Getting New York based company to delete my personal information I registered with Topresume.com and uploaded a copy of my resume. I found their service to be poor and according to the Privacy Policy they may sell information to third parties. Is there any laws in the state of New York I can use to my advantage to compel them to delete the data they have on me, for example if I write to them telling them to delete all data regarding me must they do so? According to their Privacy Policy "if a child under 13 submits personal information to us and we learn that the personal information is the information of a child under 13, we will attempt to delete the information as soon as possible" so can I just lie and tell them I was 13? Also, in there terms (ToS) it states TopResume will provide the right to request and receive, once a year and free of charge, information about third parties to whom we have disclosed certain types of personal information (if any) about you for our direct marketing purposes in the prior calendar year, and a description of the categories of personal information shared. To make such a request, please send an email to contact@topresume.com and please include the phrase "Personal Information Privacy Request" in the subject line, the domain name of the website you are inquiring about, along with your name, address and email address. At our option, we may respond to such requests by providing instructions about how our users can exercise their options to prevent our disclosure of personal information to third parties for their direct marketing purposes. Which to me sounds like it contains doublespeak but may mean they will not share information with third parties if they ask you to?
You can't You agreed: by submitting Materials in any form to the Company, in addition to other provisions of the Terms, you automatically grant Company a royalty-free, world-wide, irrevocable, non-exclusive, and assignable right and license to use, copy, reproduce, modify, adapt, publish, edit, translate, create derivative works from, transmit, distribute, publicly display and publicly perform such Materials for the purpose of displaying and promoting the Materials on any website operated by, and in any related marketing materials produced by, the Company and its affiliates. They can keep and use your data forever and give it to whoever they want. The clause you quote doesn't alter that. All it says is that once a year, if you ask, they will tell you what information they shared and with whom. If they feel like it they will tell you how to get the information deleted.
Basically how reducible is personal information until it's no longer personal information? When it can no longer be used, alone or combined with other data, to identify a person (or small number of people). Context matters, if you have data on the people in say New York City, (pop. 8 million+) there are only 676 2 letter initials which averages out to about 12,000 each BUT initials are not uniformly distributed: there are a lot more JS out there than XX. In fact XX could be so rare that you can identify an individual in NYC just from this. Of course, if you are using all initials then in, English speaking countries most people have 3 names and so, 3 initials; this not only reduces the number of people in each “bucket” it makes it way easier to identify unique individuals with 2, 4, 5 or more names. If your data set is smaller than this and people have a way of working out who was in your data, then the prospect of being able to identify an individual just from their initials is much greater. For example, my family has 4 individuals and there are 4 unique first initials so in that group, the initial clearly identifies each of us.
You won't be able to get around self-doxxing yourself. § 5 Abs 1 TMG requires tele-media service providers like you to list den Namen und die Anschrift, unter der sie niedergelassen sind the name and the address where they reside or are established Similarly, Art 13(1) GDPR requires you to provide the identity and the contact details of the controller In a German context, it is generally accepted that both of these involve a ladungsfähige Anschrift, i.e. a street address where you could be served with a lawsuit (not a post box). These requirements exist for both natural persons and legal entities, and for both businesses and non-commercial activities. The TMG Impressumspflicht talks about “geschäftsmäßige, in der Regel gegen Entgelt angebotene Telemedien” but in practice this only requires that the service could be paid (not that you're actually making any money), and that the service is offered routinely/business-like (not necessarily commercially). It does not matter where your service is hosted as long as you live in Germany. The TMG and GDPR might not apply if the forum is run purely privately, e.g. if it is only made available to a few close friends or family members.
No. Absent some collective bargaining agreement to the contrary, you have no recourse because you have not been legally wronged. You have no right to privacy in this regard. You have no right to be free of humiliation based upon truthful statements. If the email is truthful and you were indeed suspended, then the manager is entirely appropriate in sharing that information, and indeed has a need to do so. You would have no recourse in Tennessee, even if your manager gave a national television interview on your suspension and truthfully stated all reasons for the suspension and threw in statements of opinion disparaging you. Humiliation is only actionable if it amounts to "outrageous conduct" beyond mere truthful speech (e.g. throwing your clothes in the toilet or secretly putting some self-disparaging statement on the back of your uniform) and was calculated with a specific intent to cause you extraordinary emotional harm that was not necessary for some legitimate purpose.
