Public record or PII In the past, I had interactions via email with various boards of my town government. I recently noticed that printouts of these emails were scanned and added to the "meeting package" - a PDF document that is available on the town's website. The printout contains my name, email address, and in some instances my address and home phone number. Google OCR'd the PDF documents and finds them when I search for my email address. (e.g. https://www.town.medfield.net/DocumentCenter/View/2309/BOS-Meeting-Packet-January-29-2019-PDF) I asked for these documents to be redacted or removed, but I did not get a response and I don't expect any action. Is there a legal basis for this request, or can the town take the position that the correspondence is public record in its entirety? And what entity could help me enforce a request for removal (other than a paid lawyer)? Comment/Explanation: The initial couple of answers don't seem to address my concern, so here is another attempt to explain. My question is primarily about the level of protection that PII should get from local governments, not about public records. I do contract work for a federal government agency. I have to undergo training annually for Title-9,13,26 protection of citizen data. It appears to me that local town governments should adhere to the same standards, but I was wondering what the legal basis is.
The general rule is that "public records" must be disclosed unless they are by definition not public records. This study summarizes US public records law on a state by state basis, if the issue is about the US. Taking Massachusetts as an example, the law defines public record here, so if the item is not a public record, it is not required to disclose the item. Clause 26 has a long list of exceptions such as (j) the names and addresses of any persons contained in, or referred to in, any applications for any licenses to carry or possess firearms issued pursuant to chapter one hundred and forty or any firearms identification cards issued pursuant to said chapter one hundred and forty and the names and addresses on sales or transfers of any firearms, rifles, shotguns, or machine guns or ammunition therefor, as defined in said chapter one hundred and forty and the names and addresses on said licenses or cards ... (o) the home address and home telephone number of an employee of the judicial branch, an unelected employee of the general court, an agency, executive office, department, board, commission, bureau, division or authority of the commonwealth, or of a political subdivision thereof or of an authority established by the general court to serve a public purpose, in the custody of a government agency which maintains records identifying persons as falling within those categories; provided that the information may be disclosed to an employee organization under chapter 150E, a nonprofit organization for retired public employees under chapter 180, or a criminal justice agency as defined in section 167 of chapter 6. (p) the name, home address and home telephone number of a family member of a commonwealth employee, contained in a record in the custody of a government agency which maintains records identifying persons as falling within the categories listed in subclause (o). If the information is not legally a public record, there is no obligation to disclose. There is a general requirement via statute, regulation and court rulings requiring the government to protect personal information, such as this. You can get a list of sources on that topic here. This does not mean that the government body in question can be forced to redact that information, but it is at least possible that there is a (slim) legal basis for requiring them to protect your privacy.
For land ownership records and other similar scenarios such as business directors, the requirement for these to be public will be in legislation rather than a contract - this provides the legal basis, see GDPR Article 6(1c). Additionally when government departments are doing it they also have 6(1e) as lawful basis: "1. Processing shall be lawful only if and to the extent that at least one of the following applies: ... (c) processing is necessary for compliance with a legal obligation to which the controller is subject; ... (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;" -- GDPR, Article 6(1c,e). I'm not familiar enough with the specific legislation that will apply here but pretty sure this will be the case, and having said this you may well find public registries also become less public going forward. The reason ICANN has come under fire, is partly because under GDPR privacy is a protected fundamental right and therefore to comply personal data should be kept private by default and privacy never something you would be required to pay extra for. Any contract ICANN have in place with their registrars will not override legislation, it is in fact the other way around. "2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons." -- GDPR, Article 25(2). This doesn't stop ICANN from maintaining a register of domain name owners (registrants), but it does mean they can't just publish all records upon request to anyone anymore - whether people will be granted access to personal data