Is there any law that Windows 10 &quot;spying&quot; might violate? Windows 10 terms of service document includes Microsoft privacy statement which contains the following excerpt (as cited on http://bgr.com/2015/07/31/windows-10-upgrade-spying-how-to-opt-out/) Finally, we will access, disclose and preserve personal data, including your content (such as the content of your emails, other private communications or files in private folders), when we have a good faith belief that doing so is necessary to: 1.comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies; 2.protect our customers, for example to prevent spam or attempts to defraud users of the services, or to help prevent the loss of life or serious injury of anyone; 3.operate and maintain the security of our services, including to prevent or stop an attack on our computer systems or networks; or 4.protect the rights or property of Microsoft, including enforcing the terms governing the use of the services – however, if we receive information indicating that someone is using our services to traffic in stolen intellectual or physical property of Microsoft, we will not inspect a customer’s private content ourselves, but we may refer the matter to law enforcement. Is there nothing in US (or perhaps European) laws that makes asking for customer acceptance of such conditions simply illegal (especially if one considers the probable implications, not spelled out of course in the Orwellian piece above)? Of course MS lawyers worked hard to whitewash the text, but are there any precedents/legal line of action which may be taken?
It's hard to prove a negative, and I'm not sure which specific part of the quoted Terms you object, to, but it specifically states that content access may be done to: Comply with the law Protect its customers; and Protect the security of its business; and Protect its business interests. It's unlikely that access of information to comply with the law is illegal. At least one EU directive, Directive 95/46/EC, sets limits on the collection and use of personal information. We're concerned with the first condition for lawful data processing, and the second principle of data quality. Data processing is only lawful if the data subject has unambiguously given his consent; or processing is necessary for the performance of a contract to which the data subject is party; or processing is necessary for compliance with a legal obligation to which the controller is subject; or processing is necessary to protect the vital interests of the data subject; or processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party; or processing is necessary for the purposes of the legitimate interest pursued by the controller or by the third party, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection. The principles of data quality, which must be implemented for all lawful data processing activities, are the following: personal data must be processed fairly and lawfully, and collected for specified, explicit and legitimate purposes. They must also be adequate, relevant and not excessive, accurate and, where necessary, kept up to date, must not be stored for longer than necessary and solely for the purposes for which they were collected; special categories of processing: it is forbidden to process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. This provision comes with certain qualifications concerning, for example, cases where processing is necessary to protect the vital interests of the data subject or for the purposes of preventive medicine and medical diagnosis. So, let's say that someone has given their consent. It'd be at least a little questionable whether the inspection of private information could mean that they access personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. I'm a bit less clear on US laws, but you'd probably look for laws around Personal Identifying Information, as that's where a lot of focus has been.
A law has to be "broad" to include a lot of possible crimes and intent of criminals and account for the good faith of non-criminals. "Intentionally access without authorization/exceed" is actually fairly specific; "intent" is the keyword. Someone making a mistake may have intent to login, but no intent to commit a crime. Someone confused by "different pages of demo and live accounts" can easily defend their actions by pointing out that they were confused. It's up to the reasonableness of the pertinent law enforcement and prosecutors to take into account the evidence that reasonable mistakes were made by little old ladies and not charge them with a crime. And for the most part, 98% of the time, law enforcement and prosecutors are reasonable.
The most apparent potential offences would be under 18 U.S.C. § 1030, but these require the mens rea of &quot;knowingly&quot; or &quot;intentionally&quot; doing things without authorization, or doing so &quot;with intent to defraud&quot;, etc. See also the Department of Justice's manual entry on this family of offences. Particularly relevant is this quote: As part of proving that the defendant acted knowingly or intentionally, the attorney for the government must be prepared to prove that the defendant was aware of the facts that made the defendant’s access unauthorized at the time of the defendant’s conduct. Given your stipulation that the person has unintentionally viewed or downloaded the material without authorization, this would not be a violation of 18 U.S.C. § 1030.
