Is it illegal to create a mobile app which tracks a user for some purpose? Can a mobile app track a user using GPS/location services running in the background, and do something when a user is found in a particular location? Assuming that the app clearly tells the user that it will do this? A colleague said that this is illegal because there is a court ruling that no one (software/app) can track a user's location in the background, but rather can only use location when the user is actively using the app. Is this correct? After googling I found one ruling that "warrantless tracking is not allowed." Is this applicable?
It is hard to prove a negative, but no - there is not rule that an app cannot track a user while the app is in the background. Almost every GPS-function app on every smart phone does the very thing you are talking about.
The Facebook Pixel analytics solution does not seem to support access or erasure for data subjects. While there are some GDPR compliance features, these focus on collecting consent prior to collecting data. The relationship between the pixel user and Facebook is also murky. For certain kinds of data, Facebook acts as the data processor only, and the user has all the responsibility as the data controller. For other kinds of data, Facebook and the Pixel user are joint controllers, and therefore jointly responsible. This lack of features doesn't necessarily mean that Facebook Pixel is in violation of the GDPR, since the GDPR Right to Erasure only applies under certain circumstances. However, it is really difficult to argue that a website or app that integrates Facebook Pixel would be compliant. It is also rather dubious that Facebook could be compliant themselves, since their pixels will also collect data about persons who are not Facebook members. While these problems are most apparent with the Facebook Pixel since it's explicitly intended for tracking, this problem also applies to any other embeds provided by Facebook, such as like buttons. This was the subject of the Fashion ID case, in which the ECJ determined (in 2019) that the site operator is a joint controller with regards to data collection on the website by the Facebook embed. This effectively means that third party embeds can only be loaded after the website visitor has given consent for sharing data with Facebook. The tracking of non-users by Facebook was seen as especially problematic in Belgium, where Facebook had been banned from collecting such data already in 2015 (which was upheld in 2018). Since this was pre-GDPR, FB is currently litigating whether Belgium can continue enforcing their ban. I expect that Belgium will prevail with their ban. While this has no immediate consequences for Pixel users, this would make it more likely that Pixel users could be sued or fined successfully. From an advertiser perspective, Facebook does have valuable data that make the integration of Facebook Pixel an attractive proposition. However, other analytics solutions are much easier to bring into compliance. This is ultimately a business decision: will the better understanding of your ad spend on Facebook outweigh the risk and effort of integrating the Pixel?
In this specific case and location, the precise location of the incident was explicitly made a public space via state law not too long before this actual event. They therefore most certainly have no right to privacy. What is interesting to me though is the other side of this, does someone have the right to record others in public spaces, or is it simply not illegal? For instance if I non-destructively and non-violently "jam" your camera by shooting a low-power IR beam at your lens, have I abridged a legal right of yours? I don't think it would be illegal to do this. I am not even positive its against the 1st Amendment. The 1st Amendment relates only to the dissemination of information, not the collection of it. The Constitution doesn't seem to compel the gov't to make information available, or even to make things/events/spaces observable. The various "sunshine" laws after-all had to be enacted, it wasn't part of an interpretation of the 1st Amendment. To put a finer point on it, is recording events in public spaces legal or merely lawful?
You tag the question with "criminal law", suggesting that by "illegal" you mean "is it a crime" -- that would depend on jurisdiction, but in the US or my state, it is not a crime. There are crimes that you could commit with such an account, but violating the TOS is not itself a crime. However, it is illegal, a breach of contract, as you can see from the TOS "You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission".
It depends on the device identifier. For example, if you distribute your application through Apple's App Store, there is no way for you to get any identifier for the device. You can get an identifier that is unique for the combination of the device + your application, so you can verify that the same user doesn't use the application on four devices. But if I have another application, we can't combine our data to see who has purchased both applications, because we get different device identifiers for the same device. So that device identifier is totally meaningless to anyone other than you. (Years ago Apple supplied real device identifiers. They stopped for privacy reasons, and because some developers were just stupid - they didn't consider that I could sell my phone to you and buy a new one. So if I sold you my phone, you reset it completely and purchased a certain game, you would get my high scores because your phone has same device identifier that I used for ages).
They aren’t treated differently In most jurisdictions, law enforcement requires a warrant to intercept/open/read the contents of physical or electronic correspondence. Similarly, in most jurisdictions, a warrant is not required to read the metadata: who is communicating with whom, how and when but not what. That is they can read what’s written on the outside of the envelope or the routing information of the email/SMS. Telephony is not correspondence because it is not the intent of the parties to create a permanent record. It is usually treated as any other conversation - if it carried out in a place and manner that the participants have a reasonable expectation of privacy it’s usually illegal to record it (electronically or by writing it down). If it’s said publicly, it isn’t illegal.
The university has a legal obligation to collect certain data from attendees, including employees an visitors. It has decided to keep these records in digital form, and offers a smartphone app as a convenience. The university has outsourced the data processing activity to a third party. This is perfectly legal under the GDPR, if that third party is contractually bound to only process the data as instructed, and not for their own purposes. Whereas the university acts as a data controller (Verantwortlicher), the third party would be a data processor (Auftragsverarbeiter). I have some doubts though whether an app or a website is indeed the solution that offers the best data protection, especially taking into account the GDPR's data minimization principle. Requiring updates when entering or leaving any room is potentially excessive. Given the sensitivity of the data, the university should have performed a data protection impact assessment to weigh the consequences of this measure. At least for employees, the measure would likely have to be approved by the union (Personalrat) as well.
I think that one cannot answer a question such as "Will the personal use exception in the GDPR apply to personal blogs?", because it is unclear if you refer to: personal information published on the blog pages personal information collected from the Website, by way of forms, cookies, server logs, strictly collected and processed for the purpose of operating the Website for your own personal purposes as a blogger (by yourself of through a subcontractor in the sense of GDPR) and not personal information collected from the Website's operation, transferred or provided to third parties for their own purposes (this would include cookies used to identify and track users across multiple domains) Regarding 1., a personal blog wanting to benefit from the exemption should not publish third party's personal information without their consent or another legal basis, and C-101/01 certainly applies here. About 2., if the information is strictly collected and used for the own personal purpose of the operation of the blog, I would tend to agree that it should benefit from the exemption. I feel that C-212/13 would not necessarily be an indication that because the blog is publicly accessible it is then "directed outwards from the private setting" in the sense of this ruling, and should not be considered as "purely ‘personal or household’ activity". C-212/13 case was relating to a camera installed by an individual on his family home for its own security purposes which was also monitoring a public space. The persons filmed on this public space had absolutely no direct connexion with the person collecting their images. In case of a blog, the visitors of the blog interact with the blog for fulfilling the own personal purpose of the operation of the blog of the publisher of the blog. Another argument is given by the Recital 18 which you quote: a personal blog can be viewed as a type of social networking or related online activity. Finally, about 3., there is no doubt for me that, in this case, the publisher of the blog is engaged in an activity which is not personal, since it willingly provides personal information to third parties which they use for their own purposes (and not as subcontractors in the sense of GDPR). There may be other approaches apart from these 3, but that's a start for your considerations.