Regularly receiving a stranger&#39;s emails From time to time I receive emails intended for someone else with a similar email address. This has been going on now for years and in the meantime I've gotten a pretty good picture of this person. I can say for sure that this person exists and I know quite a bit what's going on in his life. Therefore I can clearly differentiate a random phishing attempt from an honest email meant to reach this specific person. In past I often contacted the senders to inform that they are using the wrong address. It wasn't that big deal for me until today, when I received an email including very personal details about him, including all his contact information and his private address. The email itself is like an automated confirmation that they have received his data correctly, sent by info@blabla.blabla so no answer is required nor meant to do so. For me there are three options: Contact the sender to inform them about the mistake. I don't really like this option in the first place because I feel like it's not my responsibility to explain to those random people behind info@blabla.blabla that they have provided me private information about one of their customers. Contact the intended receiver and inform him about the mistake and possibly say to be more careful with the use of his email address. I feel uncomfortable using information I'm not meant to know to get into contact with him. It's like opening a neighbour's letter, reading it and then passing it on to him, explaining that I had to read the letter to make sure it belongs to him. Ingnore the email. There's a risk of receiving further emails with even more personal details. Could I then get in trouble for not reporting it and therefore intentionally waiting for more information? Summary: I receive emails intended for another person, which provide some very personal data. I can tell for sure that these emails are no random phishing attempts. Do I have to report this mistake to any of the parties by law? Or would it be more like an act of kindness?
I spent 26 years in Law Enforcement (two years in Fraud, Identity Theft, and Embezzlement) and here is the answer I would often give other people in this situation: By law, recipients are not required to do anything. It can be deleted without a second thought. There is no specific law requiring someone to report this as it doesn't rise to the level of a crime. Contacting the sender or intended recipient can be risky because the other person is unknown. Return addresses online may be masked by redirects or other traps. What is displayed may not be the full picture of the site where they want someone to go. Having information about someone, although private, is not a crime unless there is a specific intent to use that information for a crime: fraud, identity theft, theft, etc. Doctors, banks, and numerous other businesses have access to personal identifying information about people. Unless they were to use it illegally, just having the information is not a crime. Phishing attempts: As far as sending the information on to the intended recipient, that would be very noble; but there is no requirement to do so. This type of transaction is likened to having a stranger call looking for someone else. There are people around the world just hoping to get people to click on their site so they can download everything on the victim's computer. I once taught a class in Internet Safety to senior citizens. The message was simple: Don't put any information on-line that you wouldn't post on your front door. Advances on computer security have made it possible to securely handle more information but still be on-guard; Phishing still happens. Most reputable companies won't send you e-mails asking for personal information, passwords, or account numbers. Hackers, thieves, and criminals have access to personal information regularly. In today's society, it's just a part of life in a digital world. How does one protect themselves? Be diligent about all transactions. For instance: Check bank accounts, credit card purchases, and credit reports regularly. A TV show, Adam Ruins Everything - Adam Ruins Security, clearly outlines a lot of these facts. (Season 1, Episode 2 - First aired October 6, 2015) To recap: 1) Do nothing. 2) Stay vigilant. 3) Be wary. Common idiom - If it looks too good to be true, it probably is.
If you were to seek legal recourse for breach of contract (their Terms and Conditions), the best outcome you could hope for would be "making whole", and since they have already offered this a court could award you what the retailer already offered, but make legal costs on both sides the plaintiff's liability (ie. you), since you could have taken the offer and avoided court. The Terms and Conditions associated with the discount code mean that you won't be able to return the gift cards for cash. It will be argued that by using the code, you agreed to those terms and conditions. The second paragraph of their reply looks like an attempt to scare you, but it has legal merit. By using the unauthorised code you could be considered to have made false representation when you entered into the contract. This could render the contract void, and if they could demonstrate it had been done deliberately to gain money it could meet the threshold for fraud (which is what the police would possibly investigate : if it can be shown that you were aware the discount code didn't apply to you it would constitute making "a false representation ... to make a gain for himself" [sub-paragraphs 1-5, paragraph 2 of the Fraud Act 2006]). You may be able to argue that the voucher websites misled you (though it sounds like you, I and the retailer already know that's not true), but since the retailer has offered to repay what you paid there are unlikely to be any damages - and, unless the voucher site took commission from your transaction, a contract between you and the voucher sites would be difficult (possibly impossible) to establish. In the circumstances, returning what you originally paid is a good offer.
