I requested an insurance quote online from a company. I checked my LinkedIn today and got the notification someone from these companies viewed your profile and obviously one of the companies was from the insurance company I got the quote from a salesperson from that company.

They haven't called me or anything relating to the quote but is this a breach of gpdr ?

Ok so maybe a childish question but I got a game ban on rust after my steam account got hacked I had 2fa but I probably made a mistake and did something wrong, now my question can I request to be forgotten not to lift the ban but to remove the game(rust) from my steam account.

While I understand that this might be farfetched what are the theoretical legal options or rights I have and can use?

Pretty much the title. LinkedIn is fighting bots on the platform (allegedly) but it is doing so in a manner that is quite unreasonable, forcing you to upload your official government ID in order for a chance at getting your account back.

Is this legal? And if not, who do I complain to? Resident in Spain.

So I'm moving out of my council property in the UK, but not until mid November. Yesterday my gas and electric went off and when I called the utilities company they said the landlord had called and said I would be moving out yesterday. The gas and electric account is in my name and is my account. Is it a GDPR breach that the council could get in touch regarding my account and be able to action things regarding it.

I have a client that is needing to adjust their LinkedIn ads. They used to run ads based on Groups that centered around a specific technology.

However, this option is no longer available for them with the recent update. Additionally, targeting this technology as a skill doesn't get them enough results.

My plan was to use sales navigator, type in the technology as a keyword, and then look at the companies that pop up and create a campaign around them as they have publicly stated they work with this technology on their profile either by job title, groups they joined, or content they posted.

Since I'm targeting at a company level, would this be compliant with GDPR?

I also have an option to see accounts that follow the company page, would that be enough to justify legitimate interest?

I Live in an EU country and so does the content poster. I was approached by someone on a beach in Spain and was asked to appear in a video of theirs on Youtube. Initially I verbally consented but had no written contracts or anything else signed that said I can't withdraw my consent at any time. Also the videos were posted on Instagram as well when I was only told it would be Youtube.

I asked the creator at a later date to remove my image from the videos on Youtube / IG or take the videos down. He effectively said "The posted content has too many views and would be too much work to remove" so he's no help. I have very distinct tattoos and just don't want myself to be out there like that. I'm going to try and claim my tattoos are copyrighted work if the GDPR request fails.

Has someone successfully removed content from IG of themselves in a similar context? I really believe I have a case to file GDPR with IG and Youtube but I'm still waiting to hear back from both of them.

To be clear, no payment was given to me, no contracts signed, and there were no verbal agreements that stopped me from withdrawing consent at any time.

Hi,

I own a small hosting company. I got contacted by the government economic department (Belgian FOD Economie) about 1 of my customers that was hosting a site that was not meeting legal requirements. In Belgium a website should show it's owner postal address on a website, which was not the case. Because of the hassle, and the fact that the customer didn't pay invoices, I terminated the site. So the legal infringement is gone now. However, the government is still asking for the personal details of the former client. Am I allowed/required to give those details to them? It's just some government office, not police, and there is no note of any official legal actions or prosecution. I didn't get any official document, just an email.

Thanks

thank you

My father is a court case against two other people. At one point I was a defendant in error which was then removed. I have recently been sent confidential emails about the court case including the results of a court order by the courts and the lawyers correspondence as well. Should I contact the senders?

Hello,

I'm planning on starting an anonymous complaints service as part of my UK-based organisation.

This service is around access problems involving assistance dogs and where the partnership does not want to escalate the situation and get compensation but instead just wants an information guide sent to the business' email.

I think I mostly understand how standard B2B marketing works but am uncertain how it would function where it's at a client's request.

I also want to know how GDPR/PECR/other relevant legislation may function in a scenario where the business' main contact email is a personal one (ie. firstname@company.com) if we are asked to contact them on a client's behalf

Thank you

PECB - study material available.
IBITGQ - No study materials available online. The only place to get training for this is at IT Governance. I am paying myself, and this is expensive.
BCS - No C-DPO training or certification, though it has a Foundation & Practitioner course.

I want a self-paced study mode, and I would prefer the IBITGQ certification, but there are no available study guides online without going through ITG.

I am based in the UK.

#Edit: Last paragraph.

Hi,

I have a question to enquire as to whether or not a company has breached GDPR regulations against myself. Obviously I will not take any word as strict legal advice but I wanted to clarify because of some blurred lines.

My neighbour is selling their house and I have a dispute regarding the nature of their property and a structure they have built against my property, outside of their title plan lines. Regardless of the nuances of this issue, I sent a letter to the listing agent of the property via my personal email. I asked for their receipt of the email and awaited their reply. They replied saying they had received the emails and had forwarded them on to their clients solicitor. I did not state how I was or wasn’t happy to be contacted in reply or by whom.

Today I received an email to my personal email from my neighbours brother asking to meet to discuss the letter and its contents. I didn’t reply and he turned up on my doorstep anyway. It was all very amicable but he said he got my email address from the estate agent. Said it was “public record”.

