How will the Trump administration ban TikTok, and are there any limitations on the use of these mechanisms against other companies? Background context The Trump administration recently announced plans to ban the social media app TikTok. The administration claims this is for national security reasons, alleging that TikTok is an agent of the Chinese Communist Party. TikTok denies these claims and has provided statistics about American ownership and employment. As a result, TikTok is currently for sale in the financial markets, with potential buyers including Microsoft and other tech giants. Question about this What specific legal mechanisms will the Trump administration use to enforce the TikTok ban? What conditions must be met for the executive branch of the government to use these mechanisms to ban TikTok, and can these mechanisms be used arbitrarily by the President or future Presidents? Do the same laws apply to domestic companies? Is it possible that these mechanisms could be used in the future to select winners and losers in the tech industry at the President's personal discretion?
The authority for the ban is laid out here: all that is required is putting the company on the Commerce Department's entity list. More specifically, under 50 USC 1701 there must be an unusual and extraordinary threat, which has its source in whole or substantial part outside the United States, to the national security, foreign policy, or economy of the United States, if the President declares a national emergency with respect to such threat If that condition is satisfied (and it has been: we have the emergency), then 50 USC 1702 grants POTUS broad economic powers, including prohibiting transactions in foreign exchange, or any kind of transaction involving any right regarding any property. Under that order, one implementational step for putting a company on the list is an executive review involving the Secretary of Commerce (Secretary), in consultation with the Secretary of the Treasury, the Secretary of State, the Secretary of Defense, the Attorney General, the Secretary of Homeland Security, the United States Trade Representative, the Director of National Intelligence, the Administrator of General Services, the Chairman of the Federal Communications Commission, and, as appropriate, the heads of other executive departments and agencies There must be a determination that the transaction involves information and communications technology or services designed, developed, manufactured, or supplied, by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary and that the transaction &quot;is a threat&quot;. This last requirement is the tallest hurdle that a Twitter-ban would face, namely establishing that Twitter is controlled by a foreign adversary.
You can put anything you like in a ToS document, but not everything you might put there will be enforceable. By posting something on the web, you are inviting anyone to read it. In some jurisdictions that may include the right to make and store a personal copy, although not multiple copies or a copy for commercial use. You can taker technical measures to prevent automated access and automated downloads (scraping). There was a case (hiQ Labs, Inc. v. LinkedIn Corp, 938 F.3d 985 (9th Cir. 2019)) in which access restrictions were held binding in a US court, but in that case the site owner had notified the would-be reuser (a competitor) directly. The laws on this sort of thing may differ from country to country, and are not as well-settled as older parts of the law tend to be. The question asks: can I list in my terms of service that all users acknowledge I own their posts ... The only way in which the host could &quot;own&quot; the posts would be if the users transferred copyright to the host, or granted the host an exclusive license. Under US law this would take a written and signed document. Clicking an &quot;I agree&quot; box or button might constitute a valid signature. A statement that &quot;by using this site you agree ...&quot; would pretty clearly not. You might prohibit bots copying from your site and posting duplicates, but to prohibit users re-posting their own messages elsewhere is harder, legally, and leas reasonable in my view. Under US law you could not actually file suit for copyright infringement until you had registered the copyright, but that is not true in many other countries.
First, read the definitions of defamation and libel be sure you understand them: Defamation | Wex Legal Dictionary | Cornell. Yes, posting to Twitter and Reddit is publishing, and people can post provably false facts on those services and defame someone in a civil law sense. But Section 230 of the Communications Decency Act (Electronic Frontier Foundation) mostly protects those services from defamation claims based on statements made by users of such a service. (Things are different if the case is criminal as a result of clear threats of violence, terrorism, etc.) ...what are the steps for them to exact damages in a civil court case? Find a lawyer, convince him/her to take the case, and file suit. if you don't know the person's real name, your lawyer will have to sue "John Doe" and point that out in the suit (and subpoenas) with the alleged Twitter handle or Reddit user name. How would a person compel Twitter/Reddit/etc to disclose the ISP information on their account? Read the various legal aspects of each service, i.e. Twitter Legal FAQs and User Agreement - Reddit and others. Your lawyer can explain that you can only try to compel them to disclose the IP and the ISP used with a subpoena during your lawsuit. How would a person compel an ISP to disclose the subscriber information (address, name) on the IP address? Since most ISPs protect their customer data, you will probably have to subpoena the ISP during your lawsuit. But your ability to do this can depend on if the ISP is a private company or a government entity, such as a university. State laws may come into play. Is obtaining the ISP subscriber's information enough to bring a lawsuit against them? Would they able to argue they didn't post the messages and bear no liability, even if it originated from their network? If it originated from an open wifi hotspot, would the proprietor bear responsibility at this point? Yes, you can sue an individual with such information; but there's no guarantee you'd win. Sure, because they can claim anything, such as someone else was using their computer or IP. No, owners of hotspots are generally not liable, and they protect themselves with TOS you agree to when you use the hotspot. Can the extensive legal costs of pursuing the case to it's conclusion be added to the damages sought easily? Legal costs can possibly be added, depending on jurisdiction. But seeking damages and actually winning them through a jury verdict are completely different things.
