Do I have legal standing to force a website to remove my Personally Identifiable Information (PII)? I recently learned a high school coach of mine used a website (athletic.net) to track meets, etc, and posted there is quite a bit of PII (full name, High school, graduation year, events competed in, etc.). I would obviously like this deleted but according to their forum Q&amp;A section they can't / don't do that: "Coaches use Athletic.net for meet entry, tracking athlete results and progress, as well as compiling school history and records in the sport. For all of the above reasons, athlete profiles, and results are never deleted." Do I have any legal standing to make them either delete, anonymize, or privatize (make not publicly searchable) the information posted about me?
The data you cite as PII are simply facts that are public information; your name, photo, your school, track meets, race times, track records, and you have little recourse against the publishing and dissemination of public information, either on a site like Athletic.net that collects and scrapes public information, or against the original sources, such as news outlets and school officials. Collecting and publishing public information is clearly allowed under press freedoms and the 1st Amendment. And, concerning photos: news outlets have the clear right to photograph people in public spaces and identify them. A possible exception regarding athletic.net is the Children's Online Privacy Protection Rule ("COPPA") for children under the age of 13. But they cover that in their Privacy Policy and offer a removal policy. One other possible exception is FERPA, the federal student record law, as pointed out by user6726 in their answer; see eCFR — Code of Federal Regulations. But your parents may have signed a release to allow the information to be made public. In the event neither of those exceptions is the remedy, you would need a court order to force Athletic.net to remove information, and you would need to show very compelling evidence that such data is harmful to you in order for the court to risk violating the First Amendment. Also see Cyberstalking and RateMyProfessors.com
In the U.S., you are not required to include your real name on a copyright registration: If you write under a pseudonym and do not want to have your identity revealed in the Copyright Office’s records, give your pseudonym and identify it as such on your application. You can leave blank the space for the name of the author. If an author’s name is given, it will become part of the Office’s online public records, which are accessible by Internet. [...] In no case should you omit the name of the copyright claimant. You can use a pseudonym for the claimant name. But be aware that if a copyright is held under a fictitious name, business dealings involving the copyrighted property may raise questions about its ownership. Consult an attorney for legal advice on this matter. Therefore, a pseudonym seems like a perfectly legitimate name for a copyright notice, considering that it is also a legally valid name for an official registration with the U.S. Copyright Office. As noted above, this may complicate your ability to prove your right to litigate against copyright infringement, but it does not actually diminish your right to do so if you can successfully validate your identity as the copyright holder.
We don't have a lot of details, but if you're in the United States, the answer is probably yes. There are rarely any meaningful rules of evidence in student misconduct cases, so pretty much anything can come in. There may be some small difference in the answer depending n whether you're dealing with a public university or private, but in either case, I can't think of any reason why they would not be able to introduce the evidence if they had it. If there's a question about its authenticity, I imagine that would just be up to the misconduct board to decide. If Person X says "Person Y sent this to me," and Person X seems credible, that's probably going to be enough.
Art. 15(4) GDPR says: (4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. If I was the controller in this situation, and I believed that this would endanger the students that have criticised the professor, I would base my argument for not complying on this. In addition, Art. 85 GDPR requires member states to: [...] reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information [...] So you may be able to argue that the students posting messages are engaging in "processing for journalistic purposes and the purposes of academic, artistic or literary expression", depending on the laws of the particular member state. (edit: this could be difficult since you mention it is a private database). The second case seems just like the first in terms of GDPR, but may constitute defamation. Defamation (or libel) laws differ wildly in each country; he Wikipedia article on Defamation explains the situation in each member state in more detail. In the third case: if the professor submits a request based on the rights of a data subject other than himself, they don't need to comply. These requests need to come from the data subjects themselves, not just a random person assuming authority. (although I suppose it's possible for them to give power of attorney to the department head if they wanted to) Personal data and the rights that GDPR provides to data subjects always relate to a natural person, not an institution or a company.
Yes If you are in the EU, or your players are in the EU and your service is targeted at some part of (or all of) the EU, then this pretty clearly falls within the scope of the GDPR. Such a service would be collecting data associated with natural persons. At least some of it would be made public along with an online identifier, and other parts would be processed and stored, even if disclosed only in anonymized form. (By the way it is a non-trivial task to anonymize data well enough that it is no longer persona data under the GDPR. But let's suppose yoru methods are good enough.) Under GDPR Article 6 the DC must have a lawful basis for such processing. If the basis is &quot;consent&quot; then the consent must be freely given, whch means giving consent may not be a condition of using the service. Under GDPR Article 13 a notice must be sent to the Data Subject (DS) when the data is collected from the subject, including some 11 items or categories of information about the collection process, the Data Controller (DC), the purposes of processing, the legal basis of processing (which the DC must define), who will receive the data, the data retention period, and various rights of the DS. Such a service must be prepared to respond to data access and data erasure requests, under articles 15-17, and data restriction requests under article 18. It must provide a method for a DS to easily make such requests. Other GDPR provisions may well apply in addition to these, but that is enough to show that such service is very likely to be within the scope of the GDPR, unless none of the DSs are present in the EU or the related market area.