Obviously the solicitors/estate agents would have shown my neighbour the letter and it is clear who it is from as I am their only neighbour. My question is; did the estate agent or solicitor breach GDPR by (either knowingly or not) passing on my personal email address to my neighbour? Should they have redacted my email? I never gave them my consent to pass my email address on.

Thanks for your clarifications in advance.

Last time I told them I didn't need a license I asked them to remove any data they have on me like my gdpr right to erasure. They said they don't do gdpr because they don't store personal data. Years later, I recently got a letter with my name and address on it. Does the licensing company have any special exemptions in gdpr? Why did they keep my data on file after I said to delete it?

I also told them I might not be able to respond in time to their letters due to a medical condition I'm getting assessed for and that it's not good to keep sending letters threatening to send officers to my house. They said it doesn't matter they treat everyone the same regardless. Aren't they required to make reasonable adjustments or something? Idk

I actually bought a license a while back just so they'd leave me alone but couldn't afford to keep paying for something I have no use for.

Hi guys,

I have seen a lot of, what I believe is, incorrect info online relating to sending individuals/potential customers emails due to an abandoned cart.

Many answers say you don't need consent and can just send under legitimate interests etc - surprisingly not once mentioning PECR and/or e-privacy directive. Whilst this is perhaps true for US companies, I don't think this is true in the UK/EU.

My understanding is that this type of email would classify as direct marketing and fall within the scope of PECR (UK) and/or e-privacy directive. Therefore, no email can be sent to the individual unless there's consent or somehow they've already chosen not to opt out if the company is using soft opt-in.

Surely, when visiting a website for the first time and checking out as a guest (for example), there is no way to send these emails w/o consent/utilising soft opt-in?

Grateful for any thoughts or help on this one. Thanks!

A few weeks ago I got an email from Google Adsense about a company website I had nothing to do with. Thought it was spam. I got a few more and turns out it was legit.

Obviously somehow they have my email associated with a company, by mistake.

So I replied telling them to not contact me again and to also send me all the info they had on me.

They replied immediately stating they had no information on me other than my email and the email addresses registered to this company. Which were personal email addresses of namesakes, which they provided me in full and also cced.

Ooops.... So was this a breach? Relatively minor but still I don't think this is good

They claim it's a violation of GDPR.

They already have my email on file, and I've proven it's me.

Fairly sure this violates the right to access which also extends to electronic access?

Hi Guys

I’m sorry if this question has been asked before on this forum, but does anyone know if the BCS Practitioner in Data Protection exam/ qualification is the same one as the PDP Practitioner Certificate in Data Protection (PC.dp). I need to have a data protection qualification for a job I am applying for, but I don’t want to spend £££ on a course/exam and then have to pay for annual membership renewals. The BCS exam seems the most affordable. Will sitting the BCS exam satisfy the job description requirement of having a recognised data protection qualification?

I also looked into the IAPP CIPPE but it looks a bit pointless as the practice test contained questions mostly on the history of EU/DP law.

Does anyone have AIGP unofficial study guide ebook to share with me, please 🙏 (by Nicole Joy Elmgrat

Hi all,

I recently started a new job and am currently 1.5 months into a 3-month probation period. As part of onboarding, my company is requiring new hires to participate in a photo session at the office for use on the company website.

I’ve already told management via email that I’m fine with my name and photo being used for internal communications, in our staff app, and for client security purposes. However, I’m uncomfortable with my name and photo appearing on the public website due to the company’s large size and reach. My name is unique and foreign, which would make it easy to track me down, even with just my first name.

This website photo requirement was never mentioned in my interviews, isn’t in my contract, and isn’t stated in the employee handbook or other documentation.

Questions:

1.	Can my company legally require me to have my photo on their public website under these conditions?
2.	If not, what sections of UK GDPR could I reference to support my case?

Thanks in advance for any guidance.

EDIT: Thank you all for the advice. Also replying to some of the comments, I am not in a high position at all, I’m at entry level in a blue collar job. So really I don’t see why the demand for the website pic.

Anyone woth experience of wheter these services are ok to use without data subject consent, i.e legitimate interest? And how would you live up to a disclosure obligation, cf. art. 14 - is privacy policy disclosure enough? Is the only way to use these kinds of services an a data aggregation basis? If the service provider is a processor and they do the anonymization, you can still argue that the customer instruct the processing the personal data, I guess? Also, only public data must be used via an authorization nowadays, it serms - any idea wheter that obligation is put on supplier or customer?

Thanks.

Hi all,

After reading the GDPR’s definition of a data breach, I interpreted it to include any unintentional publication of personal information on a website (e.g., when SMEs update their sites) that reveals details about an identifiable person (like a name, email, or GPS location). With my background in engineering, I decided to bring together my skills to explore this idea further.

The premise I tested was this: many websites contain publicly accessible documents with metadata, and often, that metadata isn’t processed or removed. This means that information embedded by the software used to create these files can remain intact. As a result, details about the individuals involved in creating those documents—such as names or locations—may unintentionally be exposed, likely without the company’s knowledge.

