Can the terms of service contain a clause that instructs a user to forfeit their rights under the GDPR? Suppose an American company wishes to do business with European parties. Could their terms of service say that as a user of their services the user forfeits any rights afforded to them by the GDPR and more importantly how would European Union courts and American Courts see this clause? Also can the Terms of Service say that if "You" are from any country in the European Union, do not continue using the services of the site? If this is done and someone from the European Union still uses the site, does that then legally negate the GDPR rights afforded to them? Just want to note that I think the GDPR good thing and I'm doing everything I can to comply with it, but I'm also structuring everything as defensively as possible.
It is not possible for someone to forfeit their rights because the GDPR is compulsory law. In the EU, laws can be regulatory or compulsory. In case of an agreement, regulatory laws can be set aside, if both parties agree on that. But compulsory laws cannot be set aside. Of course laws can also be partly compulsory. For example provisions which cannot be changed in disadvantage of a consumer. So there is freedom of contract, but it's freedom is reduced by law for the common good or for example to avoid misuse of bargaining power. In particular consumer related laws are often compulsory because it has little power against the other parties. Companies can have their negotiations done by lawyers, so they can make a well informed an well negotiated decision. As an extreme example, you cannot kill someone, even if that person has given you written permission. See also "Peremptory norm" on wikipedia for international law examples.
Alice's business sells database management software. Organisations buy or licence the software, deploy it on hardware they control and use the software to help store and, process and analyse 'personal data' within the meaning of GDPR. Alice's business has no access whatsoever to the personal data being stored and processed by those organisations. In respect of that personal data, GDPR is not engaged by Alice's business. The business is neither a 'controller' nor 'processor' of that personal data. Who does the data protection law apply to? - European Commission Who does the UK GDPR apply to? - Information Commissioner's Office
If the website's processing of your personal data is within the scope of the GDPR, then you have a qualified right to request the erasure of your personal data. It is relevant whether: the website operates within the EU; the website is operated by a company established in an EU country; the website aims to sell goods or services to people in the EU; or the website is routinely processing the personal data of people in the EU (including non-citizens). Furthermore, it is relevant whether your posts: contain one or more identifiers from which you could be personally identified, directly or indirectly, including by only the administrators or owners of the website; and by their content, directly reveal information relating to you. For example, let's say you posted on a forum saying that "I am a keen supporter of socialism", and your personal email address was used to sign up to the website, then you would have revealed information about your political beliefs, which by reference to a username, the website owners could use to uniquely identify you by your email address. You would not necessarily have to have used your name. If, for example, you posted something factual, like, "The Porsche 911 GT2 RS MR recorded the fastest lap time for a road-legal sports car on the Nürburgring," then it is only personal as long as it is associated with an identifier through which you could be identified. As such, the removal of the relationship could easily anonymise the post. A data controller has an obligation to provide means by which the data subject can exercise the rights guaranteed under Chapter 3 of the GDPR. Article 17 grants the right to "erasure of personal data concerning him or her without undue delay" where the grounds under Art. 17 lit. 1 (a) to (f) are met. It may be relevant what the lawful basis of processing personal data was in the first place, such as in determining whether you can withdraw consent (i.e. you cannot withdraw consent if consent was not given), or in determining whether there is a right to object under Article 21 lit. 1. Derogations permissible under local implementing laws may provide for other exemptions or requirements to the right to erasure, so it is also important to determine the country of jurisdiction.
Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR? Only if they offer goods/services to or monitor behavior of people in the EU (Art. 3(2)). Note that: having a commerce-oriented website that is accessible to EU residents does not by itself constitute offering goods or services in the EU. Rather, a business must show intent to draw EU customers, for example, by using a local language or currency. If it is then how (and by whom) would compliance be audited and/or enforced? Supervisory Authorities will care of it.
These are only tangentially related to the GDPR A government entity processing data in accordance with a member state law is ipso facto in compliance with the GDPR. That’s because lawful government data processing is a legitimate reason for processing data under the GDPR. If Germany, for example, passes a law saying German police can record every phone call in Germany, then that would be a lawful basis for processing under the GDPR. There may be constitutional or other legal limitations on such a law but as far as the GDPR is concerned, they’re fine.
