Hi all,

Me and my partner have just reserved a new build house.

The developer recorded my partners email incorrectly (he wrote it down correctly on the form and they’ve copied it to their system incorrectly).

This has resulted in our reservation contract being sent to the wrong email including our names, addresses, new home address, price of plot, email address, mobile number etc.

The email they sent it to doesn’t exist so they had an undeliverable response.

My question is does this still break GDPR? Is the act of sending information to the wrong email violate GDPR regardless of whether it’s ever received by someone? Or does it have to be received and or opened for it to be a violation?

Many thanks for any help.

I am a graduate of Law in the Netherlands and I would like to pursue a career in data protection law. I found these certifications in iapp, there is one that focuses on the foundations of privacy and data protection. I wanted to ask if this one is beneficial, or should I save money and go for the official CIPP/E?

Hello, 2 years ago I left my doctors surgery and moved area. A couple of days ago, they have emailed me but the email is for another person. It discloses a missed injection appointment for a vaccine coming up.

I contacted them, they were horrified and asked me to forward them the email. Funny they asked me to forward it to the email it came from!!!

They were going to call me by the end of the day…… 18 days later I’ve heard nothing.

I know the email was for someone else, but by receiving the email, why was my email and details associated to it?

Have they done anything to my data incorrect?

What should they do now?

Should they at least have contacted me after? They said they would?

Thanks in advance

My work at the local council has a public network drive with files such as contractor invoices with their business address and how much they charge, historical meeting minutes, employee qualifications, incident forms etc.

Is it against GDPR on the employers behalf to give everyone access to these files or would the employee accessing them out of interest be breaking rules?

If so, how would the employer or IT department know that the files have been accessed?

What would be the consequences and what if the employee had not been provided with GDPR training?

I am fairly new to this GDPR stuff and making sure my client's site is fully compliant is way harder than I thought.

The client site is made with WordPress, CF7 + Google reCAPTCHA. The problem is Google reCAPTCHA automatically sets cookies that stays 180 days in users' browsers before it expires.

Is it GDPR-compliant or should I be worried?

I was fascinated by the conversation in a subreddit post: Is EU data hosted on US servers legal?

The top response had a suggestion: "Ask a lawyer that knows their shit in terms of GDPR."

My question is, where do you find these people? I'm in the US.

I Google searched "EU GDPR lawyer" and I do see a lot of law firms advertising their services. Hard to know which of these are good.

Also, do you really need a lawyer? Or are there just really knowledgeable people who worked in IT that would be just as effective?

Hi, I have asked for my Snapchat account to be deleted and I am currently in the 30 days deactivation period. From what I gather you can also request for GDPR deletion but I think I am incredibly dumb... I can't find where or how to request it and Support isn't replying. Anyone know where to look to file the request?

Is there a minimum length of time after a client has left your service, you are required to hold onto any information?

I'm a university applicant who made a SAR to better understand why I was rejected, so that I know what I'm lacking.

However, after making a SAR, the university replied with information that I already have, including my name, address, personal statement.

That's about it, they did disclose any of their comments about my application (the rest was redacted).

However, another university I requested from gave me the information including their comments on my application.

Question: Can I request for information about my application including their comments when making a SAR?

Thanks in advance, I apologize if I'm not too familiar with the process.

Update: Thanks everyone for the advice 🙏🏻, I have written to them again to see what they can provide. This time I specifically requested for their comments.

Hello

My company based overseas has decided to implement a Data Privacy Program. We are an accounting firm that operates in Asia and North Africa.

Where do we even start? Is there a good template roadmap we csn use? Or resources that will help us build it out properly up to gdpr standards?

Please bear with me, I have only a basic GDPR knowledge.

Controller is located in EU. We're a processor located in the US (have a DPA + SCCs in place with controller). Controller wants another of its processors (let's call them Processor 2) to share controller's personal data with us, rather than receiving the personal data directly from controller. Processor 2 creates pseudonymized IDs for the data, then passes the pseudonymized IDs to us for advertising. Lawful basis is consent, and procedures are in place to comply with any withdrawals of consent.

We would only accept personal data (the pseudonymized IDs) from Processor 2 upon controller's written instructions. We do not have a direct contract with Processor 2, so they are not our subprocessor.

Can we accept personal data from Processor 2 on behalf of controller? I want to add something to our contract with controller that holds controller responsible for actions of Processor 2 - can I do that?

