16

The GDPR allows the right to access to be limited if this access would “adversely affect the rights and freedoms of others” (Art 15(4) GDPR). However, access to the recording would not give you more information than you've already received during the phone call, so this exemption is quite unlikely to apply in any case. UK data protection law also has a large ...


15

Of course, remote access tools and remote administration can be legitimate. But such tools also have substantial potential for abuse. You as the app provider might have a responsibility for ensuring security and safety of your system. In particular: consider whether other mechanisms are more appropriate for sharing pictures, e.g. a messenger app the user ...


14

I do not have the phone number, email, or anything else associated with the account. Well, neither do I - so it must be my account. Unfortunately, the fact that you appear in most or all of the pictures on that account does not prove that you own it. It could be the photographer's account. Do I have ANY options here Can you reactivate the email account ...


14

Community Service Announcement A person going missing is serious. Many thousands of people disappear every year. In most cases they return or make contact with friends or family after a short while, however, a significant number are never heard from again. It is a MYTH that you need to wait 24 hours before telling the police of a missing person. Alert the ...


13

When they refuse to give you control over the account because you can not (or they don't let you) prove that it's your account, then another option would be to report it as involuntary pornography of yourself. The penalties faced by platform owners for not removing such content on request are severe. So that will leave Twitter no option but to remove the ...


10

In lieu of a death certificate, a person can be declared dead by a court with probate jurisdiction under circumstances outlined under state statutes. Usually this is a combination of circumstances that make the likelihood of death nearly certain and/or the passage of a certain period of time (five years in California) without a sign of the person after duly ...


9

What are the reasons/ legal requirements that the police might need my personal information, given that I had not been able to provide any further information/ witness testimony to the incident that they were investigating? The police in england-and-wales have a duty to undertake reasonable lines of enquiry and to carry out a proportionate investigation in ...


7

I suspect that US voting records would fall under Article 2(2)(a): Article 2 Material Scope ... This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; I doubt it would be possible to argue successfully that a foreign election is anything other than "an activity ...


4

I don't think you would be responsible for whether your software is used in a GDPR-compliant manner. For GDPR compliance, it is important who the data controller is. The data controller is whoever determines the purposes and means of a personal data processing activity, i.e. the why and how. The data controller alone is responsible for their GDPR compliance. ...


4

england-and-wales If someone disappears with no report, what happens? Nothing, as no one knows about it to do anything and the law does not make any provisions for a lack of reporting in these circumstances. Is a death certificate ever issued? No, as the authorities are not aware that the person has disappeared / died. Again, the law does not make any ...


4

Art 13 GDPR is about information to be provided when data is collected directly from the data subject. This information can be provided directly during/before collection. It is not generally necessary or useful to send the data subject an email with this information. Usually, a SaaS website will provide the information under Art 13 as part of their privacy ...


3

There are multiple issues with what you are trying to do, including issues with copyright, personality rights, and data protection. You are trying to use other people's content and likeness for your advertisement. Unless you are certain that you can do this in your relevant jurisdictions, without their consent, this sounds like a very bad idea. At least ...


3

Yes. It is legal for them to do so. Also, they are often required, by their insurers and lawyers, if not as a matter of law, to maintain them for seven years in most cases, so that the information is available if a lawsuit arises from any of their dealings with you (e.g. if they receive notice of a lawsuit involving a Zipcar you were allegedly using or had ...


3

What can Mr. Johnson be charged with? In england-and-wales this would be an offence colloquially referred to as revenge porn contrary to s.33 of the Criminal Justice and Courts Act 2015 (1) It is an offence for a person to disclose a private sexual photograph or film if the disclosure is made — (a) without the consent of an individual who appears in the ...


3

No, The SaaS company should strive to be a Data Processor for the web agency, and the web agency will likely want to be a Data Processor for its customers in turn. A Data Processor processes the personal data only as instructed by the Controller. The SaaS company should not be a Data Controller itself. Being a Data Processor requires a contract that fulfils ...


