Is it legal to allow users to store pdfs of books in my website where they only can see them I'm thinking of creating a website where the user can create an account and upload his ebooks (pdf format) and read it from the site from wherever device his logged in to and I'm wondering is it legal to give the ability to the user to upload a copyrighted book that he purchased considering that he's the only one who can see he's ebooks plus should these files be encrypted in the database in case of a data breach.
A more general version of the question, as far as I can see, is &quot;Is Google Drive legal?&quot;. I can create an account and upload files to Google Drive, and I can open them from the cloud using various interfaces. I can directly open only certain files types, others I have to download to the device that I'm using in order to open the file. There are various file storage systems that allow this, most or all of which seem to use some sort of system of password access, file-access permissions and encryption to block access by unauthorized individuals. All systems seems to allow &quot;sharing&quot; of a specified file. Google and colleague escape liability by complying with 17 USC 512 aka the DMCA safe harbor provisions. Basically, they don't know, they don't select uploads, they have a removal procedure, they don't know that the material is infringing, and they &quot;are not aware of facts or circumstances from which infringing activity is apparent&quot;. There is a chance that you would be sued for inducing copyright infringement, see MGM Studios, Inc. v. Grokster, Ltd, specifically We hold that one who distributes a device with the object of promoting its use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement, is liable for the resulting acts of infringement by third parties You describe a situation that is unlikely to be found to constitute inducement to infringing, instead it is &quot;enabling possible infringing&quot;, and mere possibilty of doing something bad with a tool does not make you liable for selling a tool, under current US law. An eyebrow would be raised, though, as to why this service only allows ebooks to be deposited.
Whoever "derived" the illegal derivative work most likely has copyright in his derivations, unless they are not worth copyright protections. Say I take the Harry Potter books and add a few chapters and try to sell it - that's copyright infringement of course, but I have the copyright on these additional chapters. However, I don't have the right to allow you to copy the derived work. And even if you have the right to copy the original work, you don't have the right to copy the derived work because it is a different work. I could extract my changes, and allow you to take them and do with them what you like. You could then create an illegally derived work yourself. I couldn't sue you, but the original copyright holder could. To the comments: One, a work and a derivative of the work are not the same, so even if you have the right to make a copy of a work, that doesn’t give you any right whatsoever to copy a derivative work - they are not the same work. Two, the copyright holder has the exclusive right to control copying and the creation of derivative works. If the copyright holder doesn’t want derivatives to exist, then creating them, copying them etc. is always copyright infringement.
This is relatively uncharted legal territory, so until multiple cases establish some sort of precedent, we can only guess. I know of no legal requirement that a Browser or User has to submit cookies or referrer data or other meta-information accurately. In that regard, a user is unlikely to be prosecuted just for submitting HTTP headers. It is likely closely related to Free Speech issues. The DMCA spells out that it is illegal to circumvent copyright protection measures. While this law is typically used to make it illegal to copy DVDs, video-games or streaming movies, it is possible that the "3-free articles" policy could be interpreted as a copyright protection mechanism, and defeating it by changing HTTP headers is a circumvention. A good summary is here. A specific site's TOS (Terms of Service) probably contains language that spells out it is a violation to use the site in a manner other than as it is intended. This is a typical anti-hacking, anti-screen-scraping provision. Altering a browser session to circumvent their services is probably a violation of the license to access the site, and may open a user to a civil lawsuit for damages or even criminal hacking charges (the details of which are different state-to-state)
GDPR &amp; EPD require user consent before storing a users personal information. Wrong. User consent is one of the ways that justify storing personal information, but there are others. You may check art.6 to see the several reasons that allow to store personal information. In this case, it seems reasonable to justify it under the paragraph f (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Of course, that means that the data has to be used for this purpose. Avoiding spammers and other banned users would be such a purpose, but you should ensure that you do not send those e-mail address commercial information or even a Christmas greeting. In any case, be careful with anything you store. If along with the e-mail you stored more info, this could be interpreted as excessive and beyond the scope of paragraph f. For example, imagine storing &quot;User wrote nazi statements&quot; explaining why the e-mail is banned; EU laws are very restrictive about storing information about political or religious beliefs.
Forget about copyright or EULAs. In the UK this would be illegal under the Computer Misuse Act (1998) and you could be jailed for up to a year - specifically Unauthorised access to computer material. (1)A person is guilty of an offence if— (a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured; (b)the access he intends to secure, or to enable to be secured, is unauthorised; and (c)he knows at the time when he causes the computer to perform the function that that is the case. This law has been applied even to simply altering parameters in a GET request to a website, so it is incredibly broad. Other jurisdictions have similar wording, so be aware!
Is this legal? Generally yes, unless it unlawfully exceeds the scope of the license. Also, if it is, how can I check if it's permitted by the original store's EULA? Read the whole EULA, focusing on terms related to resale, assignment, and transferability.
The Right to Access is pretty absolute. However, there are some limitations: Is the service even the Data Controller for the data in question? Here, you're talking about notes of one user about another. Is the platform the controller for the notes, or would the note-taker be the controller? Or both, jointly? If the platform weren't a controller but merely a data processor for these notes, it would be illegal for them to disclose the information. Trish also correctly points out that the GDPR does not apply to processing for purely personal or household purposes, e.g. personal social media use. So GDPR would not provide a basis to compel a user to disclose their notes to the data subject, assuming that the note-taker is covered by this exception. Of course, this exception wouldn't apply if the notes are taken for other purposes, e.g. professional networking. Also, this exception doesn't affect the platform. There is an explicit limitation to the right of access in Art 15(4): The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Disclosing user A's notes about user B to user B would likely violate the privacy rights of A. The notes are both A's and B's personal data. However, the correct balance depends on context. E.g. an employer probably can't refuse to provide access to a performance assessment merely because it was written by an identifiable manager. The UK ICO has provided detailed guidance on this aspect to the right of access. They propose a three-step test: Step one – Does the request require disclosing information that identifies another individual? For example, it might be possible to redact other people's information (but not in your Mastodon notes example). Step two – Has the other individual provided consent? Step three – Is it reasonable to disclose without consent? What is reasonable is highly context-dependent, but UK data protection law gives some concrete criteria to consider. The EU EDPB has draft guidance on the Right to Access. They note that the Art 15(4) can cover a wide range of rights, not just other people's privacy rights. But as in all things, the data controller is required to strike an appropriate balance between user A and B's conflicting rights. In the Mastodon user notes scenario, I think that the note author's rights to privacy should be considered more important than the data subject's right to access those notes, thus making it possible to reject that part of a DSAR under Art 15(4) GDPR. If we assume that the note-taker A is a (joint) controller for these notes, then it would also be necessary to consult them before making a decision about the access request.
A document can be distributed under more than one license. Just because it has been made available under a CC license for free, doesn't mean that IEEE can't negotiate a different license with different terms that allow them to sell the content. (This is similar to the way that a software library can be available for free under a license that permits non-commercial use, but also be made available for a fee for commercial use.) If you want to know whether IEEE is legally selling Aaron Swartz's manuscript, you can contact Morgan &amp; Claypool, the publisher that owns the copyright, and ask them whether this use by IEEE has been authorized by them. For the other documents you mention, contact MIT Press. Etc.