Can I be compelled by law to decrypt information in UK? Is there any law currently in place within the UK that can force someone to decrypt information? Either by forcing them to supply the password/key or forcing them to provide the information in an unencrypted format. For example I am communicating with a friend over What's app using end-to-end encryption. Can the police or a court force me to allow them access to the data.
There is RIPA which allows a court to force you to divulge a decryption key. The penalty for not doing so is up to two years in prison, five if terrorism is involved. The Regulation of Investigatory Powers Act 2000 (RIPA), Part III, activated by ministerial order in October 2007,[20] requires persons to supply decrypted information and/or keys to government representatives with a court order. Failure to disclose carries a maximum penalty of two years in jail - Wikipedia - Key Disclosure Law Section 49 of Part III of RIPA compels a person, when served with a notice, to either hand over an encryption key or render the requested material intelligible by authorities. Anyone who refuses to decrypt material could face five years in jail if the investigation relates to terrorism or national security, or up to two years in jail in other cases. Controversially, someone who receives a Section 49 notice can be prevented from telling anyone apart from their lawyer that they have received such a notice. - The Register - UK police can now force you to reveal decryption keys - Refuseniks face jail time The act can be read on the government website It describes, for example, grounds for not complying ... 53 3) For the purposes of this section a person shall be taken to have shown that he was not in possession of a key to protected information at a particular time if— (a) sufficient evidence of that fact is adduced to raise an issue with respect to it; and (b) the contrary is not proved beyond a reasonable doubt.
US law (18 U.S.C. § 1030) only addresses US government computers, computers used in a way that affects interstate commerce, and those of financial institutions. Turns out, cell phones and home computers affect interstate commerce. So the forbidden acts are delimited by expressions like "having knowingly accessed a computer without authorization or exceeding authorized access", "intentionally accesses a computer without authorization or exceeds authorized access" or "knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value". Notice that the law is stated in terms of authorization to access, and not "cracking passwords". Similarly, 18 U.S. Code § 2701 uses phrases like "accesses without authorization". Each state has its own laws: in Washington, RCW 9A.52.110-130 identifies forbidden acts via phrases like "without authorization, intentionally gains access". The closest I can find that comes to a law that might imaginably have some bearing on "password cracking" is 18 U.S. Code § 1029 which prohibits uses of "counterfeit access devices". An "access device" is defined in para (e) as "any ...means of account access that can be used, alone or in conjunction with another access device, to obtain money..." (there is the usual attempt at an exhaustive listing behind the ellipses). A password cracker would then be an access device since it along with a user interface to a system allows one to access the system and thus the internet of things. A counterfeit password cracker would be e.g. one manufactured by BlackhatHackersoft which passes itself off as one manufactured by WhitehatHackersoft. However: 18 USC 1029 specifically says "knowingly and with intent to defraud produces, uses, or traffics in one or more counterfeit access devices", and the intent that you describe is not to defraud. If you want a paid analysis by a professional, you can hire an attorney. My view is that if the police were to come after you, that would be an abuse of law, because the law does not prohibit taking reasonable steps to select a safe password (something like "CorrectHorseBatteryStaple", which I hear is now just behind "password" in use as a password).
This is less of a compliance question, and more of an infosec question. On one hand, you want to be able to restore access to an account to users who have lost their access. On the other hand, you must prevent unauthorized access e.g. from hackers. These factors must be balanced. Whether you'll fulfil a data subject access request will generally follow the same criteria as deciding whether you'll reset someone's access credentials, so I'll mostly discuss identity verification in general. Trying to validate names is generally pointless from a security perspective, since the name on the account might not be real, or because validation documents like scans from a passport can be easily forged. When a service has identity validation measures like requesting a copy of photo ID, or requesting a photo of you holding up a validation code written on paper, that doesn't actually help validating that the person requesting access is the account owner, but that the person requesting access appears to be a natural person, and now documents about their identity are on file. A lot of information like names, birthdates, or addresses is also not at all secret and could be easily guessed by a malicious actor. Most websites work by equating access with control over an email account. If you can receive a password reset code over email, you have access. In effect, this delegates the responsibility of account recovery to the email or OAuth provider. So the issue is what happens when someone loses their email account, which is not entirely uncommon for accounts that are multiple years old. One reasonable (and likely GDPR-compliant solution) is to deny access when someone loses their account. Quite a lot of services operate this way. A milder form of this is to email the old address that someone is trying to take over the account, and turn over the account only if you have other evidence of ownership and there has been no reply over multiple weeks. Since this is part of an identity verification measure, I don't think the GDPR's normal 1 month deadline would apply. However, this approach is very risky: an attack can succeed through the mere inaction of the true account holder, and it would arguably be a data breach if you give access to the wrong person – safer for erasure requests only. Also, emails like “click here or we'll delete your account” look a lot like spam (I get a lot of those about alleged problems with my Paypal account). A potentially more reasonable approach is to use questions about the account to verify ownership. When did they create the account? When did they last use it? Can they answer questions about non-public content of the account? (But don't let an attacker choose the questions!) You see some older sites that ask the user to select a “security question” for recovery purposes. But this isn't a best practice – they are frequently the weakest link in an authentication system. If the user answers truthfully, the answer may be easy to guess or discover for an attacker. E.g. the infamous “what is your mother's maiden name” question is horrendously insecure in the age of Facebook. If the user provides a more secure answer, that is essentially just another password that's even easier to lose than an email account. High-value accounts typically offer a secondary authentication method as a fallback. E.g. my bank can send me new access codes via physical mail. GitHub can optionally link a Facebook account for recovery purposes. But these measures would be overkill for most cases. Especially collecting a physical address for the sole purpose of offering account recovery would likely violate the GDPR's data minimization principle, though it may be fine when the user opts in with freely given consent. To summarize: what you're trying to do is extremely difficult, because you've need to balance different security aspects: keeping malicious actors out, and letting legitimate account owners in. Whereas I'd resolve that by denying any account recovery or subject access requests, other approaches exists with other risk profiles. The GDPR requires you to perform reasonable identity verification measures, but what is reasonable depends on the business context and is ultimately an infosec question.
