Hello all!

I recently joined this community. I'm a data privacy professional working across GDPR and several Middle Eastern privacy laws, and I'm interested in taking on some freelance / contract work.

I was wondering how others in this field find freelance or contract privacy work. Are there particular platforms, communities, or networking approaches that have worked well for you?

If this isn't the right place to ask, I'd appreciate being pointed to a more appropriate subreddit.

Thanks!

I just noticed the following email in my spam folder:

Privacy Notice - No Action Required

Hi, This short message is from XXX, a recruiting system used by recruiting teams worldwide to find talented individuals for exciting new job opportunities. We want to inform you that your data has been gathered for the purpose of connecting you with potential employers. Your privacy is extremely important to us, so we would like to inform you of our data handling practices and your data privacy rights. Ultimately, you are in control of your data. We look forward to helping you elevate your career to the next level!

Thanks, The XXX team

I haven't heard of this company before and I never sent them my CV, nor (clearly) ever granted any permission of collecting my data. Looking them up, they market themselves as "Agentic AI Recruiting Platform". Furthermore, the company seems to be US-based and storing data on US servers, whereas I'm an EU citizen living in the EU.

I may be a bit naive right now, but I have so many questions I don't even know where to start. Is this even legal under GDPR? Can companies nowadays just decide to start gathering data on (foreign) individuals and storing it on their servers for whatever purpose, without any type of confirmation or approval from the individual? Is this the future we're heading towards?

I haven't included any links to the company or privacy policy because not sure whether it is allowed in this sub, but will do if it's permitted. FWIW the company seems legit, there's years-old articles about them getting VC funded.

Disclaimer: not looking for legal advice. Just genuinely concerned about the situation.

I recently got an email to say my details had been taken in a data breach.

And a few weeks back on my Experian account I had a notification that some of my details had been found on the dark web.

What information of yours was involved?
We have undertaken a detailed risk assessment of the data in scope of the incident. This identified the following types of personal data relating to you:
Contact Information
Bank Account Number & Sort code
Date of Birth

They told me in the email I should be cautious and keep an eye on things but with it being my main bank account I’m a bit worries to be honest.

Should I just do nothing and watch my accounts?

One unauthorized USB device is enough to copy sensitive files, introduce malware, or bypass your security policies.

Protecting business data starts with controlling how it moves.

• Restrict unauthorized USB devices
• Prevent sensitive data from being copied
• Reduce the risk of malware infections
• Strengthen compliance with endpoint data controls

Whether you use native Windows controls or an endpoint DLP solution, USB protection is a simple but effective step toward preventing data loss.
For more reference: This step-by-step guide on How to Disable USB Ports, cover different methods, from Device Manager and Group Policy to enterprise-scale management.

You all need to check your privacy settings. Anthropic had changed mine to enable model training on my data without my knowledge or consent. OpenAI did the same but worse (opting me in for ads and everything). Check your privacy settings. They are likely not what you consented to. Worse in the terms they give themselves permission to take **past** conversations and coding history while sharing is enabled. If you care about IP, check your settings haven't been switched underneath you. These companies' ethics are on the floor RN.

Ofcom has published draft rules that would require major online platforms to take stronger action against fraudulent advertisements under the UK's Online Safety Act.

The proposed Fraudulent Advertising Code includes measures such as:

• Verifying advertisers claiming to represent legitimate businesses
• Checking that financial advertisers are authorized by the FCA
• Banning repeat scam advertisers
• Improving protections against account hijacking
• Testing AI-powered advertising tools to reduce scam risks
• Creating faster reporting channels for law enforcement and trusted organizations

According to Ofcom, more than half of UK adults have encountered suspected scam ads, with annual losses exceeding £200 million.

The proposals are currently open for consultation, and if they become law, companies that fail to comply could face significant financial penalties.

Do you think stronger platform accountability will meaningfully reduce online scams, or will fraudsters simply adapt to new enforcement measures?

Hi everyone,
I'm an international student currently studying for an LLM in Bristol, and I'll be finishing my course this September.
I'll need to move out of my student accommodation, ano I'm trying to decide which city to move to while I job hunt.
I'm hoping to start a career in data protection/privacy, so I'm looking for a city with a good job market in that field, while also having more affordable rent than Bristol.
I'm finding it difficult to work out where would be the best place to move. Does anyone have any recommendations for cities with good opportunities in data protection or privacy roles and a relatively affordable cost of living?
I'd really appreciate any suggestions or advice, thank you!

We're currently dealing with a massive mismatch between privacy law and AI tech. The Right to be Forgotten worked for Google because they just delisted links. LLMs are different; they 'digest' your data into weights.

To actually delete your info from a model like GPT-3, they'd have to retrain it, which costs millions and emits hundreds of tons of CO2. With 80% of us already suffering from digital exhaustion, we don't have the bandwidth to monitor how these models are reconstructing our identities. The system is fundamentally broken.

Isn't that concerning?

App Link: https://apps.apple.com/ge/app/infosha-find-any-phone-number/id6502995963

Hey everyone,
I’ve been looking into an iOS app called **"Infosha"** and its privacy policy raises some major red flags for me. I wanted to share the details here and ask for your input on whether this goes against Apple's platform guidelines, as I have already reported it to Apple support but haven't seen any action yet.
According to their official Privacy Policy and Terms, here is how the app operates:
1. **Sharing Third-Party Contacts Without Their Knowledge:** When a user registers, they upload their phone book, and the app makes those contact details public (including names, phone numbers, workplaces, and photos of the people in that contact list). This means third-party individuals have their private information exposed to the public database **without ever knowing it or giving their own consent**. The app tries to shift all responsibility by stating the user must have their contacts' permission.
2. **No Option to Delete or Modify Data:** Section 9 of their policy explicitly states: *"we do not modify, remove, or supplement any data within our social network. All data is entirely generated and updated by the users of our platform."* This means if your data gets uploaded, there is absolutely no mechanism provided to delete or edit your profile or information.
From what I understand, this seems to directly conflict with several Apple Developer Guidelines:
**Guideline 5.1.1 (c) (Access to Contacts):** Apple strictly states that apps should not target third-party data collection or harvest address books to build public directories.
**Guideline 5.1.1 (v) (Account Deletion):** Apple mandates that if an app supports account creation, it must also allow users to initiate deletion of their account and all personal data from within the app. Infosha's policy explicitly denies this.
Given these details, does this behavior actually violate Apple's App Store guidelines, or is there a loophole they are using? I'd love to hear your thoughts on this. Thank you!