Cyberstalking and RateMyProfessors.com Imagine this hypothetical scenario: I am a faculty at a state university. I have an entry at RateMyProfessors.com (http://www.ratemyprofessors.com/) that shows up when people search Google with my name. Unfortunately I have been cyberstalked (there is a letter written by a colleague). I have asked the university not to put my name on the university website. But my RMP entry is still on the webpage. Thus I am concerned that stalker will find me from RMP website. But RMP will not remove my entry from RMP website. There are no students posting on my entry at RMP website. How would I be able to force RMP to remove my information?
You would need a court order to force them to take it down. There is virtually no chance a court will order them to take it down, because it would be almost impossible to do so without violating the First Amendment. You would have to prove that forcing a publisher to stop saying that you teach at the university would advance some compelling governmental interest, and that there isn't a better way to advance that interest. It's not clear what you mean by "cyberstalking," but if you're talking about someone sending you harassing messages, then the court would probably conclude that the better option would be to punish the harasser, rather than limit the publisher's speech. You could try paying them off or sending a threatening legal demand, but I doubt either would go far. I suspect that the best course would be a persistent campaign to escalate up their chain of command to find a sympathetic person willing to help. Even that, though, I would expect to be tough, because I'm sure you wouldn't be the first person trying this.
I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith. Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time. (Note: the term &quot;EU resident&quot; above is an approximation of the territorial scope).
united-states Is a personal text (like a diary), submitted without the consent of the author, admissible evidence? Usually, it is admissible evidence. There is no legal right to keep your diary private. Production of a diary may be compelled by subpoena and admitted into evidence subject only to general considerations regarding whether particular entries in the diary are inadmissible for some other reason (e.g. lack of relevance, they recite the contents of an otherwise privileged discussion, they contain hearsay, they recite the terms of a settlement offer, the recite inadmissible prior act evidence, etc.). If the diary revealed information that could place the diarist at risk of criminal prosecution, the 5th Amendment privilege against self-incrimination could arguably be claimed even in a civil case, but at the risk of an adverse inference to be drawn from that decision in civil matters. I haven't ever seen how that issue is resolved legally.
From what I can see on the USPTO registry, &quot;tweet&quot; is still not trademarked for the purposes you're talking about. Twitter has been working to secure that trademark, but I can't find any record of them having actually secured it. Just the same, I'd predict that using it will get you at least a cease-and-desist letter, and possibly a lawsuit. Whether you'd win that case seems to be a very open question, but that presumes you have the resources to litigate.
Your question (when read with your follow-up comments) is somewhat complex, so I am going to make a few assumptions and break it down into several sub parts. Assumptions The conviction occurred in a state where the expungement statute allows you to tell employers that you were never arrested and convicted. When you say “public records websites” you’re asking about sites like atlaspublicrecords.com. That atlaspublicrecords.com is a US based company. They don’t list an address and the website used a private registration services, so can’t easily determine that they are US-based. Your questions and follow-up Considerations After I get it expunged, will it be removed from public records websites . . . . No. Websites like atlaspublicrecords.com do not link to actual public records. I searched a couple of common names and feel safe in assuming that it only collects and publishes the information—it does not actually link to court records. Nevertheless, it would not be available from the actual government agencies that keep those records. By getting your records expunged the convictions and arrest would no longer be available as public records that someone could request from the courthouse, police department, or whatever state agency does criminal history in your jurisdiction. do I have to show them proof of the expungement . . . . Yes, if you believe what the website claims. I can’t find a physical address for the website and don’t know if they are real or a scam, so understand that when you give them information about your expungement—or pay their silly fee, they might collect the money and do nothing. My opinion is that the company is shady and seems to operate in a gray area of the law that I will explain below. Options if they don’t remove the post: You could try to sue them for some type of secondary dignitary tort like defamation or false light. But these would have some significant legal hurdles. See G.D. v. Kenny, 15 A.3d 300 (N.J. 2011), where the New Jersey Supreme Court held that commenting on an expunged criminal records was not defamation or invasion of privacy because it was the truth. You could try to argue that they are a consumer reporting agency under the Fair Credit Reporting Act (“FCRA”). If they're governed by the FCRA, you have some additional legal remedies (like civil penalties/fines) if they don't remove/clarify an expunged record. The Fair Credit Reporting Act applies to credit reporting agencies, like Experian &amp; Equifax but also covers companies that compile and sell information for background checks. This includes criminal records. See the Federal Trade Commission’s Advisory Opinion to LeBlanc (06-09-98). But . . . this website is operating in a gray area that appears to comply with the law. The FCRA only applies to consumer reporting agencies, which are defined as: Any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports. 15 U.S.C. § 1681a(f) Because they’re not charging money or a fee to access the reports and they’re not a nonprofit cooperative, they probably do not meet the definition of a CRA. Bottom-line is that you're best option is to give them the expungement documents once you obtain them.
