What are the differences between particulars, facts, and information? In this tax rule, in some places information sharing is legalised/allowed where on the other places particulars sharing is legalised/allowed and elsewhere facts sharing is allowed though in some places all have been legalised/allowed. What is the difference among these three terms?
I'm not familiar with this law, but if it works like other tax confidentiality laws I'm familiar with, it would be interpreted so broadly that there would effectively be no difference between "facts," "particulars" or "information." People receiving tax returns under this law would be prohibited from disclosing any of them. Anything that is in the return would be considered secret.
The issue of who pays directly for the items and/or to contractors is irrelevant. The important thing is to memorialize the agreement/arrangement in writing so as to preempt or solve eventual disputes. A clearly written agreement signed by the parties would supersede any presumption of conditions and rights arising solely from the parties' conduct.
There are a number of misconceptions here. GDPR does not generally impose blanket bans, but things get dicey if you're using data in a way that is not strictly necessary. Consent (freely given opt-in) is a way to continue nevertheless. A website without ads, tracking, or potentially tracking embedded content can probably work without having to ask for consent. Under the GDPR, every processing of personal data needs a purpose. This purpose must be covered by a legal basis. Some processing might be legally mandated or required by a contract with the data subject. It's also possible to base processing on a legitimate interest, but this requires a balancing test that also considers the data subject's rights and interests. As a last resort, consent can be an appropriate legal basis, but this comes with additional restrictions. Once you have a clear purpose that is covered by a legal basis, you can process the minimum data necessary to achieve the purpose. Sometimes, laws prescribe a particular legal basis. This is the case for cookies. You can use cookies (and similar technologies that access information on the end user's device) as strictly necessary to provide a service explicitly requested by the user. If you go beyond that, the ePrivacy Directive says you must obtain consent first. So for example, session cookies, shopping carts, or cookies that remember a “dark mode” preference are all perfectly fine because they are strictly necessary for something the user is trying to do. Also, you can use cookies to remember if the user gave or declined consent. On the other hand, analytics or tracking cookies are not necessary and require consent. If a website embeds third party content, this discloses personal data such as IP addresses to the third party. This disclosure requires a legal basis, most likely consent. There is case law about this regarding Facebook Like buttons on a page (→ Fashion ID case) but the same principle can be generalized to embedded Tweets or Youtube videos, images, or JavaScript files. A common way to handle this is to replace the embedded content with a placeholder, and to only load the embed once the user gives consent. But not all other domains or services are “third party” in the sense of the GDPR. When you engage a company to act as a data processor on your behalf, they are contractually bound to only use the data as instructed by you, and not for their own purposes. The GDPR allows you to outsource processing activities such as serving web content, as long as you have a suitable contract in place. Such “data processing agreements” are common for hosting providers or CDNs. When consent is to be used as a legal basis, it's important to consider the various conditions that the GDPR imposes (see Art 7 GDPR). The core principle is that consent must be freely given. You cannot make access to a site conditional on consent, so a naïve cookie wall or captive portal will be non-compliant. It's fine to force a choice, but “no” MUST be valid and possible. That consent is freely given also means that you must provide enough context for the user to make an informed decision, that the user must give consent through an unambiguous, affirmative action (consent is never the default), and that consent must be specific for a particular purpose (you can't bundle unrelated purposes). That is why modern consent management tools have multiple layers of information and allow the user to give consent for individual purposes (e.g. yes to analytics but no to ad personalization). In your particular context, you could proceed as follows: Figure out what kind of external content you're currently including. Can you enter into a data processing agreement with the external providers? If so, sign that. Can you host the content locally? This can be an easy solution except for video streams. Careful: copyright concerns might make this impossible. Can you replace the content with placeholders that only load if and when the user gives consent? That way, the rest of your site remains accessible without annoying consent walls. If the third party content is an unavoidable and essential part of your page, use an interstitial to inform the user of the risks before they proceed.
A legal paper published in a peer reviewed journal is not science. Universities have faculties of Law and Science because they are not the same thing. while both disciplines use the terms ‘evidence’, ‘fact’ and ‘proof’ they do not mean the same thing. Notwithstanding, the law has already disproved science - see the Catholic Church v Galileo and the Heliocentric model of the Solar System. Yet NASA still uses it to send spacecraft to Pluto - possibly because engineering is neither science nor law.
It may be legal or it may not For example, if any of the users are in the European Union, then the GDPR applies and the person storing the information is a data controller and has legal obligations. These include, having a legitimate reason for storing them, storing them only for as long as necessary for that reason, notifying the individuals that the data is being stored and why, deleting it upon a users request etc.
(For the data you use, you might not have to follow the license. But let’s assume you have to.) The license only applies to the content you distribute (or publicly perform, but that’s likely not relevant in your context): "Distribute" means to make available to the public the original and copies of the Work or Adaptation, as appropriate, through sale or other transfer of ownership. It doesn’t matter what’s saved on your server, it only matters what’s published (i.e., distributed). So you don’t have to publish the database. You have to attribute the content from the database when and as long you show (i.e., distribute) it. Not earlier nor longer than that.
There may be jurisdictional differences, but this link gives a thorough summary based on US interpretations. In short, privacy is an expectation based on common law while confidentiality is an ethical duty - usually (but not exclusively) part of a professional interaction. For correspondence where the sender wishes to show that they are aware of their ethical responsibility and that they also recognise that the addressee would have an expectation of privacy, both are often written.
The common law is permissive That is to say that, in a common law jurisdiction, the law is about what you must not do rather than about what you must do. Now, particular statutes may be phrased as requiring certain actions but, if you read them the “common law way” to coin a phrase, they are really imposing sanctions for doing the prohibited thing that falls outside those parameters. Since there is no legal prohibition on using multiple names (simultaneously or sequentially) you are free to do so. Now, there are common law prohibitions of, for example, fraud or tax evasion. So, if you use different names for the purpose of doing those prohibited things, then that is illegal but it is the specific criminality that is sanctioned, not the use of the alias in perpetrating it. The UK has a law that makes it a crime to not register the birth of a child. It also imposes some (and by most country’s standards, very few) restrictions on the name a child can be registered under. But there is no legal obligation on the child or their parents to use the registered name in any particular circumstances. There may be difficulties (amounting to impossibility in some cases) in obtaining a passport, opening a bank account, or claiming social security under a non-registered name but that is due to the necessity to identify the individual for which the name serves as a proxy. However, outside the requirements of specific statutes or administrative procedures, the common law position is that your name is what people call you and you identify as your name. The second part is important - I have been called dickhead on many occasions but I do not consider it to be my name. The UK has a patronymic tradition for surnames so, usually, on marriage, the female adopts the surname of the male and that, through the marriage certificate, becomes her registered name. However, it is extremely common for women to continue to use their original (and now not registered) name in their professional life and her new name in her private life. This can be problematic. My wife, has on server all occasions been refused permission to board a plane because the ticket (booked by others) was in her maiden name - a name for which she has no official identification. However, that’s a procedural problem - she didn’t do anything illegal.