will now depend on if they have a lawful basis for this, and in these cases their processing of the personal data will be limited to those purposes. Being nosey doesn't count! "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of the contract." -- GDPR, Article 7 (4) - Conditions for consent. What this means essentially, is that if the consent is conditional for the contract it will not be treated as freely given, and therefore not valid - it will no longer be acceptable to contractually bind the provision of a product or service with consent to publish personal data or any other form of processing such as marketing mailing lists. Looking now at the specific points you have raised: "GDPR article 6 allows for processing of personal data on a contractual basis (section 1b)" Whilst this is true, this is only part of it - it doesn't allow for unlimited processing for any purpose and sharing it with any people, if you look at Article 5(b) it states that the information is collected for specific explicit legitimate purposes. Each purpose requires its own legal basis and needs to be compatible with the principles of GDPR. Without consent, ICANN currently does not have a legal basis to make the WHOIS records public for EU citizens and should have adopted some technical controls to require them to opt-in if they wish to be included in the public register. They're coming under fire for non-compliance having been given 2 years to prepare and change their systems/processes. "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;" Again whilst this is true, not all processing is necessary for the performance of a contract. In the same way people must give consent to receive marketing communications, they must freely give consent for their information to be shared/published (separate to the contract for provision of service) in the absence of other lawful basis for this processing. "Also section 1c, processing is necessary for compliance with a legal obligation to which the controller is subject;" There is no legislation which requires them to publish the personal data of domain name registrants. In this paragraph 'legal obligations' refers to those required by legislation (i.e. statutory obligations), not contracts (or non-statutory obligations) which are covered under Article 6(1b). "And finally section 1e, processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;" ICANN has no official government-assigned authority, and publishing the personal data globally is not in the interests of the data subject's or others' welfare or well-being - this is what is meant by 'public interest'. As far as I can see what ICANN are actually doing to comply seems to be accepted by the European Data Protection Board, they are only 'under fire' as you say because they are late in doing so. The deadline was 25th May 2018 and they had 2 years to prepare like all other organisations.
I'd take the city council's advice and realize that you could be charged with a crime. Their job is to know the local laws and put them into place, as well as know how those laws relate to state law. As for state law, the Revised Statutes of Missouri, RSMo Section 574.115 Making a terrorist threat says: 574.115. Making a terrorist threat, first degree — penalty. — 1. A person commits the offense of making a terrorist threat in the first degree if such person, with the purpose of frightening ten or more people or causing the evacuation, quarantine or closure of any portion of a building, inhabitable structure, place of assembly or facility of transportation, knowingly: (1) Communicates an express or implied threat to cause an incident or condition involving danger to life; or (2) Communicates a false report of an incident or condition involving danger to life; or (3) Causes a false belief or fear that an incident has occurred or that a condition exists involving danger to life. 2. The offense of making a terrorist threat in the first degree is a class D felony. 3. No offense is committed under this section by a person acting in good faith with the purpose to prevent harm. A fake gun turret on a porch in the public view that tracks people who walk by could be interpreted as making a terrorist threat because it (3) Causes a false belief or fear that an incident has occurred or that a condition exists involving danger to life. And, it's probably safe to assume your turret has the "the purpose of frightening ten or more people." The fact that the gun turret is on private property doesn't mean much; it is in view of the public and your intent is for it to be seen by the public and you want to invoke fear in the public members who walk by. And it's not going to be seen by the council as some sort of security; threats are not security. If you did put up such a turret, and the state didn't take action under 574.115, and there is no local law on the books that applies, the council can easy put one in place at their regular council meeting with a simple motion and vote. Since you already asked the council, they may already be considering such a law. And, depending on the county, the council could invoke a law addressing threats to the public that has more severe penalties that the state law, because Missouri is a home rule (Wikipedia) state.
