Is it illegal to continue using oAuth tokens after a user asks to remove them? We have an app that allows users to connect their CRM. The CEO wants to "fool" users into making them believe that they can delete the OAuth tokens so that we don't have access to their data anymore. However, the CEO wants the dev team to continue using those tokens in the background and read the user's data. I'm the lead developer, and I have concerns about the legality of what he's asking. I don't want to be guilty by association. This is a pre-seed startup in the United States. Also, the CEO wants to download all of the CRM data from our users and re-sell it to other users. For example, if Lyft were to connect their CRM to our tool, the CEO wants to use that data to sell it to Uber and vice-versa. He claims this is legal because users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true? Are there any policies that we or I should be aware of before rolling out this solution? We also request users to connect their business emails (Gmail and Outlook) to our tool. The CEO wants us to download all of their emails and store them in our database in plain-text. Are there any policies or regulations that I, as a dev lead, should be aware of? Edit: There is no "legal" department, we have investors, and some investors have asked about the legality, and the CEO keeps saying "we're covered" He claims that he hired three firms to go over legal issues, but he refuses to share the name of the firms with me. He always evades the question with things like "Let me handle that."
The CEO wants to "fool" users You are essentially admitting that the company you are working for is about to deceit its customers and asking whether that is legal. The relevant set of laws is rather sparse and does not give direct answers in regards to oAuth tokens or other details of that level (which is probably making your CEO think he can "handle" the arising questions). Probably the most relevant bit of legislation that applies here is The Federal Trade Commission Act (15 U.S.C. §§41-58) which prohibits unfair or deceptive practices and has been applied to online privacy and data security policies. I am pretty sure that, in practice, if the users take your company to court, it will be held liable because: users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true? While the users are still allowing you to read their data it is completely up to the Terms/EULA what you can do with it. However, once you have made the users think that they have withdrawn your access (e.g. they "deleted" oAuth tokens), you are no longer authorized to read the current data (although the Terms may still allow you to use the old data you obtained when you had access). Silently continuing to access their data without their knowledge/approval is definitely a deceit. The CEO wants us to download all of their emails and store them in our database There would be nothing wrong with that if it was in the Terms. But if it is not, that would be a blatant (and easily punishable) breach of privacy. Note that you may also be held personally liable for this wrongdoing (if/when proved so). "Just doing your job" claim will not work.
You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.
Fairly easily. You want to use their API. They give you the conditions for using it. As long as their conditions aren't illegal or unreasonable, you need to adhere to them to use their API. Is it illegal to not include "insta", "gram", or "instagram" in your company or product name? Almost certainly not. Is it an unreasonable term? Almost certainly not. If you want to include "insta", "gram", or "instagram" in your company or product name, you can try - but you can't then use their API.
Yes, your transaction history is your personal data. Personal data is any information relating to an identifiable person. Your transaction history relates to you, and you're definitely identifiable for the bank. You have access to the transaction history to the app, which would probably satisfy Art 15 GDPR. You do also have a right to data portability under Art 20 GDPR which allows you to get your data in a machine-readable format – but strictly speaking this right only applies to data you provided yourself. You could try to explicitly invoke this right. Your GDPR rights must be satisfied without cost. Your bank almost certainly does provide machine-readable API access, in conformance with the open banking mandate from the Revised Payment Services Directive (PSD2, Directive (EU) 2015/2366). The Directive requires your EU member state to have passed a law that gives you “the right to make use of services enabling access to account information”, if you're already using online banking. However, the exact details of that right will depend on the laws in your EU member state. You might already be able to connect to your transaction history via Open Banking software such as GNU Cash.
Yes, but it doesn't matter. This answer discusses gdpr implications. Personal data is any information that relates to an identifiable person. The GDPR has an extremely broad concept of identifiability, also covering indirect identification using additional information and with the help of third parties. Even just being able to single out one data subject, i.e. being able to distinguish different users from another, counts as identification. If you already have a concept of user accounts, any information that is linked with the user accounts and somehow relates to those users would also be personal data. Since you have distinct push tokens per user, it seems like this criterion would be met. Additionally, those unique tokens might be directly identifying by themselves. The GDPR does not allow for semantic games like “it only identifies the device, not the user”. The key here is that the definition of identifiability does not hinge on your intentions, but on objective capabilities: if you or someone else who can come into possession of this data were to attempt to identify the user (such as singling out users from another), would they be reasonably likely able to do that? Since most devices are single-user, being able to identify a device would imply that you're reasonably likely to also identify users. Just because something is personal data doesn't mean you're forbidden from using that data. It means that you'd have to comply with GDPR rules, if you're otherwise within scope of that regulation (e.g. if you're EU/UK-based, or are targeting your services to people who are in UK/EU). For example, basic GDPR compliance steps include having a clear legal basis for your processing of personal data (such as necessity for performing a contract to which the data subject is party, or necessity for a legitimate interest, or consent), providing a privacy notice, and taking appropriate technical and organizational measures (TOMs) to ensure the compliance and security of processing. For example, TOMs regarding these push tokens could involve encryption, access controls, and a plan for installing security patches in order to prevent data breaches. Using push tokens is already a good measure in this context, since they are effectively pseudonymous and prevent linking additional information via that token (two sites/apps pushing notifications to the same person will have entirely different tokens). However, the push notification provider (e.g. Google, Apple, Mozilla) can resolve the pseudonymous tokens and link them to a person, indicating that these tokens are ultimately identifying (even if you can't perform that linking yourself). Note that if GDPR applies, then other EU/UK rules might apply as well. For example, sending electronic messages (such as emails) is subject to anti-spam rules (EU: ePrivacy, UK: PECR). These rules apply regardless of whether personal data is involved. Since the rules are not technology-specific, it is likely that regulators would consider user-visible push notifications to be equivalent to more well understood technologies like email and SMS.