It turns out that there is no difference between the ethical answer and the legal answer, in this case. The law recognizes the property right which a person has when they create a thing, such as a font, and that right is encoded in the law of copyright. The relevant US federal code is contained in Title 17, which you can read (essentially identical laws exist in virtually or perhaps actually all countries). The important thing to understand is that there is not a distinction between "privately" trespassing on a person's property and "publicly" trespassing on a person's property. The violation of the owner's property rights comes from taking the material without consent. There is a legally-recognized exception to the owner's rights, in the form of "fair use", which is widely misunderstood to mean "if it's not for profit, the property owner has no legal protection". Simply taking and using someone else's IP non-commercially is not "fair use".
The website owner brings in an expert programmer who testifies that the user cannot have gotten to a certain part of the site (or download, etc.) without having clicked to accept the terms of service, and that this document they're holding is a true and correct copy of the terms of service as of that date. That's evidence in favor of the site, and an adverse party has to have stronger evidence in order to overcome it. If the person didn't save a copy of the terms themselves, they'll have a hard time on this. Then the other party's attorney tries to discredit the programmer by asking questions like "how do you know there are no bugs in the software which could have allowed somebody to reach this without agreeing to the terms of service" etc. Apparently, some sites don't require users to click indicating agreement. If the company has significantly changed the site, terms of service, etc. since the time the user registered, and doesn't keep any copies of old versions around, and admits this, they'll have a hard time enforcing an agreement (as they can't produce a copy of it). If the user kept a copy, the user might be able to present that. It's up to the finder of fact to decide what to believe and how much weight to give the various witnesses' testimony.
Not that I am aware of. A person who 'owns' a domain is entitled to utilize that domain including for the purposes of receiving emails. With physical mail, it is a crime in most countries to intentionally interfere with mail that is not addressed to you. For example - Australia. However, this is statute law and as such does not extend to emails - even if it did, if you own the domain then you are the person to whom it was addressed. I note that you seem to misunderstand "confidential" - this only arises in the context of a special relationship between the person transmitting the information and the person receiving it. Usually this is a contractual obligation between A and B but it can be imposed by law (e.g. doctor-patient, banker-client, lawyer-client, GDPR etc.). If A sends confidential (as between A &amp; B) information to C, C is under no general obligation to keep it confidential if C has no relationship of confidentiality with A or B. If C discloses it and B suffers damage, B sues A for breach of confidence (or the government prosecutes A for breaking the law); B has no case against C. For your situation, where B has allowed A to send the information to an obsolete address then B has contributed to the breach to an extent that B would be extremely unlikely to succeed in a suit against A.
This sounds a bit far-fetched. There are laws against circumventing copy protection measures (DRM) but not against aimbotting (to the best of my knowledge). Thus, you cannot reasonably believe that a click-assist functionality would be used to break laws. It could definitely be used to break private contracts such as an EULA, but you are not a party to that contract and are not bound by its terms. Of course, when you use such click-assist tech in an online game, you might be breaking your contract with the game vendor or server provider. But this doesn't imply that a click-assist would be forbidden outside of that context. Note that assistive technologies sometimes have exceptions from laws, e.g. a permission to circumvent DRM if necessary for accessibility. In the US, the Librarian of Congress adopts exceptions for a duration of three years. While none of the current exceptions match your specific scenario involving video-games, it can be permissible to break DRM on e-books or videos for certain accessibility enhancements.
The conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. As for it being legal for website operators to log the IP-addresses of visitors, this is covered by the following paragraph (also pointed out by phoog in a comment). The paragraph says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) You are not the only web site that logs IP addresses for the purpose of security. Every web site I've ever worked on - from those controlled by large corporations to tiny NGOs - do this. This security practice will not be impacted by the GDPR (if it were, I am sure we would have heard about it by now). there is the EU cookie law too If your website are going to be accessible to European citizens and not only accessible by your friends and familiy, you have to comply with the EU cookie directive of 2002 (a exemption for "personal websites" does not exist).