Can a clause be added to a terms of use that forbids use of the service if the terms of use would be illegal in the user&#39;s jurisdiction? Can one add a clause stating Do not use this application if the terms demanded cannot be provided by law For example, let's say one term of use states that information collected may be retained forever, which is not possible in countries subject to the GDPR. In this case, users would be required not to use the application.
Yes, but ... It doesn’t protect you. Let’s imagine you put such a clause in and a person in Europe used your service notwithstanding: they’ve broken the contract but you’ve broken the law. You get the fine and they get ... nothing. Because you can’t contract outside the law you never had a valid contract with them so you have no basis to sue. Further, because you are purporting to something you can’t legally do, you are probably on the wrong side of misleading and deceptive consumer protection law: which is another fine. If you can ensure that you don’t breach local law - like by not operating over the internet - then you can choose not to deal with e.g. Europeans. If you can’t guarantee that, then you’re stuffed.
The GDPR does not outlaw such processing of personal data. It merely regulates how and for what purposes you can process personal data. In general, you can conduct any processing activity as long as it has a clear purpose and a legal basis. Here, the purpose would likely be something like “conducting business with my clients” and the legal basis would be a “legitimate interest”. A legitimate interest always requires a balancing test that weighs your interests against the interests and rights of the affected persons. For example, can the affected persons reasonably expect such processing activities? In a professional setting, it can probably expected that business partners keep notes about contact persons so your intended processing could be fine. The GDPR does impose some general constraints. There are general principles like data minimization and storage limitation – you should only collect data that is necessary for your purpose, and shouldn't store it for longer than necessary. You should think about appropriate technical and organizational measures (TOMs) to protect the processing activity, for example about how your CRM is hosted, how backups are made and how security updates are installed, who has access to the personal data, and how the people with access to the personal data can be trained. For example, such training might inform your employees that they can only use the data in the CRM for business purposes, but absolutely not for personal purposes like asking Gina from reception out for a date.
Is that extortion? false advertising? or in any way illegal? Not at all. The owner of the site is simply exercising his right as outlined in the terms and conditions from when the user signed up. And giving users an option for continued use of the site (that is, for him not to exercise a right of which they were always aware) does not constitute extortion.
GDPR rights and obligations cover different things: A duty of the data processor towards the government of the country where they operate to present certain documentation, and to implement technical and organizational measures to protect data. These would be audited by government agencies, not the individual customer. A single data subject cannot waive them. A duty of the data processor to process and store personal data only with a legal justification. User consent is one possible justification, if it is informed, revokable, etc. So a single data subject can waive a &quot;ban&quot; on storing his or her data in a database along with all the other users who waived that &quot;ban,&quot; but the duties towards the government regarding that data would still apply. A duty of the data processor to respond to an Article 15 request by the data subject in a certain way and timeframe. If a data subject writes a letter to the data processor and explicitly states that the letter is not an Article 15 request, then Article 15 does not apply. The data subject would of course have the right to make an Article 15 request at a later time.
It is not possible for someone to forfeit their rights because the GDPR is compulsory law. In the EU, laws can be regulatory or compulsory. In case of an agreement, regulatory laws can be set aside, if both parties agree on that. But compulsory laws cannot be set aside. Of course laws can also be partly compulsory. For example provisions which cannot be changed in disadvantage of a consumer. So there is freedom of contract, but it's freedom is reduced by law for the common good or for example to avoid misuse of bargaining power. In particular consumer related laws are often compulsory because it has little power against the other parties. Companies can have their negotiations done by lawyers, so they can make a well informed an well negotiated decision. As an extreme example, you cannot kill someone, even if that person has given you written permission. See also "Peremptory norm" on wikipedia for international law examples.
There's a few good reasons that spring to mind. Firstly, it's possible that Tesla or Microsoft have been themselves licensed something where the license is not sub-licenseable. This would prevent them from subsequently licensing you, but a promise/pledge is not a license and they can go right ahead and make promises. Secondly, a license is broadly an agreement between two parties. A promise doesn't require formal acceptance whereas a license does. To answer your question regarding a covenant not to sue - that's something else entirely. A covenant not to sue is a legal agreement between parties where the party seeking damages agrees not to sue the party it has cause against, whilst still preserving the existence of the cause (and conditions may have been set that must be met for the covenant to stand). For example, Party A still maintains that Party B used work that was not licensed to Party B, but Party A has agreed not to sue on the matter, provided that Party B advertises the fact that the work was used.
Since your consent is not required in Texas, revocation is irrelevant. Restrictions of use of recordings flow from the legal nature of the recording itself, so there is no provision saying, for example, that only one party needs to consent for just recording, but all parties must consent to make any use of the recording. Since these laws were devised to regulate the practice of wearing a wire and collecting evidence of crimes, requiring consent from all parties would be counterproductive to the purposes of the law. You could try drafting a contract where you pay people to not record you (anybody who doesn't sign, you shouldn't talk to them), but enforcement could be tricky, so I would not try a DIY contract: get a lawyer. You would have to show that you were harmed by them making an unconsented recording. It should be in the form of a contract where you give something of value in exchange for something of value, which is a thing typically enforced by the courts. Also bear in mind that even in an all-party state, if you know that you are being recorded, you cannot just say &quot;I do not consent&quot;, you have to stop talking. Continuing to talk when notified that there is or may be a recording constitutes implied consent, which is why on the phone companies often announce via recording that the conversation may be monitored, and they do not ask &quot;Do you consent&quot;. By not hanging up, you consented.
Yes, this violates the GDPR if the user is in Europe. Data which is tied to a personal device can be tied to the person who owns it. From "What Is Personal Data" by the UK Information Commissioner's Office (ICO) (emphasis added): Personal data is information that relates to an identified or identifiable individual. What identifies an individual could be as simple as a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors. If it is possible to identify an individual directly from the information you are processing, then that information may be personal data. If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual. The bit about "all means reasonably likely" in the last bullet includes the kind of de-anonymisation tactics described in the NYT article. There are 6 lawful bases for data processing in the GDPR, and all processing must fall under at least one of them. (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) Selling data isn't covered by any of the others, so consent must be obtained. Permission must be clear and positive, and you cannot predicate delivery of a service on the processing of data that isn't necessary for that service. So for instance you cannot say "You can use this service as long as we are allowed to collect and sell your data" because selling the data isn't necessary to the provision of the service. From "Consent" by the ICO: Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. Explicit consent requires a very clear and specific statement of consent. Keep your consent requests separate from other terms and conditions. Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. [...] Avoid making consent to processing a precondition of a service. This applies to any processing of data about individuals within the EU, so just being an American company doesn't get you a free pass to ignore the GDPR if your app gets used by Europeans. The "Legitimate interests" basis is more problematic, in that the company collecting the data has to conduct a vague "balancing test" to determine if this basis applies. For direct marketing the ICO has written this, which says that direct marketing may be a legitimate interest, especially if you can show that the user has expressed interest in such adverts. For instance a location service which promises to tell you about nearby special offers would fall into this category. Against this, the impact on the user's privacy has to be considered, and location data is "special category data" because it can reveal medical information (e.g. hospital attendance) or religious affiliation (e.g. which church you go to). So unless the relationship between the recorded location data and the service is very direct its not going to pass the balancing test. The company would also need to distinguish between knowing the current location and keeping a record of historical locations; the two need separate justification. And of course nothing about this covers the sale of the data; this is considering a company which sells advertising space in it's app, not one that sells the data itself.