It follows from case law from the ECJ, e.g. C‑70/10 (28 January 2010) and C-582/14 (19 October 2016), that IP-addresses are personal data. Since my interpretation of the case law differs from the interpretation offered by @Greendrake, I'll go into the relevant case law in a bit more detail than I did in my initial answer. TL;DR: Yes, IP-addresses in server logs are personal data and you need to declare IP-address logging in your privacy policy. As I said, we need to examine the case law I mentioned in the introduction to find out whether IP-addresses are personal data. The first of those are ECJ C-70/10. In this, the court concludes that all IP-addresses are "protected personal data": It is common ground, first, that the injunction requiring installation of the contested filtering system would involve a systematic analysis of all content and the collection and identification of users’ IP addresses from which unlawful content on the network is sent. Those addresses are protected personal data because they allow those users to be precisely identified. (my emphasis) Then, in 2016, the ECJ ruled in a more narrow case ECJ C‑582/14 specifically ruling on dynamic IP-addresses: The court goes through a number of deliberations, then concludes: Having regard to all the foregoing considerations, the answer to the first question is that Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person. It is very clear from this text that the court does not challenge or invalidate ECJ C-70/10 on static IP-addresses. The court is very careful, in its ruling to point out its ruling is specifically about dynamic IP-addresses. So the ruling of ECJ C-70/10 still stands for static IP-addresses, these are always protected personal data. I believe this case law is summarized in Recital 30 of the GDPR. This recital lists the identifiers that may make natural persons identifiable: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis). Since it follows from case law that static IP-addresses always makes the data subject identifiable, and dynamic IP-addresses may make the data subject identifiable, I will conclude, based on jurisprudence alone, that: Unless you are able to filter your logs to exclude static IP-addresses. I think you must consider IP-addresses protected personal data under the GDPR. However, in ECJ C‑582/14, the ruling about dynamic IP-addresses hinges on the controller having legal means to identify the data subject by connecting the IP address to some other data. The court seems to think that getting access to ISP logs is the only means of doing that. This is wrong. In 2015, the Norwegian computer scientist Einar Otto Stangvik identified 78 Norwegians who seem to have downloaded abuse material starting only with their IP-addresses. Stangvik did this while working as a consultant for Norway's larges newspaper VG. I know Stangvik and I am familiar with the methods he used. I've tried them myself, and they work. Stangvik did not have access to ISP logs, he did not do anything illagal, and the 78 natural persons identified only by means of their IP-address, combined with other data the Stangvik had legal access to. I will not go into details, I will just say this: If you know how to do this, getting to the natural person when you know the IP-address is not difficult or labour-consuming. To return to the question: It also follows from the GDPR that logging of IP-addresses falls under its definition of "processing". Your privacy policy should list all personal data personal data that is collected by yourself and third parties ("processors" in the terminology of the GDPR) that you rely on. Your hosting company is such a third party, and you need to declare the logging of IP-addresses in your privacy policy.
(Assuming the jurisdiction is the US.) Your question I was wondering whether there are any limitations on using photos of private individuals on websites. is the least of your potential problems. Photos of the public taken in public are mostly legal to use and publish, and you own the copyright on the photo, and generally don't need a model release. But your plan of posting the photo with accompanying information about (alleged) fraud: There's a fraud conducting business in my state and I want to create a website that warns others of his fraudulent practices. is potentially legally problematic. As phoog indicates in his comment, you need to be aware of defamation, both at the federal level and among states, as some have criminalized defamation (Wikipedia). Libel is the publication of provably false facts by one person about another person. For a full outline of defamation (libel and slander, and including private and public figures), see Libel and Slander | Nolo.com. What you want to do is publish "facts" about this alleged fraud on the website with a photo of the individual, linking the fraud allegations to them. That is potentially libelous. The facts of the fraud may be provably true, or they may be provably false; that remains to be seen. But the facts don't matter when considering what actions the person can take against you if you publish such information on your website. If this business and the individual(s) feel they are not committing fraud, they can sue you for libel in civil court, alleging that you have damaged their reputation and impacted their business by publishing those facts on your website with the photo identifying the person and their business. If they take legal action, and you can prove the business and the individual(s) are committing fraud with provable facts - hard evidence of fraud, such as legal documents and court judgments - than you should (no guarantees) be able to successfully defend yourself in a libel suit brought against you by that person. Even if the business and the individual(s) are aware of facts that prove their fraud, and know they will probably not prevail in court, they can still take you to court, and it will cost you whatever time and money it takes to defend yourself. My responses above concern what legal actions the alleged could take against you if you published the website with the photo and information about the alleged fraud. No one here is advising you to put up the website with the photo and the "facts" as you see them, even if you have hard proof of the facts of the fraud; you should find legal representation before taking any action with the website. And, no one here is advising you to open any legal action against the person; that's your choice in terms of determining your case and if you can show actual harm that was caused by the alleged fraud by the individual, and you should find legal representation before taking any action.
Probably not Now, some US constitutional rights do get interpreted very broadly, and it's possible this might be the case here too. But fundamentally, this situation is not equivalent to the security contractors example you mentioned. The crux is that Facebook already has every right to delete your posts for whatever reason they want. A security contractor does not have any intrinsic right to conduct searches (warrantless or otherwise) on your person, residence or effects. Facebook can choose, at their sole discretion, to delete all your posts, delete none of your posts, or delete some of your posts according to whatever metric they came up with. In this case, the metric is 'did the government flag this as misinformation'. The government isn't censoring you - Facebook is, and Facebook is allowed to do that (they happen in this case to be following the government's advice on what specifically needs censoring, but where they choose to get their advice is also purely their business). A security contractor, by contrast, can't do much of anything to you, except when they have been specifically deputized by the government to do so by some legal process. If this happens, then they are said to be acting 'under color of law', and suddenly First (and Eighth, etc) Amendment restrictions do begin to constrain their actions. Facebook is not getting any kind of state power delegated to them, and thus they aren't considered to be acting 'under color of law'. They aren't doing anything they were not already allowed to do.