Can a US company ask prospective American employees, contractors or partners about their country of birth? I decided recently to sign up as a seller on Amazon.com. The first step of the registration process however, asks about the applicants &quot;Country of Birth&quot;. Is this legal? That seems to completely irrelevant and an opening for discrimination. I think the country will be worse off if in the course of ordinary business, people were asked about their countries of birth. In America, we're all supposed to be American (though I can understand in certain very sensitive national security situations) If anyone can comment on the legality of this, I would appreciate. As a follow-up question, I would be curious to know if Amazon can in any way be sued for asking this and what the potential risk/reward of such a lawsuit would be?
The EEOC states that national original discrimination in employment is illegal, which is supported by 28 CFR Part 44 (discriminate means &quot;the act of intentionally treating an individual differently from other individuals because of national origin or citizenship status, regardless of the explanation for the differential treatment, and regardless of whether such treatment is because of animus or hostility&quot;). See also Title VII of the Civil Rights Act of 1964: It shall be an unlawful employment practice for an employer - (1) to fail or refuse to hire or to discharge any individual, or otherwise to discriminate against any individual with respect to his compensation, terms, conditions, or privileges of employment, because of such individual's race, color, religion, sex, or national origin; or (2) to limit, segregate, or classify his employees or applicants for employment in any way which would deprive or tend to deprive any individual of employment opportunities or otherwise adversely affect his status as an employee, because of such individual's race, color, religion, sex, or national origin. codified at 42 USC 2000e–2. The internet widely advises that asking such questions is illegal. The EEOC has a more nuanced view of the matter as articulated here: they say We recommend that you avoid asking applicants about personal characteristics that are protected by law, such as race, color, religion, sex, national origin or age. These types of questions may discourage some individuals from applying, may be viewed suspiciously by some applicants, and may be considered evidence of intent to discriminate by the EEOC. If you do not have this information when you decide who to hire, it may be easier for you to defend your business against a hiring discrimination complaint. Before reaching a conclusion, we should check what an employee is (42 USC § 2000e(f)), namely: an individual employed by an employer, except that the term “employee” shall not include any person elected to public office in any State or political subdivision of any State by the qualified voters thereof, or any person chosen by such officer to be on such officer’s personal staff, or an appointee on the policy making level or an immediate adviser with respect to the exercise of the constitutional or legal powers of the office. The exemption set forth in the preceding sentence shall not include employees subject to the civil service laws of a State government, governmental agency or political subdivision. With respect to employment in a foreign country, such term includes an individual who is a citizen of the United States. This just tells us that in writing the law, Congress left it somewhat open what an &quot;employee&quot; is. An Amazon seller is, on the face of it, not an employee of Amazon, instead, a seller is an independent contractor. Of course that is a legal question that can't just be decided superficially, see for example California's AB5 (but even under that law, a seller is not an employee). As articulated by SSA The common law control test is the basic test, using the common law rules, for determining whether a relationship exists between the worker and the person or firm that they work for. Under the common-law test, the employer has the right to tell the employee what to do, how, when, and where to do the job If the Dept. of Labor or the IRS determine that you are (would be) an employee, then this is illegal discrimination, otherwise it is not. Since you are not paid a wage, the prospects for being deemed an employee are extremely dim. The EEOC gives this guidance on the distinction, with a very long list of examples which in general support the position that a vendor is an independent contractor and not an employee.
Yes, it also applies. However, an employment implies they agree to having employment related data stored and processed (e.g., to be paid). When there are performance related bonuses in the contract, this will likely (but IANAL) imply they agree to performance data being collected and stored appropriately. Furthermore I would assume most of such data processing (such as knowing who is responsible for a certain change, who created a file, modified it etc.) falls into "legitimate interests" of the employer, as this information may be necessary for operations. I'd assume (still IANAL) that much of the consequence wrt. GDPR is the right to have your data erased. So a company should be prepared to remove such data when an employee leaves the company, e.g., by clearing the responsible person fields upon request. At least for data where there is no legal requirement to have such data provenance. But: consult your lawyer for a proper legal opinion!
The company probably owes U.S. and state corporate income taxes because income from services performed in the United States are usually considered "effectively connected" with the United States. The fact that the servers are located in the U.S. is pretty much irrelevant, relative to the fact that the services are performed while located in the United States. I can't think of a single tax case that has ever turned on the location of the servers in a company. Unlike a U.S. company, a foreign company is not taxed by the U.S. on its worldwide income, nor is the individual, a non-resident alien (having an F-1 visa rather than a green card) taxes on the individual's worldwide income. But, a non-U.S. person is still taxed on income that is effectively connected with the United States. Generally speaking income from property is not effectively connected with the United States merely because it is managed by someone located in the U.S., so if the company had owned an apartment in Brazil that it received rental income from, for example, that would not be subject to U.S. taxation. Also income from intangible property (like interest payments on loans or dividends on publicly held stock) is generally not subject to U.S. taxation if paid to a non-resident, non-citizen of the U.S. But, generally speaking, income from the performance of services is taxable in the place where the services are performed. For example, Colorado can impose state income taxes on income earned by a Texas baseball player while playing at a stadium in Denver. The lack of a salary or employee status shouldn't change the fact that the income received by the company from performance of services in the U.S. is effectively connected with the United States. When the owner performs services in the U.S., the company is performing services in the U.S. and so it is subject to taxation in the U.S. Dividend payments from the offshore company probably wouldn't be subject to U.S. taxation in this scenario, but the company itself would be subject to corporate income taxes in the U.S. from the profits it earned from the services performed in the U.S.
