What can a network service disclose to law enforcement if they claim they don&#39;t keep any logs? After reading this question I was wondering about the legal applications of the terms-of-service of Privateinternetaccess.com (PIA): a VPN provider. What's a VPN provider? If you have one, all your internet traffic goes through it. One of the largest claims PIA makes is that it doesn't keep any logs so that theoretically even if a government issues a warrant they would be unable to disclose any information on the activities of its users. According to this article PIA claims "We absolutely do not maintain any VPN logs of any kind." Is it legal not to keep any logs? Did they just "pull a legal fast one" by saying VPN logs so if they were to hand over information about a user they would just say it was from a non-VPN log? From the first linked page: Failure to comply with the present Terms of Service constitutes a material breach of the Agreement, and may result in one or more of these following actions: Issuance of a warning; Immediate, temporary, or permanent revocation of access to Privateinternetaccess.com with no refund; Legal actions against you for reimbursement of any costs incurred via indemnity resulting from a breach; Independent legal action by Privateinternetaccess.com as a result of a breach; or Disclosure of such information to law enforcement authorities as deemed reasonably necessary. When they say "Disclosure of such information," to what information could they refer? They claim they don't keep any information. Is the statement saying, "they will comply with the law, by showing their (empty) logs"?
There is not necessarily a contradiction. Information that they may keep may be: Account information Subscriber information Information on breaches of the Terms of Service or Agreement So yes, they might certainly not keep any logs &ndash; although that claim is doubtful, since they almost certainly keep at least error-level logs of their services &ndash; but that doesn't mean that they have no information to disclose to law enforcement. It's also questionable what "logs" refers to &ndash; would aggregate statistics be considered a log, by law? Would your last known IP address be considered a log, provided they don't keep any other history?
This is a good question, although it discusses crimes. This answer generalizes the question by giving a response for civil violations. In the united-states, where federal civil-procedure is followed and provided the tape isn't solely for impeachment purposes (i.e. it also documents other elements), there are certain disclosures required at the beginning of discovery governed by Rule 26(a)(1)(A)(ii). If a party withholds one of these disclosures, under Rule 37(c)(1), the court is able to take a number of actions, including throwing the evidence out. This could, of course, result in the withholder's conviction. Yet, if the court does not go to that extreme, it may impose the sanctions in Rule 37(b). So the withholder's attorney might try to make a case that the evidence is, indeed, solely for impeachment purposes.
There is nothing in the GDPR requiring you to collect individual personally identifiable information. If the website has no need, and the website owner no desire, to collect such information, there is no requirement to do so. The GDPR requires that if such information is collected, that there is a lawful basis, and that it be handled appropriately and stored securely, and deleted when there is no longer a need to retain it, or on a proper request. If no such information is collected in the first place, all the rules about how to handle it do not apply. It is possible that some law of an individual country in the EU might mandate collection of some particular information, but I have not heard of any such requirement.
This would probably constitute illegal wiretapping and would certainly constitute a 4th Amendment search if conducted by law enforcement. Normally, the definition of whether something is "public" for purposes of an expectation of privacy is whether it could be detected by a human being unaided by technological enhancements from a place where someone could lawfully be to make that kind of observation. Some of the relevant cases are Katz v. U.S., 389 U.S. (1967) (tape recorder outside a public telephone booth was a search violating the expectation of privacy) and U.S. v. Karo, 468 U.S. (1984) (tracking device placed in barrel by authorities violated expectation of privacy). RFID signals are not "public" even if they are not encrypted with a private code because a device, such as the ones identified in the question, is necessary to receive them. The Wiretap Act, codified by 18 U.S. Code § 2511, is a federal law aimed at protecting privacy in communications with other persons. Typically, when you think of a "wiretap," the first thing that comes to mind is someone listening to your telephone calls. But the Act protects more than that. Under the Act, it is illegal to: intentionally or purposefully intercept, disclose, or use the contents of any wire, oral, or electronic communication through the use of a "device." The Act provides criminal and civil penalties for violations, although it creates various exceptions to when interceptions and disclosures are illegal. From here. In this circumstance, despite being passive, one is intentionally intercepting the contents of electronic communications through the use of a device. The fact that there was not in all cases an intent to communicate through, for example, an RFID chip, on a specific occasion probably does not suffice to render it not a communication.
What are the reasons/ legal requirements that the police might need my personal information, given that I had not been able to provide any further information/ witness testimony to the incident that they were investigating? The police in england-and-wales have a duty to undertake reasonable lines of enquiry and to carry out a proportionate investigation in to allegations of crime. No-one is legally obliged to answer house to house questions but, notwithstanding the honesty and integrity of the majority of members of the public, any information held by the police may need to be corroborated to identify or eliminate suspects, witnesses, evidential opportunities or other lines of enquiry. Also, if it is established that someone has no information that may assist the investigation this is recorded to prevent duplication of effort thus enabling the police to focus their resources accordingly. All the while complying with the relevant privacy and data retention legislation.