For the experiment, I analyzed metadata from documents (such as PDFs and images) on a random selection of several thousand websites. The focus was solely on the metadata, not the actual document content. What I found was surprising: only about 1 in 10 websites actively removes personal names, replaces them with aliases, or cleans out sensitive information altogether.

This oversight could pose real privacy concerns. For instance, many school websites post photos of events and activities, which in itself is fine. However, in several cases, the GPS coordinates embedded in these images were still present, potentially revealing sensitive location data. Similarly, on SME websites, “our team” pages often include photos that still contain GPS metadata, sometimes pointing directly to individuals’ home addresses rather than the office.

Realizing how common these exposures are has been eye-opening, especially regarding the implications for privacy and personal safety. I'd love to hear your thoughts on this and any experiences you've had with metadata management for GDPR compliance.

I would love to hear about what privacy professionals on GPDR do to mitigate this on their customers' websites, tools, frameworks,.... I work with privacy comapanies on this field in Spain and UK to solve this issue. Feel free to DM if this is a topic of your interest.

I have just tried to order a service for my mother, as she has a bit of dementia, from a company she has used for many years. I was told that they could not talk to me/place the order for my mum due to GDPR rules.
The service would have be carried out at the address they have on file; so just a same as last time order.
Are they correct in not talking to me "due to GDPR"?

Hi folks i was hoping to get some basic level gdpr advice.

How is a company who does not carry out marketing campaigns or have a newsletter sign up (or even supply newsletters or sales literature other than advertising our services on our website) affected by gdpr? Generally we would recieve emails for either technical support or to purchase an item. There will be a contact form on our website which will have name, email, subject and message but we would not be making the first contact and we would not push sales as we are typically responding to peoples requirement to support an obsolete product.

This question arose elsewhere, but I find it fascinating. Imagine you are recorded on CCTV somewhere. You want a copy of the footage and make a SAR. Is it possible to simply present yourself to the data controller and request footage from specific place / time that includes 'me' (the person in front of them)? In other words can you make a valid subject access request for images simply with your image, and without providing any other proof of identity? Putting it in yet another way, does the law prescribe the minimum of identification required when making a SAR?

I’m the HR office at my organisation. A colleague has shared screenshots of work emails between myself manager and the colleague in a WhatsApp group with other colleague s.

He has done this apparently to show what the organisation is ‘really like’

The top boss is speaking to him when he returns to holiday to basically it isn’t acceptable.

I just wondered if there was also a data protection element to it? Some of the people in the group are ex workers as well

I'm a student. When commuting to my university by bus I encounter many CCTV security cameras in public. Would it be possible for me to do my regular commute, and when I get home ask relevant authorities to provide the CCTV footage of me that they have (coming out of home, walking in street, waiting at bus stop, on the bus, out of the bus, going into university)?

I would like to do this because I'm learning about data protection laws and it could be a weird/fun/interesting sort of art/educational project.

Would this be possible in the EU and/or the UK?

I am working for a non-profit that works with a convention once every year. For this we have volunteers that send forms including their Swedish personal number, mail, number etc. All of this is stored on a regular consumer google account where we have no control in what country the data is stored.

I have been tasked with GDPR compliance and I see this as a big warning flag. personal data should not be transferred to a third country is pretty clearly written into GDPR and in my eyes uploading these lists of personal data that will include personal information of people under the age of 18 seems like asking for trouble.

So basically I have an idea of using some other way of doing forms so we can guarantee that it is stored within the EU. We have an internal debate going around right now where a lot of people are more comfortable with Google Drive and would like to keep using that for the handling of this personal data. My worry here is that if people would ask us about how we handle the personal data we would not be able to guarantee it is stored in a certified jurisdiction.

Am I overly paranoid and it is compeltely fine to use consumer grade GDrive for all of this data handling or is this not an option and we should find another solution immediately?

Thanks in advance.

Edit: We basically only use Google Drive for creating forms for people to fill out that then get transferred into different excel sheets. I want to make sure this is compliant with GDPR based on the hosting country. We are an incredibly tiny organization/association just starting up so we don't really have any funds to speak of

I run a marketplace for freelancers where users can apply to jobs. In my policy I have stated that I may share personal information with other services to offer the users more visibility and "other positive advantages" that are in their interest.

There is another marketplace run by government body. According to their terms anyone can get their jobs by API and use them in their own marketplace. They have in their user policy that they may share user information with other services (which in this case would be my service), they also state in their policy that the poster of the job must handle data according to GDPR.

Because I want to get these job posts from this other marketplace, post these jobs on my marketplace and let my freelancers apply to these jobs. I will then send the freelance application to the original client email.

• I will not share any information with the other marketplace but only the user who actually posted the job.
• The freelancer on my service is aware that this job originated from the government marketplace.
• In the application I'll include an image, first name, and a message from the freelancer.

Is this in compliance with GDPR?

I got this message in the middle of the day. I am a little concerned. Should i reply to this STOP of just ignore it??? Pls help. I couldnt find anything in the internet. Thanks in advance.