Is recording someone without their direct knowledge in one&#39;s own home legal? Consider the following scenarios: Alice visits Bob's home and he has surveillance devices in operation for security which record all of their interactions. Alice visits Bob's home after they go on a date and as a matter of general practice Bob surreptitiously starts a recorder as insurance in case she later attempts to accuse him of rape. Alice visits Bob's home and they anticipate the interaction to be fraught. Bob doesn't know whether she might try to coerce or blackmail him, so he starts a recorder without her knowledge. In each of these cases, has Bob done anything wrong? Does it make a difference if he only refers to the recordings himself and does not publish or disclose them? Does it make a difference if he only relies on them to prove Alice's lies or wrongdoing, thus retrospectively vindicating that Bob indeed had a reasonable excuse to be motivated to record her after all? Does it make a difference that it is Bob's home? How does the situation differ from a shop running CCTV on their own premises? What if it was a phone conversation rather than in person at Bob's home?
In England and Wales, in general it is legal to make a recording in one's own home without the knowledge or consent of the other participants. In general the law with regard to recordings is more strict in non-domestic contexts than it is in domestic contexts. For example, a business must &quot;make all reasonable efforts&quot; to inform a caller that their telephone call may be recorded. A business has obligations under data protection law that the householder does not have. Depending on the circumstances the homeowner might commit a civil tort (breach of confidence) or criminal offence if he discloses or publishes the recording made without the consent of the other participants. E.g. submitting it as evidence to court is OK, sharing it with friends or publishing it on the internet is likely not OK. In the specific context of the homeowner making a recording of a sexual act with another person and the other person has not consented to the making of the recording: if the homeowner shares the recording they might be investigated/prosecuted for the criminal offence of voyeurism (s67(3) Sexual Offences Act 2003) in R. v Richards the Court of Appeal ruled that the making of the recording for one's own sexual gratification amounts to the criminal offence of voyeurism (s67(3) Sexual Offences Act 2003)
england-and-wales There is nothing in the criminal law to compel Party X to identify Party Y in this scenario - they are under no legal obligation to contact the police or anyone else, and a witness summons, for example, cannot be served as there is no trial. That said, one option is for the victim to make a complaint to the police for an alleged offence of what is colloquially referred to as &quot;revenge porn&quot; contrary to s.33 of the Criminal Justice and Courts Act 2015: (1) It is an offence for a person to disclose a private sexual photograph or film if the disclosure is made — (a) without the consent of an individual who appears in the photograph or film, and (b) with the intention of causing that individual distress. ... The definitions of &quot;private&quot; and &quot;sexual&quot; may be found at s.35: (2) A photograph or film is “private” if it shows something that is not of a kind ordinarily seen in public. (3) A photograph or film is “sexual” if — (a) it shows all or part of an individual's exposed genitals or pubic area, (b) it shows something that a reasonable person would consider to be sexual because of its nature, or (c) its content, taken as a whole, is such that a reasonable person would consider it to be sexual. The police can then ask Party X to either provide a witness statement identifying Party Y or, if Party X is concerned about unwarranted repercussions etc, to provide this information in confidence and their involvement will be protected as Sensitive Material as per para 2.1(9) and 6.14 of the Criminal Procedure and Investigations Act 1996 Code of Practice.
Art. 17 GDPR, Right to erasure (‘right to be forgotten’) requires “erasure of personal data concerning him or her”. That’s all personal data. However, this only applies when this article applies. Section 1 details when this is and sections 2 and 3 detail limitations and exceptions to the right of erasure. For example, you would be allowed to keep financial records that you're legally obligated to keep. So, if they have the right, you have to delete all their personal data that is not exempted. Aggregate statistics and other anonymous data in the sense of Recital 26 are not personal data and don't have to be deleted. Whether the kinds of data you have mentioned would be sufficiently anonymous would require further analysis.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
Indirectly, no the wording of the caution is "You do not have to say anything, but it may harm your defence if you do not mention when questioned something which you later rely on in court. Anything you do say may be given in evidence." It is illegal to question someone if they have asked for legal advice. so if you ask for a solicitor they are not allowed to question you, and you cannot (by definition) fail to answer their questions if they're not allowed to ask them. Reference from https://www.gov.uk/arrested-your-rights/legal-advice-at-the-police-station "Once you’ve asked for legal advice, the police can’t question you until you’ve got it - with some exceptions."