Probably not until and unless the process server gets the correct address and actually serves you. Then the documents should explain the matter fully. If the person who was attempted to be served took note of the court involved, and told you what court it was, you could call the Clerk of the Court and inquire. Otherwise you would need to ask every possible court, which would take a great deal of time and effort. You have not been lawfully served (at least not in most US jurisdictions) until you have been served in person, or perhaps by mail, or by publication in a newspaper, or in some other way considered lawful in your jurisdiction, but serving a person at your old address is not likely to be valid service. (Valid methods differ from one jurisdiction to another, and in some situations differ by the kind of case involved.) If the person at your old address gave the server your new address, s/he will probably be along shortly. If a process server is given an address by the client (plaintiff), s/he may well go there first, and only do research later in case the first address is wrong. One need not worry about it until the papers are served, but it might be wise to read the legal ads in any nearby large newspapers for a few weeks, in case of service by publication. The papers should give the name of a court, and perhaps the name of a judge. You can call the clerk of the court and find out if the papers are legit. There may well be a docket no or case no or some other identifying umber, as well. This will help in verification. Docketed cases may be listed on a court web site. A comment asks is service by publication is still possible. It can be. According to the Michigan Court Rules Rule 2.106 (D): (D) Publication of Order; Mailing. If the court orders notice by publication, the defendant shall be notified of the action by (1) publishing a copy of the order once each week for 3 consecutive weeks, or for such further time as the court may require, in a newspaper in the county where the defendant resides, if known, and if not, in the county where the action is pending; and (2) sending a copy of the order to the defendant at his or her last known address by registered mail, return receipt requested, before the date of the last publication. If the plaintiff does not know the present or last known address of the defendant, and cannot ascertain it after diligent inquiry, mailing a copy of the order is not required. In addition, subrule (E) provides that: If the court orders notice by posting, the defendant shall be notified of the action by (1) posting a copy of the order in the courthouse and 2 or more other public places as the court may direct for 3 continuous weeks or for such further time as the court may require; and (2) sending a copy of the order to the defendant at his or her last known address by registered mail, return receipt requested, before the last week of posting. If the plaintiff does not know the present or last known address of the defendant, and cannot ascertain it after diligent inquiry, mailing a copy of the order is not required. The moving party is responsible for arranging for the mailing and proof of mailing. Thus if the plaintiff does not know and cannot determine the defendant's address, or has an incorrect address but thinks that it is correct, a service by publication (or even by posting) may be lawful, if the Judge so orders, without the defendant getting an individual copy of the documents by mail. This requires some unlikely events, but is possible.
there was absolutely nothing in the letter. You could hold it up to the sunlight and see that it was empty. There is no legal reason to do this. Somebody screwed up. Office workers are not infallible. It happens. I've seen government officials with no grudge against my client do it too now and then. Taken together with the spelling errors in your name it reflects general administrative incompetence and not some nefarious plot. The cautious thing to do would be to call them and tell them that you got a misaddressed letter with nothing inside it. A judge might frown at your conduct if you had some inkling they were trying to communicate with you and did nothing. Save the empty envelope to prove that they didn't send you a security deposit letter as they claimed if there is a dispute or litigation down the road.
If there's a reason to believe that your machine has data that would be relevant to a lawsuit, then yes, it is subject to inspection under Fed. R. Civ. P. 34: A party may serve on any other party a request ... to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party's possession, custody, or control: ... any designated documents or electronically stored information—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form. So if there's a lawsuit where there becomes a question about what you downloaded from the network, then it's quite plausible that your device could be demanded or subpoenaed. But that's not the same thing as &quot;forfeiting&quot; your device. The normal procedure in such a case would be that the agency's lawyers would notify you of the demand, and you would take your device to an ESI expert, who would make a digital image of the device's hard drive. The parties would then fight about what portions of that image they are allowed to access, but you would have your device again while that was going on.