That is private. Who you work for is not information that is disclosed publicly by any state actor in Germany, just like your taxes. In fact, that or who you are employed at is often regarded as personal and private information. Nigh impossible through agencies Public agencies like the Fiskus (tax), Agentur für Arbeit, and immigration are not allowed to give any information about a person to anyone but that person or another agency that has the right to that information. Yes, (generally speaking) the tax office may not even say that a person exists (or doesn't) and what their tax number is to anyone but the person in question.
We can start by looking at the text of the law. US federal law 18 USC § 2252A(a)(3)(B) says: Any person who... knowingly... advertises, promotes, presents, distributes, or solicits through the mails, or using any means or facility of interstate or foreign commerce or in or affecting interstate or foreign commerce by any means, including by computer, any material or purported material in a manner that reflects the belief, or that is intended to cause another to believe, that the material or purported material is, or contains— (i) an obscene visual depiction of a minor engaging in sexually explicit conduct; or (ii) a visual depiction of an actual minor engaging in sexually explicit conduct... shall be punished as provided in subsection (b). I'm not sure how much posting the name without the link would protect you, given that you posted it with the explicit intent that someone would go and look at it. On the other hand, your intent was not to "advertise" or "promote" it, and you didn't actually "distribute" the material.
"Fraud" requires an intent to deceive. In cases like this I would fall back on the saying, "Never attribute to malice what can be explained by incompetence." Practically speaking: the email you received from them is an amendment to their Terms of Service. I.e., your contract with the company starts with their standard Terms of Service, and is modified by any agreement you reach that explicitly supersedes the ToS. Based on your description it is your credit card company that is in violation of its duty to adjudicate chargebacks. If you refuse the charge, and present the email agreement and evidence of A's "failure," then the card company has no grounds to impose the charge on you (unless the merchant in its response to the chargeback can convincingly argue that the email agreement is invalid).
My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine. Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted. Another good clause to have in your privacy policy is to basically state if the user submits information about another natural person that they have consent from that natural person for that data and what it would be used for. The internet is the internet. People have been trolling it for years. People have also submitted false information for years. The best a business can do is simply outline what their site does, what data is collected and what it will be used for. That along with what legal basis it’s processed for and following it makes you GDPR compliant in that regard. As to withdrawing consent and the rights given by the GDPR that’s all specific to what infustructure a business has in place. As a developer I know the headaches of the GDPR. Most of it resides in the fact data is not centralized and thus can’t easily be retrieved, modified, or removed. Once you’ve tackled that aspect providing the user their rights under GDPR isn’t to far off.
How did she access your bank account? If it was a joint account then it is as much hers as yours and she can treat it as her own. If it is yours alone, how did she get in? If you gave her the PIN/password then you gave her permission to access it. If you didn’t, treat her like any other hacker - notify your bank and the police.
I assume based on your reference to .edu and your can-spam-act-of-2003 tag that you are interested in United States law. The scheme you describe is illegal under the CAN-SPAM Act. 15 USC 7704 (b) (1) (a) (ii) (b) Aggravated violations relating to commercial electronic mail (1) Address harvesting and dictionary attacks (A) In general It is unlawful for any person to initiate the transmission, to a protected computer, of a commercial electronic mail message that is unlawful under subsection (a), or to assist in the origination of such message through the provision or selection of addresses to which the message will be transmitted, if such person had actual knowledge, or knowledge fairly implied on the basis of objective circumstances, that— (i) the electronic mail address of the recipient was obtained using an automated means from an Internet website or proprietary online service operated by another person, and such website or online service included, at the time the address was obtained, a notice stating that the operator of such website or online service will not give, sell, or otherwise transfer addresses maintained by such website or online service to any other party for the purposes of initiating, or enabling others to initiate, electronic mail messages; or (ii) the electronic mail address of the recipient was obtained using an automated means that generates possible electronic mail addresses by combining names, letters, or numbers into numerous permutations. The last part (ii) specifically forbids what you propose (&quot;combining names... into various permutations). Under 15 USC 7706 you may be liable for statutory damages of up to $250 per email. In addition to being illegal, I suspect your plan will also be ineffective: this sort of spam attack would be really easy for the university to detect and block.