It follows from case law from the ECJ, e.g. C‑70/10 (28 January 2010) and C-582/14 (19 October 2016), that IP-addresses are personal data. Since my interpretation of the case law differs from the interpretation offered by @Greendrake, I'll go into the relevant case law in a bit more detail than I did in my initial answer. TL;DR: Yes, IP-addresses in server logs are personal data and you need to declare IP-address logging in your privacy policy. As I said, we need to examine the case law I mentioned in the introduction to find out whether IP-addresses are personal data. The first of those are ECJ C-70/10. In this, the court concludes that all IP-addresses are "protected personal data": It is common ground, first, that the injunction requiring installation of the contested filtering system would involve a systematic analysis of all content and the collection and identification of users’ IP addresses from which unlawful content on the network is sent. Those addresses are protected personal data because they allow those users to be precisely identified. (my emphasis) Then, in 2016, the ECJ ruled in a more narrow case ECJ C‑582/14 specifically ruling on dynamic IP-addresses: The court goes through a number of deliberations, then concludes: Having regard to all the foregoing considerations, the answer to the first question is that Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person. It is very clear from this text that the court does not challenge or invalidate ECJ C-70/10 on static IP-addresses. The court is very careful, in its ruling to point out its ruling is specifically about dynamic IP-addresses. So the ruling of ECJ C-70/10 still stands for static IP-addresses, these are always protected personal data. I believe this case law is summarized in Recital 30 of the GDPR. This recital lists the identifiers that may make natural persons identifiable: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis). Since it follows from case law that static IP-addresses always makes the data subject identifiable, and dynamic IP-addresses may make the data subject identifiable, I will conclude, based on jurisprudence alone, that: Unless you are able to filter your logs to exclude static IP-addresses. I think you must consider IP-addresses protected personal data under the GDPR. However, in ECJ C‑582/14, the ruling about dynamic IP-addresses hinges on the controller having legal means to identify the data subject by connecting the IP address to some other data. The court seems to think that getting access to ISP logs is the only means of doing that. This is wrong. In 2015, the Norwegian computer scientist Einar Otto Stangvik identified 78 Norwegians who seem to have downloaded abuse material starting only with their IP-addresses. Stangvik did this while working as a consultant for Norway's larges newspaper VG. I know Stangvik and I am familiar with the methods he used. I've tried them myself, and they work. Stangvik did not have access to ISP logs, he did not do anything illagal, and the 78 natural persons identified only by means of their IP-address, combined with other data the Stangvik had legal access to. I will not go into details, I will just say this: If you know how to do this, getting to the natural person when you know the IP-address is not difficult or labour-consuming. To return to the question: It also follows from the GDPR that logging of IP-addresses falls under its definition of "processing". Your privacy policy should list all personal data personal data that is collected by yourself and third parties ("processors" in the terminology of the GDPR) that you rely on. Your hosting company is such a third party, and you need to declare the logging of IP-addresses in your privacy policy.
The purpose of the button is not to put liability on you, but to shield the website from liability. The website does not want you looking up information about drugs, deciding that a particular drug is right for you, causing yourself harm and then blaming the website. You may have acted unlawfully but you would have no liability because no injury (financial or otherwise) has been caused to the website. Clicking the button is an assertion that one is a medical professional. This is a false statement, so the website could sue you for the tort of deceit, but there is no injury, which is one of the elements of deceit. The website would not even get nominal damages. The button may also constitute a contract. In exchange for access to a website, you warrant that you are a medical professional. You are not, which is a breach of the contract. However, the damages are nil. Conceivably, if you passed the information on to someone else who misused it, there may be some injury to the website, and then you would have to compensate the website for that injury under one or both of the heads of liability described above. In terms of criminal liability, it is rarely an offence to make a false statement to a private body without some other aggravating element. For example, in Australia, it is an offence to make a false statement for financial gain, or to make a false statement to a government official (regardless of whether there is financial gain etc). But simply making a false statement is not by itself a crime. You may breach a computer law. The United States Computer Fraud and Abuse Act is pretty broad. Obtaining information from a computer without authority is an offence: 18 USC s 1030(a)(2)(C). The only exception is if the web server is in the same state as you and somehow nobody from outside the state can access it: see definition of 'protected computer' in 18 USC s 1030(e)(2).
There are multiple issues with what you are trying to do, including issues with copyright, personality rights, and data protection. You are trying to use other people's content and likeness for your advertisement. Unless you are certain that you can do this in your relevant jurisdictions, without their consent, this sounds like a very bad idea. At least under GDPR, “but they made it public” is not an excuse. Personal data is personal data regardless of how you acquire it. The GDPR also has a very broad concept of identifiability that goes beyond direct identifiers or PII. If you want to use other people's personal data, you need a legal basis, and must provide them notice about your processing. Consent (informed opt-in) is one legal basis, legitimate interest (opt-out) another. You are suggesting to avoid this by blurring PII, but you may also have to blur other content that is indirectly identifiable. Real anonymization that meets the GDPR's definition is a really hard problem. In some cases, a legitimate interest is able to avoid such problems. E.g. if I make a video with commentary about a Tweet, it would likely be OK to show surrounding personal data like the responses including the identities of the various accounts, to the degree that this is relevant to the commentary and/or necessary for proper attribution. However, that commentary likely has strong protections under freedom of expression. At least from an European viewpoint, a tutorial, demo, or advertisement would not have a freedom of expression argument that would shift a GDPR legitimate interest balancing test in your favour. Instead of blurring almost everything in your video or working on GDPR compliance, content licenses, and release forms, you should consider a different solution: create dummy content just for your videos. You can use your own content, and maybe add a dummy profile.