Is it illegal to intentionally design a social network that can&#39;t comply with right-to-be-forgotten (and possibly other laws)? If I intentionally design (and program) a social network that uses a technology (blockchain,...) which does not allow for alteration / erasing of user data, what happens in case of a right-to-be-forgotten request? Were there already any cases like this? What happens for other cases where the technical design disallows compliance with government request (for example, using end-to-end encryption for all communication, meaning I can't give goverment agencies like FBI access to private data on request)?
As a designer and programmer you virtually have nothing to worry about apart from your wasted time. Such a network would likely never evolve (unless in Darknet) just because the would-be blockchain node owners would not have the balls to keep the nodes up. If a court in country A orders information deleted, the node owners residing in A would have to comply. Technically impossible? Well, then take the node down. Information will be available from nodes in other countries anyway? Does not matter — nodes in A will be taken down regardless. Note that the right-to-be-forgotten is only a small part of the obstacle. Defamation, hate speech, child pornography etc. published in a system that does not allow to delete information will cause the whole system to be deleted.
The part about "If I'm the owner of the content, surely I have the right to request its deletion" is the problem. Sure, you have the right to request, but you can't legally compel. You have an agreement with them, according to which you got something, and they got something. You can't then take back the thing that you gave them, which is permission to use. You didn't give them the IP itself, which you still hold. Here's an analogy. You may own a car, and can give a person permission to use the car (let's say "if you bring me back a pound of cheese from the store"). You cannot later change your mind (especially after you've gotten the cheese) a say that you retract that permission and therefore they actually stole your car. When permission to use is given, as long as the conditions for granting permission are satisfied, you can't un-give permission.
You can design whatever this system is (leaving aside jurisdictions without First Amendment-like law that lets you design to your hearts content), the problem comes in implementing. The main legal question is whether you are operating a website. A website operator has to comply with various laws that require them to remove content. For example, if you operate a website that allows users to distribute content that they upload, they can distribute copyright-protected content, and you can be held liable for copyright infringement. DMCA in the US provides a way for you to not get sued, but you have to be able to remove putatively infringing content, so you could get sued if you can't remove illegal content. This may also include legal troubles over e.g. defamatory content where a plaintiff gets a court order to remove the content – you can't plead &quot;I can't it down&quot; if the court orders you to do so. Napster was sued for copyright infringement and racketeering for facilitating law-breaking by others (&quot;secondary infringement&quot;), and in MGM v. Grokster the Supreme Court annonced the general principle that One who distributes a device with the object of promoting its use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement, going beyond mere distribution with knowledge of third-party action, is liable for the resulting acts of infringement by third parties using the device, regardless of the device’s lawful uses Grokster's problems arose because they clearly intended the software to be used to violate copyright law, whereas it is unlikely that Github will get sued because it is possible to use the platform illegally. So it really matters exactly what this &quot;platform&quot; is and what your relationship to the platform is. Describing a system is generally not illegal, realizing and maintaining one can easily be.
I'd say it's definitely illegal. Here's what the cookie notice says on Facebook at the time of writing this answer: By clicking on or navigating the site, you agree to allow us to collect information on and off Facebook through cookies. And here's what the GDPR define consent: ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; Also consider this, by the way: When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. Facebook's notice is a small blue bar at the top of its blue header, and you might not even notice it (at least on a desktop computer where I'm seeing it). I see no way to easily deny consent, for example there is no button saying "I don't accept". All you can do is click on the link to their cookie policy, and still that policy does not present a clear and easy way to deny consent in all different cases, it looks pretty complicated (among other things, it depends on whether you have a Facebook account or not). So denying consent looks pretty difficult, if at all possible. On the other hand, to give consent, you'd only have to click on any link. I tried this. I opened my browser in private/incognito mode, so it should not use any previous cookies. On Google, I searched for "facebook John Doe". Clicked on a result bringing me to a Facebook page with a list of profiles of people named John Doe. The cookie bar appears at the top, but let's pretend I did not notice it. Then I click on a profile, supposing I'm interested in a certain John Doe, and... I land on John Doe's profile on Facebook, now without the cookie notice! What happened is I gave consent by clicking on any link, that is, clicking on John Doe. I can't see any way this "consent" could ever be considered "freely given, specific, informed and unambiguous indication of the data subject's wishes". Why is Facebook not compliant? Well, they probably couldn't be compliant even if they wanted to, unless they wanted to go out of business. Lately I've been wondering what the purpose of Google Analytics would be if users were always given the option to freely refuse consent. Virtually every user would always be clicking on "I don't accept", every time everywhere, so lots of business models would be totally disrupted. By the way, as of now, the cookie bar of this community (stackexchange) does not comply with GDPR either. To tell you the truth, I'm afraid very few websites have a GDPR compliant cookie notice.
The line they'll rely on for GDPR compliance is the first part of that sentence - "If you agree to this during the order process", which suggests that there will be a separate request to opt in to marketing communications at some other time in the process. Check any order documents. There's likely to be a tick box or similar on at least one. If that implies opting out rather than opting in there may be grounds to argue with that under GDPR, but there's nothing in the quoted text that suggests a problem.
There is not necessarily a contradiction. Information that they may keep may be: Account information Subscriber information Information on breaches of the Terms of Service or Agreement So yes, they might certainly not keep any logs &ndash; although that claim is doubtful, since they almost certainly keep at least error-level logs of their services &ndash; but that doesn't mean that they have no information to disclose to law enforcement. It's also questionable what "logs" refers to &ndash; would aggregate statistics be considered a log, by law? Would your last known IP address be considered a log, provided they don't keep any other history?
In the UK and USA (and I imagine other jurisdictions) there have been laws that explicitly provide for orders obliging entities to (A) provide access or information and (B) keep the order secret. For example, in the USA the Stored Communications Act, Fair Credit Reporting Act and Right to Financial Privacy Act authorise the FBI to issue National Security Letters (Wikipedia, EFF, EPIC, Lawfare). These are an administrative subpoena, without prior approval from a judge, for meta-information (e.g. phone numbers dialed or email recipients addressed but not the content) of communications relevant to national security investigations. They typically contain a non-disclosure requirement prohibiting the recipient of the NSL from disclosing its existence or the FBI's demands. There have been challenges on First Amendment grounds to the non-disclosure aspect but, so far as I'm aware, they have all ultimately failed. Some of their non-disclosure requirements may eventually expire under other laws. In response, so-called 'warrant canaries' (Wikipedia) have been developed (and gone a bit further than the original idea) - these are intended to allow entities to relatively passively warn of such an order having been received if not the detail of the order. However, they can be legally risky in that they might be seen by a court as trying to circumvent the non-disclosure requirement and therefore breaking it.
You are correct that facts in general are not protected by copyright, and most raw data are facts. However, a collection of data may be protected by copyright as to its selection and organization. A use which copies such selection might possibly be copyright infringement. If data constitutes a trade secret it may be protected as such, and &quot;improper&quot; access might be unlawful. This would not apply to publicly available data or collections of data. If, to access a data set, one must sign or agree to a contract, that contract may limit the use of such data. Again, this would not apply to most publicly available data.