What Wi-FI SSID names are forbidden in France? I have many Wi-Fi networks located in France and got quite concerned reading that an 18-year-old man from Dijon (France) was convicted for "praising terrorism" and was given a suspended sentence of three months in prison because the SSID of his Wi-Fi network was "Daesh 21." What Wi-FI SSID names are forbidden in France? Ideally I would like to have an exhaustive list to ensure none of my Wi-Fi networks sends me to jail.
The law does not say. It is up to the judgment of the judge to determine what constitutes "Le fait de provoquer directement à des actes de terrorisme ou de faire publiquement l'apologie de ces actes". I would not have predicted that the act constituted "faire publiquement l'apologie", but if that expression can reasonably construed as meaning "indicating approval of", then I understand the conclusion. The law does not mention SSIDs, that simply falls under the penumbra of "publicly approving of terrorism", and there isn't a specific list of forbidden acts. Analogously, Holocaust denial is against the law in France, and there is not a specific list of things that you can't say, there is a general rule from which specifics can be inferred. Publicly saying "Free Kurdistan!" could be construed as supporting PKK and thus approving of terrorism, but that would be quite a stretch. Using the SSID Pkk21, on the other hand, could be a problem.
Is there any official law that prohibits the use of tritium in France? Yes: it's the French decree 2002/460 of 4 April 2002. It does not mention tritium by name, but this article explains why it is now prohibited: The French authorities have just published decree 2002/460 of 4 April 2002 concerning general personal protection against the dangers of ionizing radiation. Having as its aim the transposition into French law of European directive 96/29 Euratom of 13 May 1996, which lays down basic standards concerning the health protection of the population and workers against the dangers resulting from ionizing radiation, the decree prohibits any intentional addition of artificial and natural radionuclides in consumer goods, as well as the import and export of such goods. Exceptions may be granted to ensure the safety of consumers (for example for diver's watches). No exceptions are made however for decorative pieces (jewellery and watches in general). It follows from these provisions that the use of tritium and other radioluminescent products of the same type for the hands and pointers of watch dials is now prohibited in France. It is now necessary by law to use other luminescent solutions. Source Dated 23 May 2002
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
Breach of GDPR France, Italy and Greece fined Clearview AI 20 million Euros for the following breaches: Unlawful processing of personal data (breach of Article 6 of the GDPR) Individuals’ rights not respected (Articles 12, 15 and 17 of the GDPR) Lack of cooperation with the CNIL (Article 31 of the RGPD) https://techcrunch.com/2022/10/20/clearview-ai-fined-in-france/ https://techcrunch.com/2022/03/09/clearview-italy-gdpr/ https://techcrunch.com/2022/07/13/clearview-greek-ban-order/
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
I think that there won't be any trouble from Germany, but the US could be a problem if the girl reports the case to authorities. In that case, further details would depend on the state in question. As far as Germany is concerned, there are two sections in the penal code that could be relevant here: § 176 StGB - Sexual abuse of children § 182 StGB - Sexual abuse of juveniles To make things more complicated, we would also have to take into account juvenile penal law and whether Germany would have jurisdiction in the first place. 1) Jurisdiction: I'm not sure whether this case would fall into German jurisdiction under § 3 StGB as the case could be deemed to be committed in the US. However, in that case, Germany could still assume jurisdiction under § 5 item 8 StGB. 2) Since our guy was only 18, it would be at the discretion of the court to decide whether juvenile criminal law or regular criminal law is to be applied. In the former case, the sentence would be lower (if there is a sentence at all). But then we still have to figure out whether our guy broke a law in the first place. So first of all, let's take a look at § 176 StGB: “Section 176 Sexual abuse of children (1) Whoever performs sexual acts on a person under 14 years of age (child) or has the child perform sexual acts on them incurs a penalty of imprisonment for a term of between six months and 10 years. (2) Whoever causes a child to perform sexual acts on a third person or has a third person perform sexual acts on the child incurs the same penalty. (3) In especially serious cases, the penalty is imprisonment for a term of at least one year. (4) Whoever 1. performs sexual acts in the presence of a child, 2. causes the child to perform sexual acts, unless the act is subject to a penalty under subsection (1) or subsection (2), 3. influences a child by way of material (section 11 (3)) or information and communication technologies a) in order to cause the child to perform sexual acts on or in the presence of the offender or