Are you allowed to put a customer&#39;s email address in an internal business email? Today at work I put a number of our customers' email addresses in an email that only people in the business were CCed on because we were dealing with a matter relating to these customers and their email addresses. A work colleague told me that it was illegal (breach of privacy) to put our customers' email addresses in the email. Is this true? The company operates in Australia. Note that the email I sent was internal. No one outside the company should ever see it.
Businesses do hold customers' email addresses. These are routinely stored and communicated between the businesses' internal IT systems. There is nothing illegal about this. The only difference that internal email communication makes to the above is that not just machines but employees see the customers' email addresses. So, essentially the question is: is it legal for a business to show its customers' email addresses to its employees? As per Australian Privacy Principles, personal information needs to be kept secure. Businesses therefore have duty to do their best not to leak customers' personal information (which includes email addresses). Limiting the circle of people who see personal information only to those who need to see it is essential to perform this duty. So, essentially, the answer depends on whether all those people CC'ed actually needed to see the email addresses for business purposes. If, for example, one of those people was your office cleaner, then you have done bad job in performing your duty to secure personal information. Should that cleaner leak the email addresses outside the business, you will be held liable.
You violated Facebook's Terms of Service, and it's entirely within your contractual agreement with them for them to close your account. You agreed to abide by the contract you "clicked through" when you signed up and opened a Facebook account. They didn't break any laws when you broke your contract with them. You clearly broke the contract by violating the TOS. They are not breaking any laws by not restoring your account. What you see as the value of your personal or business data doesn't really mean anything; it was your choice to use Facebook in the first place, and your mistake to break the TOS. You could try hiring a lawyer to make a case that you see a difference between the personal data you want to retrieve and the business data that caused the violation, but that's up to you; Facebook is under no legal obligation (this could be different, according to your jurisdiction and national laws) to restore any or all access to your account or data, but it's possible they could be persuaded.
That is a very broad clause, broader than the default US rule for copyright, for example. (I know the question asked about the UK, I just happen to know the US copyright rule.) It would seem on the face of it to include independent research on a subject totally unrelated to the person's employment, done off the company's premises and not during normal work hours, but while the person was an employee.. Indeed it would arguably include the copyright to a novel written off premises and during off hours. Use of "course of employment" (instead of "term") would improve the provision. so would "as a part of his or her employment" or "closely related to the subject of his or her employment". Another possible restriction would be "Using the Company's facilities and/or equipment, or during normal working hours". However, my experience is that an employer will have drafted whatever language it uses through its company lawyer, and will be quite unwilling to alter it in any way. A prospective employee will probably be faced with a take-it-or-leave-it choice unless that person is a nearly indispensable figure to the company. One could send the company a certified letter saying, "When i signed the contract agreeing to {company language} I did not intend to include any developments made off company premises, not using company equipment, and unrelated to the subject or scope of my employment. I retain full rights to any such developments." Such a letter would help establish that there was no meeting of the minds to assign such non-employment-related developments or IP to the Company. How much weight it would have if the rights to such developments were the subject of a court case I am not sure.
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
Yes, but ... It doesn’t protect you. Let’s imagine you put such a clause in and a person in Europe used your service notwithstanding: they’ve broken the contract but you’ve broken the law. You get the fine and they get ... nothing. Because you can’t contract outside the law you never had a valid contract with them so you have no basis to sue. Further, because you are purporting to something you can’t legally do, you are probably on the wrong side of misleading and deceptive consumer protection law: which is another fine. If you can ensure that you don’t breach local law - like by not operating over the internet - then you can choose not to deal with e.g. Europeans. If you can’t guarantee that, then you’re stuffed.
This follows from a term in your agreement: in opening the account, you agreed to a binding arbitration clause. The general reason why they can do this is because it is not prohibited by law to have such clauses in agreements (in fact, the Federal Arbitration Act protects such clauses from legal challenge). For the same reasons, the clauses can impose deadlines on opt-out or require opt-out by mail as opposed to email or phone call. The premise is that if you find such terms unacceptably onerous or unacceptable, you will not patronize that business. That assumes that the customer read and understood the agreement that they signed, which I grant is often untrue.
Generally speaking, if a person sends you an email you can publish it. Like if they call you a bunch of nasty names, or threaten you in some way, that information is yours and you can publish it. However, I'll give you three scenarios where you should not publish an email sent to you (and I'll edit to add more if they come up). Private facts. There is a tort called publication of private facts. A plaintiff must establish four elements to hold someone liable for publication of private facts: Public Disclosure: The disclosure of facts must be public. Another way of saying this is that the defendant must "give publicity" to the fact or facts in question. Private Fact: The fact or facts disclosed must be private, and not generally known. Offensive to a Reasonable Person: Publication of the private facts in question must be offensive to a reasonable person of ordinary sensibilities. Not Newsworthy: The facts disclosed must not be newsworthy. Stated differently, the facts disclosed must not be a matter of legitimate public concern. From Digital Media Law Project Note one thing - the offensive fact does not need to have been completely private for you to be liable, it must not have been generally known. In other words, someone like you who has a really low "public" bar needs to be careful. Also note that your buffer system might not help if the facts you publish are about someone other than the email sender; you are the one who published them. Stolen Information If someone sends you some intellectual property of a third party it is not yours to publish. Trade secrets, copyrighted works, prototype photos, etc. The sender might be breaking the law by sending the stuff to you but you're the one who published it so you can join as co-defendants. Barrett Brown was indicted for sharing a link to some stolen information. A link! He's in prison on other charges. Copyright held by the original sender (ht to @Dave_D) If the sender is the original author of the email, then the sender holds the copyright to the body of the email. Publishing the email violates the copyright. However, you could account for this in your buffer. Maybe. I am not sure is that is explicit enough.
You asked about other jurisdictions. As you'll probably be aware (from cases like EU vs Microsoft and EU vs Google) European countries and culture tend to have much stronger protection laws for consumer and employee rights than the US does. In the UK you could make a strong case, although such cases are not often undertaken. The current legislation is Part 2 of the Consumer Rights Act 2015, but the unfair contract terms clause goes back to at least the Unfair Terms in Consumer Contracts Regulations 1999. Basically the law protects a person in a situation where disparity of size and bargaining power have led to unfair terms in a contract (typically a large company offering "take it or leave it" standard terms) - and specifically if they create a significant disparity in the parties rights and obligations. In such a situation the company which drafted the terms alleged to be unfair must show they are reasonable. A list of common terms likely to be seen as unfair is provided. (Employment terms are covered by other laws but also aim to prevent abuses due to inequality of contracting power) A company which sold a product like Windows 7/8/8.1 and then later said "we are changing our terms of support and forcing you to upgrade" (especially to a different product the user may not want, or a product that is maintained in a different way),would almost certainly be at substantial risk of falling foul of this. It wouldn't matter if it was done by not providing the support/patches as originally implied (by custom or normal expectation) or as agreed in an explicit statement of support life cycle, or by saying "we have the right under the contract to do this", or by forcing what is essentially a change of product to get the updates. It also wouldnt matter how big they are, nor whether or not the user had already agreed "because I felt I had no choice". The law is there specifically to protect against abuses like this, so it is drafted to catch companies who try to find "wriggle room".