2

In most US states, information on one's own voter information, including registration details and voting record, is available from the state without any need to invoke the GDPR, for any registered voter. For example, in Maryland one can visit this web page to request from the state Board of Elections one's voter registration record, and various other ...


2

This is a very interesting question about the territorial scope of the GDPR. As previously discussed on this site and as supported by Art 3(2) GDPR and EPDB guidelines 3/2018, the GDPR only applies to non-EU data controllers for processing activities relating to the offering of goods or services to data subjects in the EU. Here, the controller offered ...


2

Applicable Law There are (at least) two levels of regulation involved. At the state level, all fifty states and all or almost all U.S. districts and territories have enacted laws requiring notifications of data breaches. Under the Securities Exchange Act of 1934, publicly held companies also have to make regular reports to the public via the Securities and ...


2

Indeed, the examples given by the European Commission all involve directly identifying data. It seems that the lists of examples should not be considered exhaustive or authoritative, but that they should be considered as examples of “definitely personal data” and “definitely not personal data”, thus painting a bright line between the two. Other kinds of ...


2

The GDPR is not intended to only regulate commercial processing of personal data, but is aiming for comprehensive data protection. This does also cover non-profit and political activity. The exception for “purely personal or household activities” has to be interpreted somewhat narrowly. It does not apply to all personal activities, but to purely personal ...


2

Somewhat analogous to Dale M's answer regarding California: if you live in the EU, the GDPR and its executing national data protection agencies are another, probably more fruitful, since this piece of legislation not only gives you a right to have that data of yours deleted, but also provides a third party ombudsman who should help you in case that the ...


1

Short answer: You can not deny them having records Data Privay laws in the Eu allow any service provider to process data under a necessity standard. Medical professionals are required by law to keep records and review them as needed, which meets all the necessary standards. Because of that, you can not ask them not to keep records. Your medical information ...


1

The GDPR does apply to government as well, but that doesn't mean you automatically get a right to opt out. Under GDPR, every collection or further processing of personal data needs a legal basis. Well-known legal bases are “consent” or “legitimate interest”. But instead, your country's registry will likely operate for “a task carried out in the public ...


1

Permission does not have an expiration data. Permission can be withdrawn at any time. Permission as granted can be a bit ambiguous, so if I ask my neighbor if I can use their garden hose to wash a window, it's not reasonable to think that the permission was to use the garden hose at any time for anything, unless he says that, but that result might be ...


1

There are two different things: The account and my password. If I set up the account to do my job as an employee, it is most likely that the company should have the right to access the account. If I used the same password that I use for my online banking, that's a stupid thing to do and I am quite sure the company doesn't have the right to this particular ...


1

would the GDPR apply? Your publication(s) would be GDPR compliant even if done by a company or someone with non-personal interests. That is because: politicians' status renders their views on various issues a matter of public interest (see articles 6.1.e and 9.2.g); the circumstances under which politicians state their views oftentimes constitute one or ...


1

When you collect or process personal data, you must provide information to data subjects. The required information is listed in Art 13 GDPR, though most privacy notice also include the items from Art 14 GDPR (if there are third party data sources) and Art 15 GDPR (which simplifies responses to data subject access requests). The ICO has provided detailed ...


1

GDPR does allow the processing of personal data, provided there is a permission of the data subject and/or a justification by law. Personal data needs appropriate safeguards and deletion policies. You might want to get specific legal advice for the country you're in. I'd ponder briefly if dietary preference constitutes either medical or religious affilation ...


1

Information about devices in a network is traffic data within the meaning of the EU ePrivacy Directive. Such traffic data can only be used under limited circumstances, in particular if the data has been anonymized or if the user has given consent. Traffic data can also be used for billing purposes. E.g. the ISP might have a billing model where the access ...


1

The title and the contents of your question are totally different. The title is "will they disclose my information", which is likely the most relevant thing for you. The contents is "are they obliged to disclose my information". What actually will happen: The company will ask itself three questions: 1. Will we be in trouble if we provide ...


Only top voted, non community-wiki answers of a minimum length are eligible