Can Twitter demand from GitHub information about users who downloaded leaked source code? Parts of Twitter source codes were leaked and published on GitHub. Twitter asked court to issue subpoena to compel GitHub to reveal &quot;all identifying information&quot; of the user who published it. However, Twitter also asked for &quot;all identifying information, ... , for the users who posted, uploaded, downloaded or modified the data&quot;. The court granted their request and issued the subpoena. On what legal grounds can Twitter demand information about users who just downloaded it?
The legal ground is to identify infringers of their copyright. Copyright law prohibits unauthorized copying, and Twitter alleges that there was unauthorized copying, which included downloading. They have a legal right to file legal actions against any and all infringers, and the subpoena process is a means of determining the true identity of the alleged infringers (since real identities are needed to sue them).
You can't own a database; you might, however, own (have) the copyright to a database if you created it or the creator transferred that right to you. You can also possess a copy of a database: the question is whether it is legal. "Leaked" implies that it is taken without permission, so you might be in violation of copyright law by possessing a copy. The only databases that would escape copyright protection would be those US government works, things put in the public domain, and things publically licensed to allow copying. Plus, any database whose content fails to exhibit a modicum of creativity (Feist). A database might be inherently illegal (at least in your hands), so it would depend on what the content is. The first thing that comes to mind is a database from a child-porn website, which contains numerous illegal images: see section 110 of Title 18. "Leaked" information might involve violation of 18 USC 1030 (Computer Fraud and Abuse Act), which prohibits unauthorized hacking. It does not directly prohibit being in possession of a hacked database: but you might still be prosecuted as an accessory after the fact. (That is one of those ad libitum areas of the law where there's no way to know for sure what is and is not "okay"). If they do prosecute you, you might rely on Bartnicki v. Vopper, 532 U.S. 514, where because it was a matter of "public interest", propagation of illegally obtained material was held to be protected by the First Amendment. Also there is the case of the Pentagon Papers. At the federal level, there are no controls over storing credit card information so if you get a copy of the Target or Home Depot hacked database, there's no federal law against that (if we discount "accessory after the fact"), but there are circumstances in Minnesota where retaining such information could be illegal.
If it was something important to the owner, they would file injunctions/suits against everybody that they find the code in, and make those very public. This isn't unlike what the RIAA did to individual downloaders of pirated music files, filing over 18,000 lawsuits. They could subpoena GitHub for information related to IP addresses for who downloaded the code and go after them. It is unlikely that they would get a financial award but they could have the court order them to stop using it. Eventually the RIAA found that filing these lawsuits was more trouble than it was worth and started going after the internet service providers. These reduced the number of lawsuits and forced ISP's to moderate its own users, blocking some sites and protocols that programs like Napster relied on. Basically they shifted responsibility from themselves to the ISP's.
By which law I am enforced to share my personal details (such as my full name) on forum publicly to on-line people which I even don't know (when commenting on random posts)? Contract Law. Google have made it a term of the contract that you use your full name. You can: contact Google and negotiate a change to that term, accept that term, choose not to enter the contract. so I can enforce on my privacy rights without removing my Google Plus account? As a person subject to UK law, your privacy rights involve limiting who and in what circumstances Google can divulge personal private information to. Your name is not personal private information; things like your medical history and bank balance are. Aside from that, you do not have a right to privacy. Anything you do or say that is visible or audible from a public place (like the internet) or a private place where the person in control of that place does not insist on your privacy (i.e. almost everywhere that you are not in control of) is public!
