New answers tagged privacy
2
Which countries' law should be considered for Privacy Policy and Terms of Use in a localized website
It totally depends on the countries (versus languages) of your target audience.
A Chinese version of a website domiciled in the UK does not necessarily target visitors living in China. Absent any other clues, it targets visitors who prefer to use Chinese language. These can potentially be anywhere: for those in the UK you will need to have mere translation ...
2
Which countries' law should be considered for Privacy Policy and Terms of Use in a localized website
International contracts are tricky
(Which is not to say that intra-national ones aren't tricky)
Let's say you are based in the United States and put in your terms of service that it will be governed by the laws of Washington - like this. While choice of law is generally upheld as valid in most jurisdictions, there are some local laws that cannot be ...
2
Which countries' law should be considered for Privacy Policy and Terms of Use in a localized website
Should a multi-language website have different privacy policy and terms of use content for the languages it implements?
No, absolutely never. Even if you opt to have translated versions of your terms of use available, every single version of your terms needs to include all of the same content. You cannot guarantee a French user will read the French language ...
0
"Shall be able to demonstrate" means what it says. It does not mean having a signed piece of paper.
Typically your database will have a boolean field with "True" indicating that the user has clicked the "I consent" button at some point. Gathering this information is trivial. The difficult bit is demonstrating that the database fields reflect reality. For ...
2
Under GDPR the principle of Data Minimization rules that companies should not keep Personal Data that is irrelevant towards the fulfillment of a given service they render you.
So, YES, you can "hide"/ cover" Data on any document that goes beyond what is "vital" to ensure the Service is rendered.
Let's imagine I am to become a member of a Library, I can blur ...
0
Personal Data is any Data that either on its own or when cross-referenced with other Data allows the univocal Identification of a Natural Person. So for the company towards which you register to get your "steam Account ID", YES it is Personal Data, for they can identify you through it; it is also Personal Data for any partner they share such identifier with ...
2
Since the Steam ID contains or may contain enough information for it to be possible to link your account to you as a physical person, it would definitely be considered "personal data" according to Article 4 of the GDPR.
However, by agreeing to the DOTA2 terms of service, you have given consent for them to show your information to other players (or at least ...
0
Both solutions are legally invalid (although your client's idea is better)
There are a number of things that must happen to create a binding contract (see What is a contract and what is required for them to be valid?). One of these is that both parties must agree to be legally bound.
When they download the app, the user is agreeing if you give them a click-...
3
Businesses do hold customers' email addresses. These are routinely stored and communicated between the businesses' internal IT systems. There is nothing illegal about this.
The only difference that internal email communication makes to the above is that not just machines but employees see the customers' email addresses. So, essentially the question is: is ...
0
There are numerous notarisation approaches you can take, including printing out the agreement when you accept it, taking it to a notary public or solicitors and having them officially notarise it. This may cost you money, but it gives you a document with a date, time and official seal of a notary public on it.
There are other ways also, such as taking a ...
1
The Internet Archive (IA) routinely takes snapshots of websites, indeed of much of the content on the web. Their service can be used to demonstrate the content of the site on the date of any such snapshot. They also have a procedure by which anyone can request a snapshot of any web page at any time. Although they do not guarantee to comply with such requests,...
1
From GDPR Article 2:
This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
A blood sample is not "personal data". If information is derived from the sample then ...
0
Well, thank you for all your feedback...
Now the answer :)
A Blood Sample is NOT Personal Data, however, it is something similar to a biological Hard Drive, meaning a repository which contains identifiers that constitute Personal Data (DNA; Blood Type; other...).
Personal Data (and someone gave the example of a facial photograph) is any Data that either ...
2
If you mean the actual sample - no. It’s a physical thing, not data.
If you mean the results of testing then yes if they can identify an individual (like a DNA sequence) or are linked to an identifiable individual and no if they don’t (like they are part of an anonymised database of thousands of results).
-1
They would basically be out of Business and the owners in prison in a very short time frame since they are breaching almost everything there is ruled under the Law in terms of Privacy...
-2
I wouldn't worry about it too much... you are not a company nor did you share PERsonal Data with 3rd parties (the ones who got it did so under a context that the Data Subject had defined), therefore GDPR does not apply.
