&quot;No logs&quot; in Switzerland and Internet crime ProtonVPN says that their servers are in Switzerland and that: Under Swiss law, we are not obligated to save any user connection logs, nor can we be forced to perform targeted logging on specific users. This allows us to ensure that your private browsing history does in fact stay private and cannot be turned over to a third party under any circumstances. How come this is viable? What if people use their service to commit crimes?
How come this is viable? Because it’s legal. What if people use their service to commit crimes? What if people use a Ford in a bank holdup? Or a Glock in a murder? Or the US Postal Service in a Nigerian letter scam? If the goods or services are legal and not provided for an obviously illegal purpose, nothing happens.
This is relatively uncharted legal territory, so until multiple cases establish some sort of precedent, we can only guess. I know of no legal requirement that a Browser or User has to submit cookies or referrer data or other meta-information accurately. In that regard, a user is unlikely to be prosecuted just for submitting HTTP headers. It is likely closely related to Free Speech issues. The DMCA spells out that it is illegal to circumvent copyright protection measures. While this law is typically used to make it illegal to copy DVDs, video-games or streaming movies, it is possible that the "3-free articles" policy could be interpreted as a copyright protection mechanism, and defeating it by changing HTTP headers is a circumvention. A good summary is here. A specific site's TOS (Terms of Service) probably contains language that spells out it is a violation to use the site in a manner other than as it is intended. This is a typical anti-hacking, anti-screen-scraping provision. Altering a browser session to circumvent their services is probably a violation of the license to access the site, and may open a user to a civil lawsuit for damages or even criminal hacking charges (the details of which are different state-to-state)
Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions. Personal data from users/customer is carried for lots of reasons, not just marketing. What if you're asked to delete data that is needed to bill customers, information that may be relevant to a legal case or information that needs by law to be retained for the purposes of audit? GDPR does not make it illegal to carry personal information, it simply needs you to justify why you are keeping the information - inform the named person about this and provide them with a timescale for deletion. For example if you are required by law to store a record of emails to document the work done, but the user asks you to delete that information. You would be entitled to keep that information but only for the purposes of maintaining that audit trail. You would delete all associated customer data that was unnecessary such as CRM info, payment details etc.. but could keep the audit trail. The proper way to respond to the user's deletion request would be "your data will be kept in a secure server for the purposes of maintaining an audit trail for x amount of time. Once this time has elapsed it will be deleted. If you are unhappy with our use of this data please contact our data officer". GDPR isn't designed to catch you out - if you have a legitimate reason to keep that information then you are entitled to. The law was designed to stop marketers and advertisers hoarding huge amounts of information, as well as undermine Google/Facebook's duopoly on our personal information.
Surely such a well meaning albeit naive driver wouldn't stand a chance in court if they said that it's because they've a section 230-like protection. Because Section 230 of the Communications Decency Act explicitly protects computer service providers from such charges. A driver is not a computer service provider, and the US legislature has never voted to offer similar protection to drivers picking up hitchhikers. You say that an email can easily be classified as fraudulent, but that's not true. Spam detection has gotten pretty sophisticated, but they still get plenty of false positives. They were a lot less sophisticated back in 1996 when the Communications Decency Act was passed.
I'm only going to consider US perspectives, which may or may not answer your question entirely. Also, I'm not going to address the guesses in other answers because, and except to say, they don't appear to be based in law, but rather (mis)understandings of law. 17 U.S. Code § 512 provides protections for service providers when providing content, online. This expressly includes caching. In Viacom Int'l, Inc. v. YouTube, Inc., 676 F.3d 19 (2d Cir. N.Y. 2012) at 39, the Court held that to exclude these functions from the safe harbor would remove protections for service providers under subsection (c). The answer, however, lies in Perfect 10 v. Google, Inc., 416 F. Supp. 2d 828 (C.D. Cal. 2006), in footnote 17, at 852: Local caching by the browsers of individual users is noncommercial, transformative, and no more than necessary to achieve the objectives of decreasing network latency and minimizing unnecessary bandwidth usage (essential to the internet). It has a minimal impact on the potential market for the original work, especially given that most users would not be able to find their own local browser cache, let alone locate a specific cached copy of a particular image. That local browser caching is fair use is supported by a recent decision holding that Google's Click for Enhanced Coverage Linking Searches own cache constitutes fair use. The case referred to is Field v. Google, Inc, 412 F.Supp. 2d 1106 (D. Nev. 2006). Although the Perfect 10 v. Google, Inc. was overturned on appeal - Google was permitted to utilise thumbnails in their search pages - and the above is merely obiter, it is the closest to a ruling on browser caching I have been able to find. In short: Google's caching has been found to be fair use. It is unlikely that your local cache would not, as it is generally done automatically.
I think this shows a misunderstanding of the meaning of the GDPR. A data subject has the right to demand information, correction, deletion etc. about some of their data held by some institutions, depending on the legal basis for the data processing. One John Smith does not have the right to see the data of any other data subject named John Smith, and he cannot even demand to know if there are other John Smiths in the database. The data controller has to make reasonable steps to ensure that an individual who seeks account information is in fact the individual who is the data subject. In the case of an email, that's usually easy -- if John Smith can access the mail account jsmith@sample.org, one can assume that he is the John Smith who opened the account. If not, then not. If the data controller has the birthplace and birthdate in their records, they can possibly match that against some government-issue identity document, too, but why would they have that data?
In all likelihood, the judge's order related to data collection and reselling is not legally enforceable. They weren't parties to the expungement action, so the judge doesn't have jurisdiction over them. And, the First Amendment protects the right to say truthful things pretty absolutely. Arguably, if the sites provided the information without making clear that it might not be current because records were expunged or corrected, there might be a claim for negligent misrepresentation, false light, or even defamation, but I seriously doubt that even those claims would hold up. The language in the order might cause sites to comply out of not legally justified concern, or just a desire to be accurate, even if it is not enforceable. So, it doesn't hurt to bring that information to the attention of such sites and ask them to take down the information. But, when push comes to shove, I very much doubt that you would prevail in court enforcing that order against them. Certainly, if you do nothing, they will do nothing, because they are not psychic and have no idea that the court order related to those records has been entered. Even a valid and enforceable order directed at a party over whom a court has jurisdiction is not effective until the person ordered to comply with it has notice of the order. And, there is no system that gives sites like that notice without you taking action to inform them of an order.
No. Causing someone "pain and suffering" is not against the law; it is merely one kind of damages that can be awarded when someone has done something that is against the law. You may, for instance, endure pain and suffering from a car accident or shooting, in which case you could collect damages for your pain and suffering after proving that the other party committed the torts of negligence or battery, which are illegal. But if you were enduring pain and suffering from the last episode of Lost, you could not collect damages for your pain and suffering because it is not against the law to write a crappy finale. So in your case, cannot sue for pain and suffering based simply on the existence of a secret audio recording. North Carolina allows secret audio recordings, and it does not make exceptions for audio recordings that hurt someone's feelings. But to go beyond your explicit question, there still remains the possibility that you could pursue a legal action. If the other party used that recording in a way that violated the law, that might give rise to a tort that would support an award of damages for pain and suffering. If they publicly distributed a recording of themselves having sex with someone, that might constitute the tort of public disclosure of private facts. If they edited the recording to make it sound like someone had said something that they had not and then gave it to someone else, that might be grounds for a libel action.