The "Contribution activity" is extracted from repositories hosted on Github. Looking at the privacy statement, Github considers itself as a hosting service for those repositories. See EU Directive 2000/31/EC Article 14 for the exact definition and conditions: Article 14 Hosting Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that: (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information. Article 2(4) GDPR defines that the GDPR does not apply (to Github) in this case This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive. Extracting data from the repositories to create a nicely formatted contribution activity list, would still be considered hosting as defined at Directive 2000/31/EC, because Github does not (manually) redact or modify commits. So if you want to hide your contribution activity, you must delete the contributions. And you should not ask Github to do that, but ask the owners of the repositories. And they might have good reasons to deny your request. If an owner of a repository denies your request without a good reason, you can ask Github to do so. But Github would then probably deny that request, because they explain in their privacy statement that modifying the history is not possible: The email address you have supplied via your Git commit settings will always be associated with your commits in the Git system. If you chose to make your email address private, you should also update your Git commit settings. We are unable to change or delete data in the Git commit history — the Git software is designed to maintain a record — but we do enable you to control what information you put in that record. edit To further clarify why Article 14 of Directive 2000/31/EC applies, see case C-236/08 (Google v. Louis Vuitton) where the European Court of Justice clarifies the meaning of that article (ECLI:EU:C:2010:159): In that regard, it follows from recital 42 in the preamble to Directive 2000/31 that the exemptions from liability established in that directive cover only cases in which the activity of the information society service provider is ‘of a mere technical, automatic and passive nature’, which implies that that service provider ‘has neither knowledge of nor control over the information which is transmitted or stored’. Accordingly, in order to establish whether the liability of a referencing service provider may be limited under Article 14 of Directive 2000/31, it is necessary to examine whether the role played by that service provider is neutral, in the sense that its conduct is merely technical, automatic and passive, pointing to a lack of knowledge or control of the data which it stores. The way Github creates/shows the contribution activity is in my opinion technical, automatic and passive. That means it is not liable, and that implies that the GDPR does not directly apply, unless data is unlawful, and someone notifies Github of that: The restriction on liability set out in Article 14(1) of Directive 2000/31 applies to cases ‘[w]here an information society service is provided that consists of the storage of information provided by a recipient of the service’ and means that the provider of such a service cannot be held liable for the data which it has stored at the request of a recipient of that service unless that service provider, after having become aware, because of information supplied by an injured party or otherwise, of the unlawful nature of those data or of activities of that recipient, fails to act expeditiously to remove or to disable access to those data. Surely the GDPR might be the reason data is unlawful. But you need a reason, in particular based on Article 17 ("right to be forgotten"). For example if personal data of a 12 year old child is processed without permission of it's parent. Without such a reason the legitimate interest of the repository owner will probably prevail (who wants to keep the git history complete).
Both. The user made an infringing copy with the upload, the developer did with the download. Further the ToS between the app owner and the user will not protect them from being sued by the owner of the copyright. They don't have any ToS with them.
I'm pretty sure that under GDPR, you can indeed request them to send all data they have on you. If it's a complex request, they may charge you something like £10. If they have a lot of data on you, they may list the categories of data they have and ask you to pick one, rather than them having to collect and send everything. They should respond within one month, but iirc in the UK implementation, they can inform you (within that month) that they will respond within three months instead. For the rest, I only know current Dutch law. GDPR is not that different from what we already had (in general terms) and in many cases it even extends it. Under our law (WBP), you can also request a correction of the data in case it is incorrect, or deletion if they no longer need it for the purpose for which it was collected and stored. I don't really know how that works out in practice though, as Facebook can of course claim that "being able to connect you to your friends when you sign up for WhatsApp or Facebook with that number" is a legitimate purpose (in their eyes). They might also not have your full name and therefore not be able to connect your data to your request. Or, perhaps, they have only your full name (and there are probably more people with your name), so they'll have a hard time verifying that it's really your data which they would be handing over or deleting. The company is required to verify your identity before acting on your request. How they implement that is up to them. Under Dutch law, if I remember correctly, any data that can be connected to your person by any party is personally identifiable information (PII). While Facebook might not be able to find who's behind a phone number, your carrier most certainly can. Therefore, the data falls under PII protection laws and they will have to implement a way to verify you and get you your data. Finally, whether your local laws apply to Facebook, I don't know exactly. There's lots of information on this though, so you should be able to find it. Generally, countries say that if something happened within their territory (e.g. you signed up for WhatsApp while in the UK), their law applies. Companies, I've read, will instead try to claim that their main office is in SomeCountry and therefore SomeCountry's laws apply. But I'm pretty sure you'll be able to find a Facebook office somewhere where GDPR applies, so that's probably fine. While not an exact answer and while I am not sure about everything, I hope this gave you some pointers to go on!
We can assume there was a meeting of the minds when the contract was drafted, and both parties expected payments to me made based on product usage. Plaintiff alleges that this did not happen. Thus plaintiff is indeed alleging that the contract was breached. Now plaintiff alleges that defendant broke the contract, while defendant counters that plaintiff broke the contract. "[T]o be determined by tracking software" is woefully ambiguous. The court will want to know which party drafted the contract, as disputes arising from ambiguity are often resolved in favor of the non-drafting party.