An organisation sent me a message 41 days later about a subject access request after I got a complaints advocate to prompt them:

“I apologise for the delay in receiving your information. We are working on your request and will respond as soon as we can

Thank you”

What would you recommend I do? They didn’t give any info on how long it will take them or anything. I’m not sure if I should contact the Information Commissioners Office about this.

Hi. I undertake surveys for bats for clients who are seeking planning permission for development. Bats and their roosts are legally protected in the UK. I found a bat roost and recommended additional surveys. The client commissioned the surveys from another consultant and in the mean time appears to have removed the bat's access to the property. This is very likely to have been a criminal act. The other consultant and I want to share images with each other to corroborate and work out what has happened and what the next steps are, e.g. to call the police.

My original report is in the public domain, but the resolution on the photos is poor. Can I share the original photos, and photos that aren't in the report with the other consultant, or is this breach of GDPR? Would even having a conversation about it and me saying over the phone "no, there wasn't expandable foam in that hole when I was there" be a breach? If we are going to cause a police investigation, I don't want the client to be able to come back at us for revenge, so I'd appreciate to understand were we are with this.

I will shortly be amending my contract to include a clause that covers this better. By my contract, the intellectual property and related material is my property, which I assume to mean the photos taken are mine to do with as I please, but perhaps not. I will shortly be amending my contract to include a clause that covers this better.

2 months ago I started a new job.

I signed a document which said they will use my picture for the security badge. The legal basis they chose was consent.

Now I've realized this picture is not only on my security badge but also is being used on an internal website which every employee can see, it's used on presentations, on awards, on conferences, etc.

Is this okay? Considering originally what I signed was only "for the purposes of obtaining a security badge" and the legal basis consent.

Thanks!

I've been looking everywhere and can't find an exact answer in respect to GDPR rules about whether you need to give your legal name and address in the Privacy Policy or Imprint section of your website.

In the Privacy Policy, can I just put:

Mywebsitename

PO Box Address
privacy@mywebsitename

For a newsletter, it's clear that you need to provide a real physical address (can be a PO Box). But I've found some sources saying you need to put a name, but most of them say nothing about it.

Looking through the newsletters I'm subscribed to, they all seem to use the name of their website or business.

So would it be GPDR/legally compliant if at the end of your newsletter you put:

Mywebsitename PO Box Address

Does it matter if your business is registered? Where I live, as soon as you make money you're considered a sole proprietor without any paperwork.

I'm always trying to protect my personal data, but I cannot think of a way to go around this if it happened in EU

https://www.bitdegree.org/crypto/news/crypto-exchanges-ordered-to-share-user-data-with-australian-tax-office?utm_source=reddit&utm_medium=social&utm_campaign=r-australia-data

Hi, not sure if that’s the right place to ask this, but I started a data startup and need some guidance on GDPR Compliance. Obviously specialists on this issue are super expensive, £500-650 per hour. There are quite a few subscription based law firms that offer legal advice, doc review, etc. Some of them sound suspiciously cheap, for example £100 per month.

Had anyone had any experience with such firms? Do you think it’s a viable way to get legal guidance or the only way is to pay big?

Any advice is appreciated.

PS, if anyone would like to join the startup as a GDPR/legal specialist, let me know, I’ll send you the pitch deck

I recently filled out the following form on a property sales website to arrange a viewing of a house for sale.

https://preview.redd.it/gs923x2ktyyc1.png?width=836&format=png&auto=webp&s=7b5e3a2226a7589c7fa7d73874ad2930883fffb1

I used autocomplete to fill in the form with my own personal mobile phone number and email address. Shortly after I received a phone call from the property agent to confirm a viewing of the house.

Not long after, I received an email from my estranged ex-partner who received the email confirmation of the house viewing and she forwarded it onto me, as she assumed it was me as it was address to a "Mr" with my surname. The only information in the email linking it to me my title "Mr", my surname and the address of the property in question.

I believe my ex was contacted because we lived together (many years ago) and we used this letting agency to manage the house we rented. After splitting up, she stayed in the rented house and I moved home. I continued to receive emails about the property but phoned up and confirmed that I no longer lived there and that she was the sole renter of the property. The letting agency agreed to remove me from correspondence. Unfortunately I don't have a written email confirmation of this as it was agreed to over the phone. This is the only explanation that I can think of that she was contacted.

I've contacted the branch manager of the property agent to ask why was she contacted and for them to update their database, but I still haven't received as much as even an apology.

