Do I have to declare my cameras to the CNIL? Do I have to declare my CCTV system to the CNIL (Commission nationale de l'informatique et des libertés, which translates to "National Committee for IT and Liberties") if they are placed on a private property which is also the HQ of a company? This web page indicates you have to declare any CCTV system that meet the following conditions: the cameras are recording a place not opened to public AND you're recording on some digital hardware. On this web page, the penultimate line indicates you don't have to do anything if this is your home, but the last line says you have to declare it if you're having employees on the house. The company HQ is the house of the company owner's parents. The house is fully owned by his parents. The company is fully owned by the owner. So, the employees are not the house's owner's employees. Does it still qualify for the last line? This is a contractor company, so the employees are not working all day long on HQ, they are just loading/unloading trucks.
The obligation to notify the supervisory authority (CNIL in your case) no longer exists. It was part of the previous regulatory framework, but it is not part of GDPR (which takes affect tomorrow). If you use CCTV that may monitor employees (i.e. they sometimes enter the HQ to consult with the owner), your obligations under the GDPR is basically to inform the employees that the CCTV cameras are there. I.e. Data subjects are entitled to understand when their personal data is being processed, covering the transparency aspect of processing. The use of CCTV must be communicated via signage which indicates the areas covered and instructions for further information.
You're misreading the law. You need to keep reading the section you referenced (emphasis added): The disclosure...shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business Thus, the option to have the disclosure sent by mail only applies to consumers who do not have an account with the business. Since presumably a large number of sites only maintain personal information for users with accounts, such sites need not provide a mail option. Further, it doesn't say there needs to be a button: you just need the ability to say you'd like it mailed to you in the request somehow, and then they need to comply when you do.
The key issue here is the unauthorized collection of video thumbnails, not the use of cloud services. Under GDPR, every personal data processing activity has one or more controllers who are responsible for the activity, and every such activity needs a “legal basis”. With such cameras, the operator will typically be a controller, since they determine the purposes for which this camera is used. In this scenario, the operators – as part of their responsibility to conduct the data processing activity in a GDPR-compliant manner – had disabled any cloud features provided by the camera manufacturer. Despite this configuration, the camera manufacturer collected thumbnails and uploaded them to servers under their control. So, we likely have two distinct issues at hand: the camera manufacturer misled its customers about the privacy settings of the cameras. This is not necessarily a GDPR issue by itself. the manufacturer performed data processing activities in contravention of various aspects of the GDPR. Relevant aspects of the GDPR that might have been violated: the manufacturer did not have an Art 6 GDPR legal basis for this processing activity, such as a “legitimate interest” the manufacturer did not provide information per Art 13 GDPR to the people being monitored this way even if the cloud-based thumbnail processing were intended, this could be a violation against the Art 25 obligation to ensure “data protection by design and by default” depending on how the cloud storage services were configured, there might be violations against the Art 28 responsibility to contractually bind such vendors as data processors, or against the Chapter V rules on international data transfers Different actors might have different remedies against this violations: buyers of the camera might have remedies under consumer protection and product liability laws against the manufacturer data subjects of the illegal processing activity have remedies under the GDPR they can exercise their data subject rights against the data controllers, such as erasure of the thumbnails. However, this will be difficult to exercise in practice since the manufacturer will not have identifying information, and would then be free from having to fulfil certain data subject requests per Art 11 GDPR. they can lodge a complaint with a responsible supervisory authority, which would be the data protection agency in their EU/EEA member state (or the ICO in the UK). The EDPS is irrelevant here, since it is only the internal supervision authority for EU institutions. The competent supervisory authorities can levy fines. they can sue the data controllers, both for compliance (e.g. deleting unauthorized thumbnails) and for damages, if any were suffered. However, immaterial damages awarded for GDPR violations are typically fairly low, if they are recognized by the court at all. the right to judicial remedy (sue the controllers in court) and to lodge a complaint are independent. They largely pursue different remedies. Both can be used to seek compliance, but only supervisory authorities can impose fines, and only direct lawsuits by the data subjects can seek damages.