The CEO wants to "fool" users You are essentially admitting that the company you are working for is about to deceit its customers and asking whether that is legal. The relevant set of laws is rather sparse and does not give direct answers in regards to oAuth tokens or other details of that level (which is probably making your CEO think he can "handle" the arising questions). Probably the most relevant bit of legislation that applies here is The Federal Trade Commission Act (15 U.S.C. §§41-58) which prohibits unfair or deceptive practices and has been applied to online privacy and data security policies. I am pretty sure that, in practice, if the users take your company to court, it will be held liable because: users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true? While the users are still allowing you to read their data it is completely up to the Terms/EULA what you can do with it. However, once you have made the users think that they have withdrawn your access (e.g. they "deleted" oAuth tokens), you are no longer authorized to read the current data (although the Terms may still allow you to use the old data you obtained when you had access). Silently continuing to access their data without their knowledge/approval is definitely a deceit. The CEO wants us to download all of their emails and store them in our database There would be nothing wrong with that if it was in the Terms. But if it is not, that would be a blatant (and easily punishable) breach of privacy. Note that you may also be held personally liable for this wrongdoing (if/when proved so). "Just doing your job" claim will not work.
The GDPR does not outlaw such processing of personal data. It merely regulates how and for what purposes you can process personal data. In general, you can conduct any processing activity as long as it has a clear purpose and a legal basis. Here, the purpose would likely be something like “conducting business with my clients” and the legal basis would be a “legitimate interest”. A legitimate interest always requires a balancing test that weighs your interests against the interests and rights of the affected persons. For example, can the affected persons reasonably expect such processing activities? In a professional setting, it can probably expected that business partners keep notes about contact persons so your intended processing could be fine. The GDPR does impose some general constraints. There are general principles like data minimization and storage limitation – you should only collect data that is necessary for your purpose, and shouldn't store it for longer than necessary. You should think about appropriate technical and organizational measures (TOMs) to protect the processing activity, for example about how your CRM is hosted, how backups are made and how security updates are installed, who has access to the personal data, and how the people with access to the personal data can be trained. For example, such training might inform your employees that they can only use the data in the CRM for business purposes, but absolutely not for personal purposes like asking Gina from reception out for a date.
But that a phone number exists in your collection is interesting information. Since phone numbers are identifying and so short that they are guessable, hashing does not provide anonymization. Hashing could still be an appropriate safety measure or pseudonymization technique. Note that the salt is typically stored as part of the hash value, and should not be considered to be a secret key. If the information had been anonymized it wouldn't be personal information and the GDPR wouldn't apply. However, since the phone numbers are personal information (even hashed, they relate to an indirectly identifiable person), you should apply standard GDPR compliance processes to determine whether storing these phone numbers is legal: What is the purpose of processing? Some purposes like national security or purely personal and household purposes are exempt from the GDPR What is the legal basis for this purpose? E.g. consent, legitimate interest, legal obligations, … What is the minimum data necessary to fulfill the purpose? If pseudonymized data is sufficient, pseudonymization is mandatory. What safety measures do you think are appropriate? This could shift a legitimate interest balancing test in your favor. What compliance measures are you obliged to take? E.g. information per Art 13–14, preparation for data subject requests, engaging data processors, further safety measures. While your purposes are probably benign, it can be useful to recall that the presence of identifiers in data sets can be a matter of life and death. When accounts were leaked in the Ashley Madison data breach, that drove some users to suicide. In some countries, the existence of a Grindr account can be a death sentence. Those are examples involving special categories of data per GDPR Art 9, so likely far more sensitive than the context of this question. However, in the AM breach it would not have helped much to hash identifiers like emails: third parties would still be able to check whether the email of someone they know was part of the breach.
Could I get into legal trouble for this? No. Relax. Your three emails are very unlikely to cause a data privacy professor to feel harassed. Just move on regardless of whether he replies at all. Don't keep sending another email just because the recipient has not replied to your previous one. As for the issue that prompted you to start emailing the professor, what everyone else has told you is correct. And the other email user is unlikely to take court action for something like this. The effort and cost of drafting &amp; filing suit, and then pursuing discovery would dissuade most people unless they are incurring actual losses (which is not the case with your messages). Just move on so that this other user also can move on.