It is not the case, but what if my ex wasn't of sound mind, abusive or a stalker. This business just handed over my potential future address to someone without consent.

Essentially, I would like to know if this breaches GDPR or a privacy policy of some kind so I can make a formal complaint.

Hey! I've been using Auth0 for authenticating my users, but with scaling it seems too expensive for me. I've been eyeing Firebase and other cheaper options, but it seems like their servers are exclusively in the US (which is a no no for GDPR, with data leaving eu and all that). Has anyone dealt with creating a safe authentication for logins within EU and what have you used? Appreciate any help I can get! Thanks in advance!

Hi all, I really need some help because I can't find concrete answers to my questions in ICO guidelines or examples.

Some context:

I am PhD student (at a Scottish university) who had to change supervisors because my previous supervisor "A" decided I wasn't capable of doing a PhD. Instead of telling me this so I could switch to another supervisor, A decided to attempt constructive dismissal by removing my access to facilities and equipment as well as excluding me from the research group (trying to reassign my desk, removing me from shared messaging groups) to limit my access to personal and professional support. I ended up having to choose between quitting my PhD or filing a formal complaint - I chose the latter.

For clarity, it is not your supervisor's job to decide whether or not you should be doing a PhD; their only job is to help you get your PhD. PhD students have annual reviews at which we are independently assessed and there is a graduate progression committee who decide if you are doing well enough. If you aren't doing well enough, you are given opportunities to catch up. I had passed my first annual review (clear pass, no catch-up work) less than 4 months before my supervisor decided that I didn't deserve to be there.

The DSAR I made:

After filing the complaint, I submitted a DSAR to the university asking for all digital/handwritten correspondence/notes to/from A (it was more detailed but that was the gist). The university asked A to fulfil it, despite me asking them to ask IT to do it and explaining that I had filed a formal complaint against A and therefore A had a vested interest to withhold information.

The problems and my questions:

The response was notably missing a lot of information, for example I started my PhD several years before the first email that was in the response. My research group also uses a third-party messaging app that is not monitored by the university and not a single message was included from it. I knew for sure that information was missing because I had been sent some emails and app messages independently that were not included in the response (and the messages were still on the app when I received the response). Also, the information that I was sent was heavily redacted, including parts that were clearly solely about me (i.e. in email chains discussing my supervision, performance and lab access).

I complained to the university, providing specific examples of missing information, and asked them to explain how they verified compliance. Specifically, I asked them how they verified that all relevant information had been included and that A hadn't excluded relevant items or deleted them since receiving the DSAR. The university's response was that they did not verify (and do not in general), they just assumed A hasn't done anything illegal because they issued warnings. They also said that they would not ask IT to (re)run the DSAR because, even if they did, they would not ask IT to do any more than A had done i.e. they would not ask IT to check backups or to check if relevant messages had been deleted between the date of my request and the response. Hence, IT would only be able to provide the same information I had already received (under their assumption that A had not withheld information).

To me, this is a clear statement that the university does not do anything to actually verify compliance, even when given specific examples of missing information. Is this approach legal - trusting an employee that is currently under investigation to follow the law and not verifying via IT even after being given examples of missing information?

They also do not check backups, despite these holding personal data. Is it legal to refuse to search university backups (I assume this has to be done by IT)?

I also asked the university to explain the redactions. Most of it made sense but they said that they had redacted "personal opinion" as it was classed as 3rd party data. It is clear from the subject lines of the redacted emails and the content of the unredacted emails that I was sent separately that these personal opinions were professional judgements on my performance (my approach to work, my rate of progress, etc.) and were used to make decisions about my PhD (whether I should continue, whether I should have lab access). Many of these were unfair and derogatory, which constitutes bullying according to university policy. A had also made discriminatory (according to the UK Equality Act 2010) comments during meetings and I suspect these are also contained in the redacted portions (and missing emails).

To me, it was inappropriate to redact information that was used to make professional judgements and recommendations. Is it legal to redact this kind of information?

I also feel that redacting this information makes the university complicit in covering up bullying and potentially discrimination by an employee. I appreciate that this may be beyond the scope of this forum, but I would like to know is it legal to still redact information where it evidences violation of organisational policy and/or UK law?

They seem to scrap data around, and put it under sale. There's also informations that they would not had information to, unless they had access to my resume, so either they planted in the past fake advertising to get resume, or some asshole gave them the data in a way or another

Please help me to spread this news, I deleted my account 2 years ago but I just realized that they never delete my ip!!! This is a big breach of GDPR.

