What now? privacy problems
Photo posted without consent, data breach, stalking, ex sharing photos — what now?
- Photo online without consentStep-by-step: secure evidence → contact poster → report to platform → GDPR removal request → AP complaint → potentially court. Most cases resolved within a week.Live
- Data breach at businessProtect yourself first (passwords + bank), then hold the company to its notification duty, possibly damages claim under GDPR Art. 82.Live
- Intimate photos shared (revenge porn)This is criminal (Dutch Penal Code Art. 139h). Call 112 or file police report immediately, platform reporting, and specialised help via Centrum Seksueel Geweld or Slachtofferhulp.Live
- Online stalking — what now?Secure evidence, block, file police report (Sr Art. 285b), engage platforms, and for serious threats Slachtofferhulp + specialised help. Stalking is a crime.Live
- Identity theft — what now?Immediately call bank, block card, reset DigiD, report to RvIG and police. Then Fraudehelpdesk + Slachtofferhulp. The complete protocol — first hour to 12 weeks.Live
- Erasure refused — what now?First send a formal demand with 14-day deadline. No reply? Complaint to AP + on damage: civil damages claim under Art. 82.Live
- Unsolicited adsGDPR Art. 21(2) = absolute right to object to direct marketing. One written request = stop. No "are you sure", no delay.Live
- Business keeps callingCold calls prohibited without prior consent since 1 July 2021 (Dutch Telecoms Act 11.7). On continued calling: ACM report (€50k-€900k fine per violation).Live
- Ex keeps contacting — what now?Written cease-and-desist, block all channels, preserve evidence. On escalation: stalking police report (Sr Art. 285b) or restraining order via court.Live
- Employer monitoringEmployer monitoring requires works-council consent + proportionality + prior announcement (Dutch Works Council Act + GDPR). On violation: works council, union, AP, cantonal judge.Live
- School shares child dataChild data = AP priority + UAVG Art. 5 stricter protection. Erasure request + Education Inspectorate + AP complaint. High fine pressure on school board.Live
- Neighbour cameraCamera aimed at someone else's private property = GDPR breach (Art. 6 basis missing). Conversation → written notice → AP complaint → preliminary injunction.Live
- Recording without consentDutch Criminal Code Art. 139a/b criminal (audio + image in private place without consent). GDPR + portrait right also apply. Police report + erasure + civil claim.Live
- AI used my dataGDPR Art. 15 + Art. 17 + AI Act on training data. Request access, demand erasure, complain to AP. Major enforcement theme 2025-2026.Live
- Medical data leaked — what now?Special category data (GDPR Art. 9) — extra strict rules. Engage healthcare provider, inform IGJ, AP complaint, damages claim. High fine pressure.Live
- Bank refuses accessAccess is a hard right (GDPR Art. 15). Banks are AP enforcement priority. Via DPO → Kifid → AP. On refusal damages Art. 82 claimable.Live
- Too much info requestedData minimisation (GDPR Art. 5(1)(c)) prohibits unnecessary data requests. Ask basis per field, refuse unnecessary fields, AP complaint on systematic overstepping.Live
- Data sold to third partySelling requires explicit consent + transparency. Access at original + erasure at third party + AP complaint. Fines up to 4% turnover.Live
- SoMe photos misused — what now?Report to platform + removal request to abuser. On commercial misuse: damages claim. On intimate context: Helpwanted + police.Live
- Press published photo/nameBalance press freedom (ECHR Art. 10) vs privacy + portrait law. First editorial, then Journalism Council, then court. Journalistic exemption UAVG Art. 43.Live
- Wrong Google result — what now?Right-to-be-forgotten request to Google (Costeja route, CJEU C-131/12) + separate erasure request at the source website. Not automatically accepted.Live
- Phishing link clicked — what now?First 15 min: device offline + change passwords. First 60 min: call bank + enable 2FA + antivirus scan. Then: police + Fraudehelpdesk + GDPR actions.Live
- Password in breach — what now?Check via Have I Been Pwned. Change on all sites where you reused it. Enable 2FA. Consider a password manager. On high risk: force company notification.Live
- Account hacked — what now?Recover via "forgot password" on a clean device, enable 2FA, log out sessions, warn contacts, file police report (Sr Art. 138ab), notify business under GDPR.Live
- My data leaked — rights?Right to be informed on high risk (Art. 34), right of access (Art. 15), right to erasure (Art. 17), right to damages (Art. 82). Business must notify + take action.Live
- Revenge porn — what now?Criminal (Sr Art. 139h, max 2 years). Secure evidence, Helpwanted.nl (free + confidential), police report, platform takedown via NCMEC/Meta procedures, civil damages claim.Live
- Sextortion — what now?Don't pay. Secure evidence. Call Helpwanted (free + confidential). File police report (Sr Art. 318 extortion). Report extortion account. Platform takedown.Live
- Doxing — what now?Explicitly criminal since 1 Jan 2024 (Sr Art. 285d, max 2 years). Evidence, platform takedown, police report, AP complaint, possibly BRP address shielding.Live
- Child photo onlineChild data = highest priority (UAVG Art. 5). Platform takedown (24-48h), GDPR erasure, on sexual context Helpwanted + police + NCMEC.Live
- Google cache photoFirst remove original + then Google "Outdated Content Removal" tool. Cache disappears in 1-7 days.Live
- Signature misusedForgery = Sr Art. 225 (max 6 years). Police report + documents recovery + bank/agency dispute + civil damages claim.Live
- Tinder stalkingBlock + report in app. Secure evidence. On personal threat: stalking police report (Sr Art. 285b). On sexual context: Helpwanted.Live
- WhatsApp group unsolicitedLeave immediately + address admin on data sharing. On commercial/structural use: AP complaint (GDPR breach). On sensitive content: stalking route.Live
- Unfair reviewPlatform takedown via "report". On defamation: civil rectification or damages claim. Businesses: also consumer law + Cruijff jurisprudence portrait law.Live
- Old bankruptcy GoogleRight-to-be-forgotten (Costeja jurisprudence) at Google + erasure request to source website. Depends on rehabilitation + public interest.Live
- Photo in marketing — what now?Dual claim: portrait right (Dutch Copyright Act Art. 21) + GDPR. Immediate removal + damages claim (comparable licence fee is benchmark — Cruijff ruling). On refusal: preliminary injunction.Live
- Medical record errorsRectification via GDPR Art. 16 + WGBO (Dutch Civil Code 7:454). Doctor must correct or annotate. On refusal: IGJ + AP complaint.Live
- Hiring discriminationGDPR Art. 15 access to selection data + algorithms. Complaint to NL Human Rights Institute + ACM on AI screening. Evidence of profiling = stronger.Live
- Ex installed tracker appTwo-parent consent required (Dutch Civil Code Book 1 custody). Unilateral install = GDPR breach + possible stalking. Family court + Veilig Thuis.Live
- Email tracking detectedEmail pixels are technically hard to detect. Block remote content. On suspicion of unauthorised access: check app permissions + 2FA. Possible hack.Live
- Government asks too muchData minimisation + necessity test also for government. Request basis in writing. On refusal Nationale Ombudsman + AP complaint.Live