An app(lication program) is software run on the end-users machine. That does not fall under the GDPR. Any processing (including storage) you do on user data has to be compliant with the GDPR. Allows a user to authenticate via e.g. Facebook and stores some basic data (optional) Authentication via Facebook leaves GDPR compliance to Facebook (AFAIK). It would be a good idea to provide alternative authentication methods, such as Google and an "own account" user name and password so that the user doesn't have to share information with a multinational company in order to use your service. The "basic data" will need to be processed according to the GDPR. As long as the "optional" part is "opt in" (i.e. the user needs to at least click on something) then this means you have permission to process that data. Providing this "basic data" as a JSON or CSV file should meet data portability requirements. Allows a user to upload a GPX file (a route or some other activity) Stores the above file to Google's database Allows the user to analyze that file. Since the user is actively choosing to upload each file you have permission to do this. You should make it clear in your privacy policy that the data will be held by Google. Doing so should not be a problem as Google has set up the legal framework to do this under the GDPR. You don't have to store the information encrypted, but you should use encryption (e.g. HTTPS) for any data transmission. Allowing the user to analyse the file is not an issue; either the user is doing it on their own machine (GDPR irrelevant) or you are doing it under user instruction (meaning you have consent). Since the user has uploaded GPX files they already have data portability on those files. You should tell your users that while you will employ best endeavours you don't promise to keep their files accessible and they should maintain their own private copies. That way if your entire database gets corrupted they can't blame you for loss of data. Finally, make sure there is a "Close my account and delete all my data" option.
It's hard to prove a negative, and I'm not sure which specific part of the quoted Terms you object, to, but it specifically states that content access may be done to: Comply with the law Protect its customers; and Protect the security of its business; and Protect its business interests. It's unlikely that access of information to comply with the law is illegal. At least one EU directive, Directive 95/46/EC, sets limits on the collection and use of personal information. We're concerned with the first condition for lawful data processing, and the second principle of data quality. Data processing is only lawful if the data subject has unambiguously given his consent; or processing is necessary for the performance of a contract to which the data subject is party; or processing is necessary for compliance with a legal obligation to which the controller is subject; or processing is necessary to protect the vital interests of the data subject; or processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party; or processing is necessary for the purposes of the legitimate interest pursued by the controller or by the third party, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection. The principles of data quality, which must be implemented for all lawful data processing activities, are the following: personal data must be processed fairly and lawfully, and collected for specified, explicit and legitimate purposes. They must also be adequate, relevant and not excessive, accurate and, where necessary, kept up to date, must not be stored for longer than necessary and solely for the purposes for which they were collected; special categories of processing: it is forbidden to process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. This provision comes with certain qualifications concerning, for example, cases where processing is necessary to protect the vital interests of the data subject or for the purposes of preventive medicine and medical diagnosis. So, let's say that someone has given their consent. It'd be at least a little questionable whether the inspection of private information could mean that they access personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. I'm a bit less clear on US laws, but you'd probably look for laws around Personal Identifying Information, as that's where a lot of focus has been.
Probably not. There are potential problems on the levels of copyright, data protection, and the Youtube terms of service. You should assume that comments are typically covered by copyright. You do not have a license to these comments, only YouTube does. Therefore, YouTube can show the comments but you can't copy them – just like YouTube can stream your videos but others can't download them and host them on their own websites. To cover the copyright angle, you'd either need to obtain a license from the commenters, or get a sub-license from YouTube, or identify a suitable copyright exception. The comments are personal data within the meaning of the GDPR, so that your processing of these comments (including mere storage) would be subject to GDPR as well. You need a legal basis for processing personal data. Which legal basis is suitable would depend on the purpose of processing, and on your relationship with the commenters. Potentially applicable legal bases in this context: you have a contract with the commenters that requires you to show the comments on your website. For example, I could see such a contract if there were a “featured comment” perk for a Patreon subscription. But this is not going to fly with random commenters. you have a legitimate interest (LI) that allows the processing. A LI requires that you conduct a balancing test where you weigh this interest against the commenter's rights. This is very specific to the purposes for which you want to show the comments. However, a LI will generally only apply if you have an existing relationship with the commenters, making it possible for them to expect that this processing will occur – unlikely if you'll be scraping comments from YouTube. you have obtained consent from the data subject. Consent must be specific, informed, freely given, and unambiguous – you can't obtain consent by writing “by commenting under this video you consent to XXX” in the video description. Regardless of legal basis, you would have to inform the commenters under Art 14 GDPR when you scrape their comments from the platform. Finally, consider the platform terms of service. I have not read the YouTube ToS recently, so I don't know what their specific conditions are. But in general, such ToS will not allow you to scrape content from their platform in order to host it somewhere else. The ToS might allow certain actions like embedding a link/iframe to such videos on other sites, without allowing other actions such as copying other user's content to your site.