Is this a major privacy loophole? Say you want to (illegaly) obtain someone's ssn. You call their employer and impersonate them and ask for the ssn or ask for a 1099 to be mailed which has the ssn. Is this a major loophole to get anyone's ssn? Is there a specific law against it besides mail tampering which is hard to prove?
You call their employer and impersonate them The onus is on the employer to keep your personal data secure. If they do not take reasonable steps to verify that the caller is indeed you, they fail that duty and can be held to account. So, not a loophole.
Nicknames, usernames, or gamer tags are definitely personal data under the GDPR. You are operating under a very narrow definition of “identifying”, which is understandable since the definition of personal data in the GDPR isn't overly enlightening at first glance: […] an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; — GDPR Art 4(1) However, this definition does show that “identifiable” should be interpreted rather broadly. For example, indirectly identifying data is still identifying data – there doesn't even have to be a strong identifier like a name, passport number, or street address. It is also not necessary that identification enables you to determine the real world identity – identification is anything that allows you to single out a person, or to combine data into a profile of that person (compare Recitals 26 and 30). In any case, an online username or user ID is clearly an identifier and will fall under one of “a name, an identification number, […] an online identifier”. If in doubt, ask your data protection authority for guidance. You've correctly understood that you will need a legal basis to process this data, and that legitimate interest could be that legal basis. This doesn't have to be your own interest, so a community interest would be OK. You need to balance the user's rights against this interest. You have performed this balancing and have found that the interest outweighs these rights. You've noted that such leaderboards are a cultural norm and are generally expected, which strongly weighs in your favour. However, legitimate interest is not a free pass but just means an opt-out solution (right to object per Art 21). You should also inform users that the leaderboard is accessible publicly when they join your server (transparency principle per Art 5(1)(a) as detailed by the information obligations in Art 13). In particular, you should use a “message of the day” or welcome message functionality to link to your privacy policy. You should also be aware that other rights such as the right to access, erasure, and data portability apply. As an alternative to legitimate interest (opt-out) you could also consider consent (opt-in), though this results in slightly different data subject rights and is more difficult to do correctly. But I'd agree that legitimate interest is more appropriate here.
Prove my work is not a trade secret violation Please don't. It's not your job to prove your innocence. The burden is on them to be specific, explain fully, and prove specific claims about your actions. In other words, don't justify, don't explain, and don't defend yourself to them. It's actually best you do not say anything to them, and just forward the letter to your legal counsel (Since you're selling software to be used in the medical field, I assume you already have some kind of legal counsel). For instance, even saying something as innocuous as "Managing patients, Exams, Bills etc are all public knowledge." could be used against you. Because it establishes the fact that you've been working on those features with them and that you've been working on those features with your new company (which doesn't necessarily follow, for all they know, you could have purchased a library module from someone else with those exact features). In other words, even if you were to reply with such an innocuous-sounding statement, you could be saving them months of cross-border discovery and litigation about some of their claims (even if you believed you were being entirely reasonable by defending yourself). But at the same time, don't take what I'm saying to mean that you should lie to them about which features you recently worked on. When I say that you shouldn't be talking to them. I mean that you should not be talking to them. You shouldn't be engaging with them and you shouldn't be giving them any shred of information whatsoever (implied or otherwise). It's not your job to make their job any easier. Do not reply to them. Don't even acknowledge the receipt of the letter (unless you already did by signing for it, which can't be helped). Use a legal intermediary. Give the letter to your own legal counsel (whether you signed for the letter, or not) and leave any reply to him or her (assuming he/she thinks this warning letter even warrants a response). And if this former employer gives you a phone call, kindly refer them to your legal counsel without saying another word.
Question: Do I need a EU passport or EU ID card to legally work in the EU (or establish that I have the right to work in the EU)? Or is a certificate of citizenship sufficient? Legally, your right to work is not contingent on this and there is no Europe-wide rule that makes holding any document mandatory. Importantly, if you do start working anyway, you are not committing a crime and cannot possibly be banned or forced to leave the country. You do have the right to work from the day you became an EU citizen and if any doubt arises down the line, you should be able to clear it up later. In practice, employers are sometimes supposed to check you are allowed to work (and for that would require some proof of your citizenship) but they don't necessarily need a passport or ID. What's typical on the other hand is that you have to provide an official proof of address (in the countries where you have to register your address with the authorities) and the local social security, insurance, or national tax number. Both of these will require dealing with the authorities and will be considerably more difficult, if not downright impossible, without a national ID card or passport (in fact it can even be difficult with a passport). I worked in multiple EU countries and I don't recall always having to present my ID to employers. I recall at least one instance (in Germany) where I could start working without one (it had just been stolen) and another one (in the Netherlands) where I started on the day after I arrived, without official address nor tax number (BSN). In both cases, I was expected to solve these issues within the first month and you risk a fine if you don't register within a week or two but it was neither illegal nor impossible to start working before all the formalities were completed. None of this means I would be completely comfortable about being months without a passport. But the main issue for you will be entering the country and what your employer's HR department is prepared to tolerate, not any sort of legal obligation to hold a passport to work. Note that in one of the cases I described above I went to the local consulate to get an emergency passport. It wouldn't have been possible back in my country of citizenship but there are some special procedures when you reside abroad. These rules change all the time and depend on your country of citizenship but that could be worth a try.