england-and-wales Initially, one should comply with the officer's instructions as he has the power under statutory Stop &amp; Search powers to detain someone for the purpose of the search (discussed here). Failure to do so may be an offence. If, subsequently, one considers the search and detention was unlawful, the first port of call is to lodge a complaint with the relevant police force who - depending on the circumstances - may escalate the complaint to the Independent Office for Police Conduct IOPC. You can complain directly to the police/other organisation (see ‘Who can I complain about?’ below for a list of the other organisations) or via the IOPC. If you complain via the IOPC, your complaint will be sent direct to the organisation involved. They will assess your complaint and contact you about how it will be handled. The IOPC will not be involved with this initial assessment of your complaint. If the complaint is found to be valid, then any offence committed by not complying with the office would (in all probability) be overturned on appeal. As well as any compensation awarded by the court, the Chief Constable may consider making an ex gratia payment (mentioned here). Note that there is no obligation to do anything if the interaction falls within the Stop &amp; Account provisions.
The Canadian law governing interception of communication (wiretapping and recording) is explained here. Canada is a one-party country, so as long as one party (you, for example) consent, this would not be a violation of that statute. That source also believes (not unreasonably) that is would not constitute the tort of invasion of privacy since under the act The nature and degree of privacy to which a person is entitled … is that which is reasonable in the circumstances, giving due regard to the lawful interests of others (bearing in mind that is it allowed w.r.t. Section 184(1) of the Criminal Code: that is, it is reasonable to do so).
I can't find any specific laws or cases in the United Kingdom. In Australia, bag searches must be consensual - shopkeepers and even security staff have no power to search your person or belongings. It is for this reason that you will often be asked by security staff to open your bag, and move belongings around inside that may obstruct their view. If they attempt to force you to surrender your bags for search by physical force or by intimidation, you may be entitled to bring a claim for the tort of assault and/or battery. You need only prove that these occurred, without actual loss or damage. In any case, they do not have the power to arrest or detain you unless they believe you have committed a crime, and in those circumstances, only reasonable force may be used. You are under no obligation to remain in the store. If they detain you against your will and you are later found not to have shoplifted, you may be entitled to bring a claim for the tort of false imprisonment, which is, again, actionable per se (you need not actually show damages) and serves to vindicate a person's right to liberty.
Since your consent is not required in Texas, revocation is irrelevant. Restrictions of use of recordings flow from the legal nature of the recording itself, so there is no provision saying, for example, that only one party needs to consent for just recording, but all parties must consent to make any use of the recording. Since these laws were devised to regulate the practice of wearing a wire and collecting evidence of crimes, requiring consent from all parties would be counterproductive to the purposes of the law. You could try drafting a contract where you pay people to not record you (anybody who doesn't sign, you shouldn't talk to them), but enforcement could be tricky, so I would not try a DIY contract: get a lawyer. You would have to show that you were harmed by them making an unconsented recording. It should be in the form of a contract where you give something of value in exchange for something of value, which is a thing typically enforced by the courts. Also bear in mind that even in an all-party state, if you know that you are being recorded, you cannot just say &quot;I do not consent&quot;, you have to stop talking. Continuing to talk when notified that there is or may be a recording constitutes implied consent, which is why on the phone companies often announce via recording that the conversation may be monitored, and they do not ask &quot;Do you consent&quot;. By not hanging up, you consented.
Yes, phone numbers would generally qualify as Personal Data under GDPR. It would be so irrespective of whether you have also stored other information along with the phone numbers or not, since also information that indirectly could identify a natural person is Personal Data (provided that there are, somewhere else, public or not public, a register of who holds the specific phone number). See Article 4(1) GDPR. (One could possibly argue that the phone numbers would not be considered personal data if there is no actual register of who owns a specific phone number with any other party. Or if such register is in practice not available for anyone. It might be so in some cases, although I would not rely on it.) Whether you have the right to process the phone numbers must be assessed based on its lawfulness (see Article 6 GDPR). It could be based on consent, performance of contract, legitimate interest or any other ground set out therein.