1a - Where is US government website where person can requesting free copy of their MIB (online or by phone). And I don't mean MIB.com. I am looking for government website that would reference something like MIB, i.e. for instance Federal Trade Commission website references annualcreditreport.com There isn't one. The right to medical information is a right you have vis-a-vis individual heath care providers and insurance companies that have your medical information. The U.S. government does not have access to this information and doesn't facilitate you getting this information, except that you could sue in federal court to get it if the person required by law to provide it to you didn't give it to you. (The fact that the U.S. government does not have access to individual health information is one of the reasons that major medical research studies that capture a sample of the entire population of a country for a given time period are often done instead in foreign countries that have comprehensive medical records databases. In the U.S., the best possible alternative is often to look at the medical records of servicemen and veterans who received government provided health care, or to create very large voluntarily long term studies of populations such as doctors and nurses.) Even in the case of credit reports, the government website merely ends up directing you to a private sector website maintained by credit reporting websites and is not a government website. 1b - Where is US government website where person can requesting free copy of their other personal records (online or by phone) You can apply to the U.S. government via one of the IRS websites to get transcript of your past tax returns for a certain number of years. You can apply to the Social Security Administration to get your earnings history for Social Security purposes and I think that can be done from their website or by telephone. There is a U.S. government website called PACER at which you can get copies of all non-sealed filings in all federal court cases, and all filings in court cases to which you are or have been a party. There is U.S. government website at which you can ascertain whether or not a building, including your home, is in a flood plain. There is a U.S. government website that allows you to locate people who are currently incarcerated in federal prison. There is a U.S. government website that allows you to review census data from time periods when almost everybody is dead. I believe that old immigration records can also be accessed in this manner. There is a phone number at the Veteran's Administration where veterans can ask about their personal veteran's benefits. I'm not sure if that have a website from which they can do so yet. Last time I checked, a long time ago, they didn't. There are several websites and phone numbers that federal employees can access to get their personnel record type information. This is absolutely not a comprehensive list. It shouldn't be hard for you to research yourself the current web address for these sites which changes fairly often anyway. You can get many other kinds of information from the U.S. government that is about you via the Freedom of Information Act (a.k.a. FOIA), but generally speaking, this information isn't available via a website or by phone. Usually, you have to request it in a written letter or application unless a new website allowing you to do this that I don't know about has been created recently.
(Assuming the jurisdiction is the US.) Your question I was wondering whether there are any limitations on using photos of private individuals on websites. is the least of your potential problems. Photos of the public taken in public are mostly legal to use and publish, and you own the copyright on the photo, and generally don't need a model release. But your plan of posting the photo with accompanying information about (alleged) fraud: There's a fraud conducting business in my state and I want to create a website that warns others of his fraudulent practices. is potentially legally problematic. As phoog indicates in his comment, you need to be aware of defamation, both at the federal level and among states, as some have criminalized defamation (Wikipedia). Libel is the publication of provably false facts by one person about another person. For a full outline of defamation (libel and slander, and including private and public figures), see Libel and Slander | Nolo.com. What you want to do is publish "facts" about this alleged fraud on the website with a photo of the individual, linking the fraud allegations to them. That is potentially libelous. The facts of the fraud may be provably true, or they may be provably false; that remains to be seen. But the facts don't matter when considering what actions the person can take against you if you publish such information on your website. If this business and the individual(s) feel they are not committing fraud, they can sue you for libel in civil court, alleging that you have damaged their reputation and impacted their business by publishing those facts on your website with the photo identifying the person and their business. If they take legal action, and you can prove the business and the individual(s) are committing fraud with provable facts - hard evidence of fraud, such as legal documents and court judgments - than you should (no guarantees) be able to successfully defend yourself in a libel suit brought against you by that person. Even if the business and the individual(s) are aware of facts that prove their fraud, and know they will probably not prevail in court, they can still take you to court, and it will cost you whatever time and money it takes to defend yourself. My responses above concern what legal actions the alleged could take against you if you published the website with the photo and information about the alleged fraud. No one here is advising you to put up the website with the photo and the "facts" as you see them, even if you have hard proof of the facts of the fraud; you should find legal representation before taking any action with the website. And, no one here is advising you to open any legal action against the person; that's your choice in terms of determining your case and if you can show actual harm that was caused by the alleged fraud by the individual, and you should find legal representation before taking any action.