Why are businesses not concerned about every law in the world, mostly? Several businesses have publicly accessible websites . Thus don't they operate in every country? Then why are they only concerned about their own country's laws and sometimes GDPR and CCPA? Is it legal? Are they safe? Are their owners being and their assets in their home country safe?
That a company (C) has a website that can be accessed from a given county does not mean that the company operates in that country. If C is located in country A, markets and advertises to country A, offers products designed to appeal in country A, has its site only in the primary language of country A, uses servers located in country A, and has all its assets and physical offices in country A, it is not operating in country X, even if a few people from X do business with C over its web site. Country X may have laws which claim to apply to C or its web site. It will find it hard to enforce those laws, particularly if owners and officers of X do not travel to X. It will find it hard to extradite anyone for violations of the laws of X unless those actions are also crimes under the laws of A. If X is a major, powerful country such as the US, the UK, or the EU it may be able to get A to enforce its court orders, or to use its influence over the banking system to impose penalties on C. If X is North Korea, or even Brazil, it is probably out of luck. Thus the management of C needs worry primarily about the laws of A, and to a lesser extent the laws of major countries that make some effort to enforce their laws outside their own borders, such as the GDPR, or certain US laws. It probably has little reason to worry about the laws of other countries. If A is itself a major country that can easily resist any pressue from X, C has even less reason to worry. If C does significant business in countries D and E, and particularly if it opens physical offices in D or keeps assets in E, it will have much more reason to worry about the laws of D and E. If it does advertising in the D &amp; E markets, this also gives C more reason to be concerned with their laws. There is always some risk of X finding a way to enforce its laws, but the risk is small.
The GDPR does not outlaw such processing of personal data. It merely regulates how and for what purposes you can process personal data. In general, you can conduct any processing activity as long as it has a clear purpose and a legal basis. Here, the purpose would likely be something like “conducting business with my clients” and the legal basis would be a “legitimate interest”. A legitimate interest always requires a balancing test that weighs your interests against the interests and rights of the affected persons. For example, can the affected persons reasonably expect such processing activities? In a professional setting, it can probably expected that business partners keep notes about contact persons so your intended processing could be fine. The GDPR does impose some general constraints. There are general principles like data minimization and storage limitation – you should only collect data that is necessary for your purpose, and shouldn't store it for longer than necessary. You should think about appropriate technical and organizational measures (TOMs) to protect the processing activity, for example about how your CRM is hosted, how backups are made and how security updates are installed, who has access to the personal data, and how the people with access to the personal data can be trained. For example, such training might inform your employees that they can only use the data in the CRM for business purposes, but absolutely not for personal purposes like asking Gina from reception out for a date.
Yes When personal data is processed in the context of an EU/EEA/UK establishment (for example, by a company with offices in the UK), then all these processing activities must fully comply with the GDPR, regardless of where the data subjects are located. For the UK GDPR: This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the United Kingdom, regardless of whether the processing takes place in the United Kingdom or not. For the EU GDPR: The GDPR applies to: a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed; or …
In the United States, the main statute governing the use of health care information is HIPAA, the Health Insurance Portability and Accountability Act. HIPAA and its related statutes and regulations detail what you can and can't do with medical information. You can't always collect it; if you do, you can't always share it, and you can't always delete it. This is a complex field of law and it's easy to screw up in a way that would cause big, serious, company-destroying, job-ending problems for everyone involved. To put this another way: this is absolutely, positively, not something you want to get advice on from strangers on the internet. You don't just need a lawyer; you need a HIPAA specialist--or the equivalent in whatever other countries you plan to operate in--before you push anything out to real-life patients, especially children.
I think that one cannot answer a question such as "Will the personal use exception in the GDPR apply to personal blogs?", because it is unclear if you refer to: personal information published on the blog pages personal information collected from the Website, by way of forms, cookies, server logs, strictly collected and processed for the purpose of operating the Website for your own personal purposes as a blogger (by yourself of through a subcontractor in the sense of GDPR) and not personal information collected from the Website's operation, transferred or provided to third parties for their own purposes (this would include cookies used to identify and track users across multiple domains) Regarding 1., a personal blog wanting to benefit from the exemption should not publish third party's personal information without their consent or another legal basis, and C-101/01 certainly applies here. About 2., if the information is strictly collected and used for the own personal purpose of the operation of the blog, I would tend to agree that it should benefit from the exemption. I feel that C-212/13 would not necessarily be an indication that because the blog is publicly accessible it is then "directed outwards from the private setting" in the sense of this ruling, and should not be considered as "purely ‘personal or household’ activity". C-212/13 case was relating to a camera installed by an individual on his family home for its own security purposes which was also monitoring a public space. The persons filmed on this public space had absolutely no direct connexion with the person collecting their images. In case of a blog, the visitors of the blog interact with the blog for fulfilling the own personal purpose of the operation of the blog of the publisher of the blog. Another argument is given by the Recital 18 which you quote: a personal blog can be viewed as a type of social networking or related online activity. Finally, about 3., there is no doubt for me that, in this case, the publisher of the blog is engaged in an activity which is not personal, since it willingly provides personal information to third parties which they use for their own purposes (and not as subcontractors in the sense of GDPR). There may be other approaches apart from these 3, but that's a start for your considerations.
...due to the international registration of multiple domains to generate ad revenue by recycling stories across sock puppet networks, giving the impression of multiple, independent companies. None of that is illegal on its face. Internet domains are freely registerable by anyone, anywhere (with the exception of some laws in some nations that restrict such Internet-related activity), and registered privately or publicly, and websites can be hosted anywhere. Writing articles and "spinning" and copying articles (even if that writing is sales gibberish in broken English) among the same copyright owner is legal, and using the same design and layout for a network of sites is legal. The formation of multiple, related companies and shell companies to give the impression that companies are separate and independent is legal (again, with the exception of some business and corporate laws in some nations that restrict such activity). These are all common business practices. Some business practices may appear to be unethical - trying to fool customers in order to make money and get clicks and sell ads. And what you may be feeling is that such activity is unethical. And that's OK. But feeling that they are unethical doesn't make the practices illegal. Many common activities that are considered to be unethical are illegal; but not all. Buyer beware. One way some of that activity may be illegal is if those articles are factually incorrect and promote quack medical treatments, are financial scams requiring payments, are gambling sites or promote other clearly illegal things. But then you get into the complexity of exactly how they are illegal, which jurisdictions are involved, and on and on.
It may be legal or it may not For example, if any of the users are in the European Union, then the GDPR applies and the person storing the information is a data controller and has legal obligations. These include, having a legitimate reason for storing them, storing them only for as long as necessary for that reason, notifying the individuals that the data is being stored and why, deleting it upon a users request etc.
If an employee takes home information that his or her employer considers confidential, that would be a matter of company policy. The employer could discipline or fire the employee if it learned of the incident, and chose to act. If the information is considered to be a trade secret, or part of one, disclosing it or mishandling it so as to risk disclosure could be a crime under US law. However, only in unusual cases is criminal action taken on such matters, normally it is left to civil lawsuits or internal company action. I do not know if Canada has a similar law.