a third person or to have the offender or a third person perform sexual acts on the child or b) in order to commit an offence under section 184b (1) no. 3 or under section 184b (3) or 4. influences a child by showing pornographic images or depictions, by playing pornographic audio recordings, making pornographic content available by way of information and communication technologies or pornographic speech incurs a penalty of imprisonment for a term of between three months and five years. (5) Whoever offers or promises to supply a child for an offence under subsections (1) to (4) or who arranges with another to commit such an offence incurs a penalty of imprisonment for a term of between three months and five years. (6) The attempt is punishable; this does not apply to offences under subsection (4) nos. 3 and 4 and subsection (5).” Since the girl is 15 years old, this section is probably not relevant. However, to know for sure, we would need to know her exact age when contact started. If she was only 13 years and 11 months and contact lasted 1 year and 2 months, then § 176 might be relevant after all. That takes us to § 182. “Section 182 Sexual abuse of juveniles (1) Whoever abuses a person under 18 years of age by taking advantage of a predicament by 1. performing sexual acts on that person or having said person perform sexual acts on them or 2. causing the person to perform sexual acts on a third person or to have sexual acts performed on them by a third person incurs a penalty of imprisonment for a term not exceeding five years or a fine. (2) A person over 18 years of age who abuses a person under 18 years of age by performing sexual acts on that person or having that person perform sexual acts on them for a consideration incurs the same penalty. (3) A person over 21 years of age who abuses a person under 16 years of age by 1. performing sexual acts on that person or having that person perform sexual acts on them or 2. causing that person to perform sexual acts on a third person or to have a third person perform sexual acts on that person, and thereby exploits the victim’s lack of capacity for sexual self-determination, incurs a penalty of imprisonment for a term not exceeding three years or a fine. (4) The attempt is punishable. (5) In the cases under subsection (3), the offence is prosecuted only upon request, unless the prosecuting authority deems there to be a special public interest in prosecution which calls for ex officio intervention. (6) In the cases under subsections (1) to (3), the court may dispense with imposing a penalty pursuant to these provisions if, having regard to the conduct of the person against whom the offence was committed, the wrongfulness of the act is minor.” § 182 para. 1 StGB applies only to cases where the offender takes advantage of a predicament. I seriously doubt there's a predicament involved here. § 182 para. 2 StGB only applies for sexual acts for consideration, i. e. when money is being paid. Since apparantly there was no payment involved in this case, no problem here and we can go on to para. 3. § 182 para. 3 StGB only applies to cases where the victim lacks the capacity for self-determination and the offender is at least 21 years old. Neither is the case here. Summary: As far as Germany is concerned, there's no trouble to be expected under § 182 StGB. § 176 StGB might cause problems but only if the girl was under 14 when contact began. (You stated that she's 15. This could mean that she just turned 15 but was 13 years and 11 months when contact began.) As far as German law is concerned, it looks like our guy was overly cautious and there was no need to cut contact. From the US perspective, however, things will probably be different. I'm not familiar with US law but we would probably need to know the state in question.
Mongolia apparently has a list of banned words (list is NSFW) that websites can't use. And according to this State Department report: Additionally, the regulation requires Web sites with heavy traffic to use filtering software that makes the user Internet Protocol addresses of those commenting or sharing content publicly visible. The report also says: The law places the burden of proof on the defendant in libel and slander cases, and both defamation and insult are criminal charges. NGOs reported that these laws were used more frequently than in previous years to control the press. Canada is probably a better choice, even if it isn't perfect.
Desuetude is the wrong concept. Desuetude relates to laws as a whole falling out of use; it doesn’t relate to individual cases. There is no question that the UK actively enforces their bail laws so they are not falling out of use. There is a statute of limitations that applies to non-major crimes within which the state must initiate prosecution. However, in this case the prosecution for bail violation has been initiated and Mr Assange is “on the run” so this is not relevant. Neither is the fact that the original charges that led to his arrest has been dropped- he is wanted for escaping lawful custody under English law for which the penalty is pretty stiff. I will also venture an opinion that the case against him is as open and shut as it comes. TL;DR When he dies.