Just at the offset this does not constitute legal advice, just some opinions I have on this point. Technically, you would not be prohibited to generate speech and use it however you like. Under normal circumstances any output generated by the system that does not contravene the service agreement would be your intellectual property. This would include the text and speech generated. Once you go about the request limit you would naturally be required to pay, but until that time you can use the service as a paying customer. Just to clarify this point I would like to make reference to the service license agreement, clause 3, which make reference to the following prohibitions: (a) copy, modify, create a derivative work of, reverse engineer, decompile, translate, disassemble, or otherwise attempt to extract any or all of the source code of the Services (subject to Section 3.4 below and except to the extent such restriction is expressly prohibited by applicable law); (b) use the Services for High Risk Activities; (c) sublicense, resell, or distribute any or all of the Services separate from any integrated Application; (d) create multiple Applications, Accounts, or Projects to simulate or act as a single Application, Account, or Project (respectively) or otherwise access the Services in a manner intended to avoid incurring Fees or exceed usage limits or quotas; (e) unless otherwise set forth in the Service Specific Terms, use the Services to operate or enable any telecommunications service or in connection with any Application that allows Customer End Users to place calls or to receive calls from any public switched telephone network; or (f) process or store any Customer Data that is subject to the International Traffic in Arms Regulations maintained by the Department of State. Unless otherwise specified in writing by Google, Google does not intend uses of the Services to create obligations under HIPAA, and makes no representations that the Services satisfy HIPAA requirements. If Customer is (or becomes) a Covered Entity or Business Associate, as defined in HIPAA, Customer will not use the Services for any purpose or in any manner involving Protected Health Information (as defined in HIPAA) unless Customer has received prior written consent to such use from Google. Similarly, as specified here: Customer will not, and will not allow third parties to: (i) use these Services to create, train, or improve (directly or indirectly) a similar or competing product or service or (ii) integrate these Services with any applications for any embedded devices such as cars, TVs, appliances, or speakers​ without Google's prior written permission. These Services can only be integrated with applications for the following personal computing devices: smartphones, tablets, laptops, and desktops. In addition to any other available remedies, Google may immediately suspend or terminate Customer's use of these Services based on any suspected violation of these terms, and violation of these terms is deemed violation of Google's Intellectual Property Rights. Customer will provide Google with any assistance Google requests to reasonably confirm compliance with these terms (including interviews with Customer employees and inspection of Customer source code, model training data, and engineering documentation). These terms will survive termination or expiration of the Agreement. You should also take a look at this and this. However, as per the terms of the agreement the speech generated would be your intellectual property, unless otherwise specified. Good luck!
You can't grant or license that which is not yours. For example, the Slack terms of service say: We grant to Customer a non-sublicensable, non-transferable, non-exclusive, limited license for Customer and its Authorized Users to use the object code version of these components, but solely as necessary to use the Services and in accordance with the Contract and the User Terms. So Slack's agreement with Org A does not give A any right to let any other organization B use the software. It does not matter how A and B are related, nor whether B is nonprofit or for-profit, nor what A would be getting in exchange. If B wants to use it, they need to make their own agreement with Slack.
While German law indeed requires providing correct contact information it does not require the recipient to answer queries. It is there so that you can submit legal notifications. In your case I wouldn't be so sure that the information is not correct. However, even if the contact information is incorrect, there is not much you can do about it. This is reserved to the following groups by § 8 Abs. 3 UWG: every competitor; associations with legal personality which exist for the promotion of commercial or of independent professional interests, so far as a considerable number of entrepreneurs belong thereto, and which distribute goods or services of the same or similar type on the same market, provided such associations are actually in a position, particularly in terms of their personnel, material and financial resources, to pursue the tasks, under their memoranda of association, of promoting commercial or independent professional interests, and so far as the contravention affects the interests of their members; qualified entities that prove that they are entered on the list of qualified entities pursuant to section 4 of the Injunctions Act or on the list of the Commission of the European Communities pursuant to Article 4 of Directive 98/27/EC of the European Parliament and of the Council of 19 May 1998 on injunctions for the protection of consumer interests (OJ Number L 166 page 51); Chambers of Industry and Commerce or Craft Chambers. Unless you are a competitor you are out of luck. The hoster or other providers can't do anything and don't need to, as they are not required to check legality of their user's websites. It doesn't really matter where you are by the way for these laws.