Greendrake's answer says that a country can declare any jurisdiction it likes. This is true, but in practice it is the convention that a country should claim jurisdiction only over its territory and its citizens. The point about "citizens" is normally not pushed, as when you go to a foreign country you are normally subject to its laws rather than those of your home, but for instance there are laws against child sex tourism where the perpetrators can be prosecuted at home for offences committed abroad. However this basic principle gets more murky with long-distance communication such as the Internet. Someone in country X can, for example, provide a service to someone in country Y which is illegal in country Y. At this point the laws of country Y have been broken by someone sitting in country X. Y is not claiming extraterritorial jurisdiction; the crime occurred inside its own territory, but the criminal is currently resident in X. From a legal point of view this is the same as if both had been inside Y when the crime was committed, but then the perpetrator fled to X before they could be arrested. So in the Kim Dotcom case, Dotcom is alleged to have committed criminal copyright violations by supplying movie files to people in the US. In the Meng Wanzhou case, Meng is alleged to have made fraudulent statements to American banks to the effect that Huawei was complying with US sanctions law (otherwise those banks would not have been able to do business with Huawei). The accounts I've read don't say whether Meng was in the US for those meetings, but the fact that they were made to American banks in order to do business in America makes the precise location of the meeting irrelevant.
Not that I am aware of. A person who 'owns' a domain is entitled to utilize that domain including for the purposes of receiving emails. With physical mail, it is a crime in most countries to intentionally interfere with mail that is not addressed to you. For example - Australia. However, this is statute law and as such does not extend to emails - even if it did, if you own the domain then you are the person to whom it was addressed. I note that you seem to misunderstand "confidential" - this only arises in the context of a special relationship between the person transmitting the information and the person receiving it. Usually this is a contractual obligation between A and B but it can be imposed by law (e.g. doctor-patient, banker-client, lawyer-client, GDPR etc.). If A sends confidential (as between A &amp; B) information to C, C is under no general obligation to keep it confidential if C has no relationship of confidentiality with A or B. If C discloses it and B suffers damage, B sues A for breach of confidence (or the government prosecutes A for breaking the law); B has no case against C. For your situation, where B has allowed A to send the information to an obsolete address then B has contributed to the breach to an extent that B would be extremely unlikely to succeed in a suit against A.
"Legal requirement" can and in this case simply means "it's what is required in order for us to be reasonably able to offer you this service", noting that it would be unreasonable for such a dangerous business to operate, when one moron slipping and suing them could put them out of business. It's a little surprising that you've never had to sign a waiver before, but there are quite a number of similar waivers out there, such as REI (Seattle), The Edge (Vt), Croc Center (Coeur d'Alene), YMCA (MI) and U. Nebraska. They all have in common the requirement of a signature (indicating that you've waived your right to sue them), birth date, date of signature. This is the bare minimum that's required to have a valid waiver, and more info would be better (to uniquely identify the customer out of the 1000 John Smith's in the state and 500,000 in the US). If you break yourself and try to sue, they will trot out the waiver to put an end to the suit. Name, address, phone number and birth date do a long ways towards proving that the person who signed the waiver is indeed you.
If an employee takes home information that his or her employer considers confidential, that would be a matter of company policy. The employer could discipline or fire the employee if it learned of the incident, and chose to act. If the information is considered to be a trade secret, or part of one, disclosing it or mishandling it so as to risk disclosure could be a crime under US law. However, only in unusual cases is criminal action taken on such matters, normally it is left to civil lawsuits or internal company action. I do not know if Canada has a similar law.
The CEO wants to "fool" users You are essentially admitting that the company you are working for is about to deceit its customers and asking whether that is legal. The relevant set of laws is rather sparse and does not give direct answers in regards to oAuth tokens or other details of that level (which is probably making your CEO think he can "handle" the arising questions). Probably the most relevant bit of legislation that applies here is The Federal Trade Commission Act (15 U.S.C. §§41-58) which prohibits unfair or deceptive practices and has been applied to online privacy and data security policies. I am pretty sure that, in practice, if the users take your company to court, it will be held liable because: users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true? While the users are still allowing you to read their data it is completely up to the Terms/EULA what you can do with it. However, once you have made the users think that they have withdrawn your access (e.g. they "deleted" oAuth tokens), you are no longer authorized to read the current data (although the Terms may still allow you to use the old data you obtained when you had access). Silently continuing to access their data without their knowledge/approval is definitely a deceit. The CEO wants us to download all of their emails and store them in our database There would be nothing wrong with that if it was in the Terms. But if it is not, that would be a blatant (and easily punishable) breach of privacy. Note that you may also be held personally liable for this wrongdoing (if/when proved so). "Just doing your job" claim will not work.