As said there was no theft only "appropriation" for a limited time frame and with the owner next to you.
Charges may always be raised on ...
0
No.
In ECJ’s Breyer decision the "website" was run by the German Government. It was therefore deemed to have "the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person" because it could legally order the ISP to reveal who is behind a particular IP address.
The same logic does ...
0
Personal Data is any Data that either on its own or when cross-referenced with other Data enabled the univocal identification of a Natural Person.
So, in the same way, your Car license plate if Personal Data when someone who has access to a repository that identifies you as the owner; anyone's IP Address is Personal Data when cross-referenced with other ...
1
In the US, there is actually a lot of legislation that protects people from such annoyances. For example, if you are on the National Do Not Call List then telemarketers are not allowed to call you. They will still call anyway on occasion, "by accident". You can then ask them to take you off the list, and they will usually comply. Unfortunately you will have ...
1
1) theft (Diebstahl) : Intension of permanently retaining another persions belongings
not fulfilled
2) possible, if the person envolved may choose to do so
3) Grobe Unfug (serious mischief), also possible if they choose to do so
Wiki (in German)
https://de.m.wikipedia.org/wiki/Bel%C3%A4stigung_der_Allgemeinheit
2
If the commercial service is in Germany, then they are in for loads of trouble.
Persönlichkeitsrecht (in German)
https://de.m.wikipedia.org/wiki/Pers%C3%B6nlichkeitsrecht_(Deutschland)
The right of protection of personality is a constitutional right that has been confirmed in many ways by the constitutional courts.
A corporation may only be registered / ...
0
Here’s a cybersecurity perspective. Cookies can have the ability to do a wide range of things. In addition to small arbitrary data, cookies can be used for authentication mechanisms and trackers. This from Wikipedia on tracker cookies:
...tracking cookies, and especially third-party tracking cookies, are commonly used as ways to compile long-term records ...
0
Under GDPR Personal Data is any Data that either on its own (e.g. a photograph) or when cross-referenced with other Data enables to univocally identify one given natural person.
If user generated content allows the identification and/ or Profiling of that natural person then... Yes.
At least for the platform such "link" between the person and the ...
1
Yes
Posts on social networks are explicitly called out as personal data.
0
Cookies are 3rd party pieces of software that may gather Data that you are unaware of, so disabling the IP addresses on your end side, does not mean Privacy Assurance.
You need to have a proper Cookies Policy, the ones which are "mandatory" as a Service Enabler need to be explained as such and all must have a manufacturer description of "purpose" and "scope, ...
0
Within the company premises/ office/ shop, as long as there is a two-factor authentication (e.g. phone number and email, not only phone number) it is a matter of Service requirements versus Data Subject's Consent versus Risks.
Even if there are some rare names, as long as you do all within your power to ensure that the person Logging in is the Data Subject ...
1
I agree with wimh's answer. There are some points to add:
a phone number is not unique; one number may be shared by several customers in the same household. This is the fundamental problem with the proposal.
loss of privacy may cause serious damage. If Mrs X logs on and sees Mr X's transactions, she may wonder where the item that that Mr X bought, as she ...
3
Art.5(1)(f) contains:
Personal data shall be:
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
Art. 25 ...
3
The law involved is the US Federal Family Educational Rights and Privacy Act (FERPA), which is described at this Department of Education page. FERPA applies to schools and other educational institutions that receive certain Federal funds. It does not apply to other organizations, unless such organizations receive educational information under a contract that ...
0
Yes, it is intended.
Good would be to have a button together with the message to turn of cookies. This is rare, but for example slashdot.org does this.
Some reasonably good sites let you turn off all cookies with three clicks; it looks very much like they all use the same software for this.
Other sides make it ridiculously difficulat. arstechnica.com ...
2
Consent for cookies is not mandated by the GDPR, but by some member states' implementation of the ePrivacy directive. Specifically, cookie consent
isn't required for processing personal data (which the GDPR is about),
but for storing anything on the user's device unless this cookie is technically necessary (e.g. session cookies, preferences).
This leads to ...
Top 50 recent answers are included