This very much depends on where you are. Different jurisdictions have wildly different laws about this. Some places are very permissive. You can record a conversation that you aren't even a party to so long as nobody has any reasonable expectation of privacy. In others, affirmative consent is required from every party to a conversation before it's legal to record it. The laws run the entire spectrum. Some places allow you to record anything you're a party to without permission, but you can't record others' conversations. Some places require you to disclose, but not obtain explicit permission. Some allow you to record but restrict who you can disclose it to. Some allow you to record or ban recording only under certain circumstances. It's a really wide gamut of laws. Since you don't say where you are, who you're recording, or why, there's no way to really answer the question. Here's a good rundown on the United States. This Wikipedia article covers lots of different countries, but only with regard to phone calls.
Greendrake's answer says that a country can declare any jurisdiction it likes. This is true, but in practice it is the convention that a country should claim jurisdiction only over its territory and its citizens. The point about "citizens" is normally not pushed, as when you go to a foreign country you are normally subject to its laws rather than those of your home, but for instance there are laws against child sex tourism where the perpetrators can be prosecuted at home for offences committed abroad. However this basic principle gets more murky with long-distance communication such as the Internet. Someone in country X can, for example, provide a service to someone in country Y which is illegal in country Y. At this point the laws of country Y have been broken by someone sitting in country X. Y is not claiming extraterritorial jurisdiction; the crime occurred inside its own territory, but the criminal is currently resident in X. From a legal point of view this is the same as if both had been inside Y when the crime was committed, but then the perpetrator fled to X before they could be arrested. So in the Kim Dotcom case, Dotcom is alleged to have committed criminal copyright violations by supplying movie files to people in the US. In the Meng Wanzhou case, Meng is alleged to have made fraudulent statements to American banks to the effect that Huawei was complying with US sanctions law (otherwise those banks would not have been able to do business with Huawei). The accounts I've read don't say whether Meng was in the US for those meetings, but the fact that they were made to American banks in order to do business in America makes the precise location of the meeting irrelevant.
In the question, you write: The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file). No, it does not. To quote Miss Infogeek: GDPR DOES NOT MAKE CONSENT A MANDATORY REQUIREMENT FOR ALL PROCESSING OF PERSONAL DATA. Consent (Article 6 (1)a) is indeed one of conditions that can be used to comply with the GDPR requirement that processing must be lawful, but it is not the only condition available to the controller to ensure lawful processing &ndash; there are alternatives (before the list of conditions it says that "at least one of the following" must be satisfied). All the conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. One of alternatives are Article 6 (1)f. It says says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) As noted in the question, logging IP addresses for the purpose of security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices. It is the default, and most (all?) web-sites do this. I.e. it is legal to do this without consent (if this is not the case, I am pretty sure the outcry had been heard all over the Internet by now).
Subsidiary and supplier are separate cases. For a controlled subsidiary: full duties, full responsibility, you could (and someone has) fill a textbook with the ins and outs but this is the answer. For a supplier: it is under the law much more complicated, but if a client of mine came to me with this question my answer would be pretty much the same: if the evidence is truly credible you should cut ties and then conduct an FCPA review to determine whether there is any obligation to disclose.
There is no mailbox-specific law. You can take pictures in public, and you can put a camera to take pictures on your property. Whether you can install a camera in a particular place depends on who owns that place. Of course, you also can't aim it to peer into a nearby residence; and it has to be a video-only camera (unattended recording of audio is illegal without the consent of the thief). In some cases, mega-boxes are owned by the USPS so you would need USPS permission. There is a widespread false narrative that the USPS owns all mailboxes, but the USPS does not say that nor does the US Code. USPS describes two kinds of cluster-boxes, private and USPS-owned. The USPS offers no statements on permission or its denial to install a cameras inside a USPS-owned box, so you would have to ask the local post office in case your box is USPS-owned.