In addition to compelling a store to produce evidence such as video footage, via a search warrant as described by bdb484, police can request access to information in the possession of such information. The store may voluntarily comply with the request, or not. Especially in the case of online transactions, there may be a privacy guarantee that information about a customer's transaction will not be revealed to a third party unless required by law (ergo, a warrant), but security camera recordings are not protected by such guarantees.
One way in which it holds legal water is that if you use the website in violation of the terms, then you may forfeit your right to take civil action against the company. Analogous language especially regarding the age of the user may protect the site against actions by third party governmental entities (COPPA-like laws), though nothing patently obvious springs to mind (insofar as this deals with firearms and there is also an age 21 restriction both on the web site and in terms of US firearms law, this is not a totally crazy idea). The citation of 18 USC 1030 non-probatively points to an issue which may be disposed of by SCOTUS in US v. van Buren, that knowingly violating the terms of service is a crime (a proposition rejected by lower courts, see US v. Valle). Facebook v. Power Ventures in particular clarifies how &quot;being put on notice&quot; may make such unauthorized access indeed &quot;unauthorized access&quot; in the statutorily-relevant sense. This does not prevent a legally-authorized law enforcement investigation, pursuant to para (f), but if the &quot;violation of TOS = unauthorized access&quot; theory is upheld, it limits how LEOs can legally access the website (and the limitations extend past LEOs). It is a separate and potentially interesting question whether there actually are any legal limits on the investigative powers of the government – if any law enforcement officer has the liberty to investigate anyone they want, with no supervision or requirement of justification, then this would be a rather gaping loophole in their legal strategy. Web pages involve massive copying of copyright-protected data, and the function of terms of use is in part to conditionally grant access to that copyright-protected content. When a person copies protected material from someone's web page having been explicitly denied permission to copy, they run the risk of an infringement lawsuit.
(As there are cases that remain sub judice, I will give only a general answer describing the disclosure process.) How does discovery disclosure work for financial crimes? Disclosure for all criminal investigations in England and Wales, including those in to financial crime, are carried out in accordance with Parts 1 and 2 of the Criminal Procedure and Investigations Act 1996 and its accompanying Code of Practice. A full explanation is given in the Code, but put briefly: the police appoint a Disclosure Officer whose role includes reviewing and assessing everything held by the police, called &quot;material&quot;, and passing details of all &quot;relevant material&quot; to the CPS appointed prosecutor. There are four stages in the police disclosure process, called the 4Rs: Record Retain Review Reveal These 4Rs overlap with three questions that require answering in order: Record and Retain: Q1: Is it &quot;relevant material&quot; to the investigation? If No, nothing further need be done. If Yes then Record and Retain it in a &quot;durable and retrievable format&quot; - write it down, save it to disc etc, keep it safe and in a place where it can be found. Review: Q2: Is it &quot;sensitive material&quot;? e.g. does it relate to informants, covert tactics, information given in confidence etc? Either way, two seperate schedules of relevant material according to its &quot;sensitivity&quot; are created. Reveal: The Disclosure Officer passes both schedules (and the actual material if necessary) to the CPS prosecutor who provides the defence with a copy of the non-sensitive schedule. The prosecutor also asks: Q3: Does the material &quot;undermine the case for the prosecution or assist the defence with theirs&quot;? If No, nothing further need be done. If Yes, the prosecutor must disclose the material to defence, unless it sensitive and giving it to the defence is not, for example, in the public interest as it may jeopardise life, covert operations etc. The prosecutor and police then has to decide whether to drop the case or not in order to protect the reason for the sensitivity. (They may also apply to the Crown Court judge for a Public Interest Immunity certificate which - in very, very rare cases - allows a trial to go ahead in the interests of justice without the defence being made aware of material that may assist their case as long as the whole trial process is fair to the defendant.) The defence, in addition to their copy of the non-sensitive schedule, can apply for sight or copies of and any material that they consider also undermines or assists but has not been disclosed to them by the prosecutor, and is necessary for their case. In the first instance this application is to the CPS prosecutor, but if it is refused the defence may apply to the trial judge for a ruling on whether it must be disclosed or not. The overriding principle is ensuring a fair trial. ETA: It it possible for a party to such a suit to bring evidence to the court without providing the underlying data to the other party? It is possible but the principles of a fair trial, disclosure and the continuity of evidence (what some call the chain of custody) coupled with challeges by the defence are supposed to ensure that the provenance and accuracy of evidence is properly tested and accountable at a Plea and Trial Preparation Hearing (PTPH) before a trial opens. Unfortunately, especially in highly complex investigations, this does not always seem to be the case.