Should I use first-person (I) or second-person (you) for ToS consent? This is a bit of a nagging question for me. Let's say I'm creating a web application that allows users to sign up for some service, subject to certain terms of service. I've seen some sites use first-person pronouns for this purpose: By registering, I agree to the terms of service. Others use second-person pronouns: By registering, you agree to the terms of service. For simplicity, let's assume that the terms are readily viewable and fully enforceable. Is there any significant legal difference between the two?
There is no significant difference between the two and it is simply a matter of (modern) legal writing style. Traditionally, contracts were always written in the third person, but starting sometime in the late 20th century (if I had to hazard a guess, I'd say sometime in the 1980s), the innovation of writing in the first and/or second person was developed and found to be more readable for most people, especially in contracts of adhesion.
There is no law pertaining to top level domains, defining &quot;appropriateness&quot;. Instead, some organization is an administrator, and there is an understanding as to what the purpose of the domain is, but this is not legally enforceable. The TLDs com, org, net are open to anyone, whereas edu is limited in the US to accredited post-secondary institutions, however some non-educational commercial enterprises were grandfathered in. Insofar as registering a com-domain website does not entail &quot;an intent to make profit&quot; and registering an org-domain website does not entail &quot;an intent to not make a profit&quot;, there is no deception w.r.t. internet users. One would of course have to be truthful in registering the domain. Public Interest Registry, the administrator for org, does not even purport that businesses registered under org should be &quot;nonprofit&quot;.
Yes If you are in the EU, or your players are in the EU and your service is targeted at some part of (or all of) the EU, then this pretty clearly falls within the scope of the GDPR. Such a service would be collecting data associated with natural persons. At least some of it would be made public along with an online identifier, and other parts would be processed and stored, even if disclosed only in anonymized form. (By the way it is a non-trivial task to anonymize data well enough that it is no longer persona data under the GDPR. But let's suppose yoru methods are good enough.) Under GDPR Article 6 the DC must have a lawful basis for such processing. If the basis is &quot;consent&quot; then the consent must be freely given, whch means giving consent may not be a condition of using the service. Under GDPR Article 13 a notice must be sent to the Data Subject (DS) when the data is collected from the subject, including some 11 items or categories of information about the collection process, the Data Controller (DC), the purposes of processing, the legal basis of processing (which the DC must define), who will receive the data, the data retention period, and various rights of the DS. Such a service must be prepared to respond to data access and data erasure requests, under articles 15-17, and data restriction requests under article 18. It must provide a method for a DS to easily make such requests. Other GDPR provisions may well apply in addition to these, but that is enough to show that such service is very likely to be within the scope of the GDPR, unless none of the DSs are present in the EU or the related market area.
Can reading a something mean agree to to a contract? Just reading — no. Reading and acting as if you have agreed — yes. This is called "acceptance through conduct". I had an employer deduct a small fee to process my payment, they argued that they were allowed to because it stated they would on the website I had to use for the job. Does this even form a contract? Yes — because you read and continued to use the website. librarian came up to me and pointed out a sign saying I had to pay before using the computer (which is uncommon where I live). Is there a contract formed by just having a sign? Hypothetically could the library sue me for not paying? Provided that you read the sign and started using the computer — yes. However, because you did not see the sign, the library had failed to communicate the terms of the offer to you, which means there was no contract. However to however, if you continue using the computer even after the librarian tells you that you have to pay, you now accept the offer through conduct. In this case, the library could sue you for damages should you not pay. if there was a sign on the door to a private building saying you have to pay $20 to enter, if you didn't read the sign and entered, could the owner demand $20 from you? If the sign was so conspicuous that no reasonable person would have missed it — yes (because you should have read it and then you entered the building. But you could get away if you convinced the judge that you genuinely did not see/read the sign, for which you would have to have a plausible excuse (e.g. vision impairment).
I believe in this case, your company (OrgX) is a data processor and your customer's organization (OrgY) is the data controller. OrgY is responsible for establishing a lawful basis for sending you (OrgX) the personal data for their employees. Note that consent is just one of six lawful bases outlined in article 6(1). I'm no expert, but I believe OrgY's admin can claim they have a legitimate interest in sending their employee's personal data for training sake. In either case, the data processor is not responsible for establishing the lawful basis for processing. Of course, data processors aren't completely off the hook. GDPR outlines specific requirements for data processors (see chapter 4, particularly article 28).
There are two cases to distinguish: information that the other party does not want to give without court order, and information that the other party may not give without court order. Only the former case matters, of course, since the latter by definition requires a court order. So, if the other party is legally capable of giving the information, but it's commercially not sensible for them, then you'll need to sweeten the deal. And that's business, not a legal question anymore. In other words: there's no legal instrument that's at the same time equal to a court order but also different from one. When you need a court order, there's no alternative to a court order.
"One-party consent" law governs recording of conversations in New York state and under federal law. What that means is that a conversation can be recorded, provided one of the parties consent. You can publish any legally-acquired material, or send it to journalists.
Nicknames, usernames, or gamer tags are definitely personal data under the GDPR. You are operating under a very narrow definition of “identifying”, which is understandable since the definition of personal data in the GDPR isn't overly enlightening at first glance: […] an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; — GDPR Art 4(1) However, this definition does show that “identifiable” should be interpreted rather broadly. For example, indirectly identifying data is still identifying data – there doesn't even have to be a strong identifier like a name, passport number, or street address. It is also not necessary that identification enables you to determine the real world identity – identification is anything that allows you to single out a person, or to combine data into a profile of that person (compare Recitals 26 and 30). In any case, an online username or user ID is clearly an identifier and will fall under one of “a name, an identification number, […] an online identifier”. If in doubt, ask your data protection authority for guidance. You've correctly understood that you will need a legal basis to process this data, and that legitimate interest could be that legal basis. This doesn't have to be your own interest, so a community interest would be OK. You need to balance the user's rights against this interest. You have performed this balancing and have found that the interest outweighs these rights. You've noted that such leaderboards are a cultural norm and are generally expected, which strongly weighs in your favour. However, legitimate interest is not a free pass but just means an opt-out solution (right to object per Art 21). You should also inform users that the leaderboard is accessible publicly when they join your server (transparency principle per Art 5(1)(a) as detailed by the information obligations in Art 13). In particular, you should use a “message of the day” or welcome message functionality to link to your privacy policy. You should also be aware that other rights such as the right to access, erasure, and data portability apply. As an alternative to legitimate interest (opt-out) you could also consider consent (opt-in), though this results in slightly different data subject rights and is more difficult to do correctly. But I'd agree that legitimate interest is more appropriate here.