Yes, encrypted personal data potentially still is personal data, so some prior thought is necessary. But are you a controller who is processing this personal data? Possibly not. This hinges on what kind of metadata you process, and whether the encryption happens under your authority, e.g. by a software that you provision. If all you can ever get is the encrypted data but not the plaintext, then you can probably treat this similar to pseudonymous or anonymous data. A related example is a postal service. Letters might contain sensitive personal data. But the postal service is not processing the letter contents, and cannot be treated as a controller of this data. (The postal service is prevented by law from processing this data, you are prevented by the encryption). However, a postal service processes personal data like addresses on the envelope. You might want to create a Records of Processing document, which will help you understand what (potentially) personal data you will process. If you are processing patient data on behalf of a healthcare provider, you might want to look into whether you are a controller or a processor. Processor status is not automatic but requires a suitable contract with the controller. As a processor you still have to take appropriate security measures, but you are not responsible for determining the purposes of processing or for responding to data subject requests.
In all likelihood, the judge's order related to data collection and reselling is not legally enforceable. They weren't parties to the expungement action, so the judge doesn't have jurisdiction over them. And, the First Amendment protects the right to say truthful things pretty absolutely. Arguably, if the sites provided the information without making clear that it might not be current because records were expunged or corrected, there might be a claim for negligent misrepresentation, false light, or even defamation, but I seriously doubt that even those claims would hold up. The language in the order might cause sites to comply out of not legally justified concern, or just a desire to be accurate, even if it is not enforceable. So, it doesn't hurt to bring that information to the attention of such sites and ask them to take down the information. But, when push comes to shove, I very much doubt that you would prevail in court enforcing that order against them. Certainly, if you do nothing, they will do nothing, because they are not psychic and have no idea that the court order related to those records has been entered. Even a valid and enforceable order directed at a party over whom a court has jurisdiction is not effective until the person ordered to comply with it has notice of the order. And, there is no system that gives sites like that notice without you taking action to inform them of an order.
My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine. Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted. Another good clause to have in your privacy policy is to basically state if the user submits information about another natural person that they have consent from that natural person for that data and what it would be used for. The internet is the internet. People have been trolling it for years. People have also submitted false information for years. The best a business can do is simply outline what their site does, what data is collected and what it will be used for. That along with what legal basis it’s processed for and following it makes you GDPR compliant in that regard. As to withdrawing consent and the rights given by the GDPR that’s all specific to what infustructure a business has in place. As a developer I know the headaches of the GDPR. Most of it resides in the fact data is not centralized and thus can’t easily be retrieved, modified, or removed. Once you’ve tackled that aspect providing the user their rights under GDPR isn’t to far off.
Summary If they didn't steal your withholding, it depends a great deal. But if your employer stole your withholding, the IRS will sue them on your behalf. You will absolutely have grounds to sue them, and because tax law is so cut and dried in these situations, in that case, you will almost certainly win. You need to contact the IRS immediately and advise them what your employer has done. This is more important than anything else because until you do, you can't be sure the IRS will figure out what happened (they might. They're really good at tax stuff). If your employer didn't advise you that you are now responsible for paying your own quarterly estimated income taxes, the IRS will almost certainly grant you relief from penalties for failure to file timely and they could potentially abate interest as well, depending on the circumstances. They are especially likely to grant penalty and possibly interest abatement if you've never filed 1099 before. If your employer withheld tax from your pay that they then failed to turn over to the IRS, good news for you - bad news for them. The IRS takes no mercy whatsoever on employers who steal tax withholding from employees. Advising the IRS that this may have been the case is all you should need to do - the IRS can check its own records, your employer's records, etc. They will let you know once they've determined whether your money is where it's supposed to be; if anything is out of order, rest assured they will already be pursuing the case against your employer. In this case, the IRS will waive all penalties and interest that may have been assessed as a consequence of your employer's failure to turn over your withholding. If you are currently unable to pay, that's not the end of the world. Make the IRS aware of your current financial circumstances and your inability to pay due to unemployment. They have installment agreements you can request, or if that won't work, they can temporarily suspend collection action while you get things straightened out. There's a bunch of paperwork they'll ask for, and penalties and interest will continue to accrue, but as long as you let them know the situation, they will apply a dramatically reduced rate to reflect your efforts to comply.