I used to play a game about 3 years ago from a German company. As I have no further interest in ever playing I sent a request for them to delete all data related to me from their systems.

I have gotten a reply today claiming they would need to keep my email which they claim is stated in their terms and conditions as a means to track the status of my account, specifically related to the email.

I would prefer they not keep my email on their system and be completely forgotten.

My question is do they have to right to hold / keep my email for this reason?

Hi everyone!

I recently took many photos of an Orthodox Easter Procession in Greece. It was a litany in which many marching bands go around the town playing music.

So I took photos of the marching bands playing because photography is a hobby of mine.

There are a lot of wide shots but the faces of the people can still be seen clearly. I've also taken photos that are more focused on one subject and some the musicians playing without their face getting in the shot but you can see faces of spectators. I think what complicates matters even more is that usually there are teenagers playing in these marching bands too.

I thought some of the photos were good and I thought of maybe uploading and selling them online on stock photography websites. There are photos like that from older processions on those sites but I noticed that there weren't any from 2019 onward. Nevermind checked again using other keywords. There are newer photos. There are even photos of students that take part in those processions. Is it legal though?

Then I was thinking that at university graduations there are usually a lot of photographers taking all sorts of photos that they later upload on their website and charge for them. I've never given them my consent but I know there are photos of me on those sites.

Is it okay in public events or are they just violating the law without caring? Is it maybe different because their websites are Greek while the ones I'm thinking of uploading my photos aren't?

If time is money, I've probably wasted quite a bit of time on this thinking of how I could make very little money selling these photos but oh well.

Thanks in advance!

Hello! I have a very old website I am updating and want to add a banner at the top stating it is undergoing maintenance. However, I want people to be able to close the banner and for it to remain closed once they do. Would keeping track of that closure count as strictly necessary? I don’t want anyone having to reclose the banner every time they refresh the page or open any new subpages as it would get annoying pretty fast.

I prefer not to add a full cookie consent pop up as no data is collected otherwise and never will be. As such, I don’t have a cookie policy to link to at all. The website has a ton of legacy code and I want to keep changes minimal to not break anything. The banner is a small maintenance heads up only

A colleague approached me to say within their SAR, there was an email thread between HR and Occupational Health with my health information, including a diagnosis I have that I wanted to keep private. He said he’d report it as a breach, but I’m concerned.

Has he breached GDPR for telling me, even though it’s my data? I want to make sure it doesn’t happen again, but this colleague is a friend and I don’t want to get them in trouble and I also want to make sure my information is safe.

Thanks!

Hi, just wondering if I'm allowed to display a list showing each staff members remaining holiday hours for the year ? We get a few coming in and asking, so thought maybe if we just put up a list, everyone knows where they stand? Is this against gdpr? All it would display is the staff members name plus hours remaining. It would only be displayed in the staff canteen. Thanks in advance.

Hi, I have ordered some goods online from a French online merchant. It's been over a month and I haven't received my order. I contacted the merchant and they claimed that my address is "nonsense". I tried to explain to them that this is the address that I've used for all international shipments so far. So they asked for a photo of my ID in order to send a new package, because "maybe the original is lost"?!?

I'm definitely not sending them a photo of my ID card just to get what I'm entitled to get, but my question is - is this legal in any way? What are my options here, should I just issue a charge-back on the Credit Card and be done with them?

Hi, one of the biggest Czech web search engines started to give this option. You can pay for non-personalized ads and your data privacy or if you do not pay they share your location data, history of visited websites, targeted ads, etc. I am wondering if this is against GDPR. Thx

https://cmp.seznam.cz/nastaveni-souhlas

https://preview.redd.it/w77z49peidxc1.png?width=986&format=png&auto=webp&s=e9c7a2cbf9ed081c33bf7332f2a67a416a3d561a

https://preview.redd.it/vvjhur0lhdxc1.png?width=1097&format=png&auto=webp&s=d4d33615183c31592284337813f336c0d9be4d67

Recently there has been a ruling regarding pay or consent within the EU ruling metas proposal of a subscription for no personalized ads invalid.

What difference is there in Netflix's current monetisation model( and similar streaming providers) and meta's model?

Does this ruling affect streaming providers that serve ads as well?

What are the problems with metas proposal?

I have heard people mention that metas price was to high but at least a couple years ago meta earned more money per user than Netflix did in the US.