There is nothing preventing the OP's &quot;subject&quot; from making a Subject Access Request in these circumstances From the British Transport Police's Privacy Notice page, under the heading &quot;How we use personal data&quot;: This privacy notice explains: ... the rights individuals have when we process their personal data. ... Right of Access: You can request access to the personal data we hold about you free of charge. You can request access to the personal data we hold about you using the contact details in this privacy notice. ... We collect personal data from a variety of sources, including: ... sound and visual images (e.g. from body worn cameras, CCTV, or facial recognition software); ... our own CCTV systems and body worn cameras. There's more detail in the link, which I have not replicated here to save space and avoid unnecessary &quot;noise&quot;, but the above should cover the relevant points raised by the OP
As always, it depends. However, it is by no means certain that any public facing hobby project, such as a web app, is exempt from having to comply with the GDPR. Since the GDPR is only a few days old, we have of course no case law based upon the GDPR itself yet. However, when considering this, one should take the following two facts into consideration. 1. The "personal use exeption" in the GDPR is not new. The personal use exemption is unchanged from the article 3(2) of Directive 95/46/EC. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.) 2. Case-law under the previous regulation restricts the scope of the exception The ECJ has ruled on the scope of the personal use exception in two cases: C-101/01 C-212/13 In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals. In C-101/01 it can be argued that the hobby project as a blogger was connected to the controllers professional activity (she was a catechist in a local church, and blogged about her work. including her colleagues). But in C-212/13, there no such connection to professional or commercial activity. Here, the controller operated a CCTV to protect his home, but set it up to also capture public space, and that was enough for the ECJ to decide that the personal use exception did not apply. Discussion Case-law based upon Directive 95/46/EC is in no way binding for a future court that need to rule based upon the GDPR. We need to wait for case-law decided under the GDPR to be able to have some degree of certainty about the scope of the "private use exception" under GDPR. However, given what we know about how the ECJ has ruled in these cases in the past, I think it is hazardous to think that just because what you are doing on the web is just a "hobby project" not connected to professional or commercial activity, you are exempt from complying with the GDPR. Conclusion IMHO, you may be exempt, or you may not be exempt. I think it really depends on your activity in your hobby project, and to what extent this project processes the personal data of other people than yourself.
This question needs more detail. As a cybersecurity professional I can provide some technical context around what I believe to be the situation. While I do not know the legal precedence, technically, IP addresses cannot typically be attributed to an individual person. There are a number of reasons for this. In a local network, IP addresses are not unique. Rather, they are distributed by the DHCP server, and are reassigned at intervals. Forensic attribution to an individual in most environments would require a DHCP log linking the IP to the machine’s MAC address, with time stamps that correlate to the individual’s logon to that machine at the same time. If the IP correlation involves a VPN, it gets more difficult. I would need to know where the log/evidence was obtained to determine what the IPs in question actually correlate to. If the evidence was obtained in local area network of the suspect, the IP addresses are likely assigned by the DHCP server (see previous). If they are obtained after encryption in transit to decryption, then very little can be determined. If they were obtained at the VPN server log, these IPs likely belong to an ISP which in turn may or may not be able to show what machine initiated the conversation. Digital photos often contain EXIF data, which is metadata about the photo. This data can contain details like, device make and model, sometimes location, time and date... If the defendant owns a Nikon such and such and the photo was taken with a Nikon such and such, and was uploaded using a VPN the defendant has an account with, and the defendant was in that location at the time and place of the photo... there may be enough there... but I’m not a lawyer. I believe the discovery should include any EXIF metadata and logs to be used as evidence. You may need a special technical whiteness to educate the court on what can and cannot be determined (technically) given the evidence. Things to consider for such a witness could include: EXIF, forensic certification, network administration experience, VPN, TCPIP, OSI Model, Network Address Translation (NAT). Again, nothing here should be considered legal advise. Seek professional legal counsel.