The constitution does not actually forbid "abusing a position for financial gain", and thus it is left to the political process to address any such actions (voting for a different candidate), or the legislative process (defining certain acts as forbidden) – or, the impeachment process. The court system in the US does not have the power to decide on their own what politicians can and can't do, if there is no underlying law. It is within congressional power to define limits on the act of any politician, for example Congress could pass a law requiring the President and Vice-President to have no business interests or stocks during their term of office; they could require that of cabinet members or members of Congress. Such a law would, of course, either require presidential approval or else sufficient support in the houses of congress to override a veto. There are various limits on what government folks can do. 18 USC 202(c) is an example of a limit on the limits: Except as otherwise provided in such sections, the terms “officer” and “employee” in sections 203, 205, 207 through 209, and 218 of this title shall not include the President, the Vice President, a Member of Congress, or a Federal judge It is possible that a president could engage in a criminal act such as theft, and that is not permitted and would be grounds for impeachment. The president does not, however, have the power to e.g. unilaterally send all government hotel business to a certain hotel company, nor can he declare that 10% of all government expenditures must be deposited in his personal bank account, so the mechanisms whereby corrupt rules of certain other nations can get away with that is that those executives have vastly more power in their countries than POTUS does. With congressional support, though, such acts could come about. If it did, it would not be too surprising if SCOTUS ruled based on common law and considerations of justice that such a law / act was illegal, but it would not be a textualist argument.
The part about "If I'm the owner of the content, surely I have the right to request its deletion" is the problem. Sure, you have the right to request, but you can't legally compel. You have an agreement with them, according to which you got something, and they got something. You can't then take back the thing that you gave them, which is permission to use. You didn't give them the IP itself, which you still hold. Here's an analogy. You may own a car, and can give a person permission to use the car (let's say "if you bring me back a pound of cheese from the store"). You cannot later change your mind (especially after you've gotten the cheese) a say that you retract that permission and therefore they actually stole your car. When permission to use is given, as long as the conditions for granting permission are satisfied, you can't un-give permission.
If the app (and the service accessed from the app) truly doesn't have any EULA, ToS, or license agreement, to include restrictions on reverse engineering, you can probably create an alternate front end, so long as you aren't using their logos, etc. However, their data may be a different beast, depending on the nature of it. For example, extracting data from Twitter would potentially violate Twitter's license on the original text copyright held by the authors in question. Wikipedia explicitly includes redistribution in their license agreement with authors/content creators. If all you are extracting and storing is the temperature at a particular weather station, you might have less of a concern. Anything beyond merely factual runs the risk of a copyright infringement as you store the data in your own database.
The Right to Access is pretty absolute. However, there are some limitations: Is the service even the Data Controller for the data in question? Here, you're talking about notes of one user about another. Is the platform the controller for the notes, or would the note-taker be the controller? Or both, jointly? If the platform weren't a controller but merely a data processor for these notes, it would be illegal for them to disclose the information. Trish also correctly points out that the GDPR does not apply to processing for purely personal or household purposes, e.g. personal social media use. So GDPR would not provide a basis to compel a user to disclose their notes to the data subject, assuming that the note-taker is covered by this exception. Of course, this exception wouldn't apply if the notes are taken for other purposes, e.g. professional networking. Also, this exception doesn't affect the platform. There is an explicit limitation to the right of access in Art 15(4): The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Disclosing user A's notes about user B to user B would likely violate the privacy rights of A. The notes are both A's and B's personal data. However, the correct balance depends on context. E.g. an employer probably can't refuse to provide access to a performance assessment merely because it was written by an identifiable manager. The UK ICO has provided detailed guidance on this aspect to the right of access. They propose a three-step test: Step one – Does the request require disclosing information that identifies another individual? For example, it might be possible to redact other people's information (but not in your Mastodon notes example). Step two – Has the other individual provided consent? Step three – Is it reasonable to disclose without consent? What is reasonable is highly context-dependent, but UK data protection law gives some concrete criteria to consider. The EU EDPB has draft guidance on the Right to Access. They note that the Art 15(4) can cover a wide range of rights, not just other people's privacy rights. But as in all things, the data controller is required to strike an appropriate balance between user A and B's conflicting rights. In the Mastodon user notes scenario, I think that the note author's rights to privacy should be considered more important than the data subject's right to access those notes, thus making it possible to reject that part of a DSAR under Art 15(4) GDPR. If we assume that the note-taker A is a (joint) controller for these notes, then it would also be necessary to consult them before making a decision about the access request.
The line they'll rely on for GDPR compliance is the first part of that sentence - "If you agree to this during the order process", which suggests that there will be a separate request to opt in to marketing communications at some other time in the process. Check any order documents. There's likely to be a tick box or similar on at least one. If that implies opting out rather than opting in there may be grounds to argue with that under GDPR, but there's nothing in the quoted text that suggests a problem.