Can a university require me to use hardware authentication to pay bills? I am a graduate student at a university in California. The university is planning a policy change which will require me to use a "hardware token" (a little device which generates one-time passwords) to login to any university online resources, including the services which allow me to view and pay bills. I find this rather concerning, because I often find myself needing to access university resources at unpredictable times, and I cannot guarantee that I will have the hardware token available when I need it. Do I have a legal grounds for complaint? It seems to me that if it were legal to require people to use hardware tokens for accessing and paying bills, then everyone would do it (e.g. banks). But it is quite unreasonable to expect people to have hardware tokens for every service they use. To be clear, I'm not proposing to sue my university, only to complain and encourage them to provide alternatives to the hardware token.
There is little prospect for suing over this measure. The university has a legitimate interest in verifying that access to online systems is only granted to authorized users, and simple passwords are considered to be insufficient. (I don't intend to argue about password technology, I'm just making the observation that two-factor authentication is better than single-factor authentication). I have not encountered this requirements in US banks yet, but I have encountered it in Norway where an online transaction always requires with a password and a code generated by a gadget of the type you alluded to. I surmise that your university mandates that all payments be done online, which means that you must have access to a computer in order to pay a bill. It is not reasonable to expect people to have a computer that is connected to the internet at all times, but it is reasonable (and often done, by universities) to expect people to be able to so connect some of the time. So likewise, it is not reasonable to expect that people will have their authentication gadget available at all times, but it will be available some of the time, and thus there is no insurmountable impediment to paying the bill (or accessing the library, or reading email...). These gadgets do, however, potentially run afoul of ADA, but presumably they know that and can make accommodations.
In the United States, no. For something to be illegal in any meaningful way, you have to be able to point to a law that makes it illegal. If there's no law to break, it's not illegal. I would wonder if your colleague was thinking about question of whether cryptocurrencies are legal tender. For something to be "legal tender," there would need to be some kind of law or regulation requiring people to accept them as payment. There is no such requirement in the United States, so Bitcoin, for instance, is not legal tender. But that doesn't make it illegal tender; it just means that people can decide whether to accept it or not.
Every state except New York, Illinois, and Washington has adopted the Uniform Electronic Transactions Act, and those three states have adopted their own electronic signature laws. At the federal level, a law known as ESIGN provides that electronic signatures are valid, and preempts state laws unless the state has adopted UETA or has its own electronic signature law compatible with ESIGN. One requirement of UETA is that both parties have to agree to use electronic signatures. It can't be forced on a party. If you send me a contract electronically and I electronically sign it, the question is whether I meant "I agree to be bound" or something else (like "I read it, this looks fine, send over a paper copy to sign"). By putting in the agreement "I agree to use an e-signature," it's hard to argue that you didn't mean to accept the contract. If you didn't mean to use your e-signature to accept, you shouldn't have put it on a contract saying "an e-signature is accepting the contract." However, you don't necessarily need to put that in the contract for the e-signature to be valid. The question is the intent of the parties, and the court can look at all relevant evidence to decide whether both sides really meant to use e-signatures to accept the contract.
Assuming here that this is without the permission of the current account-holder. As discussed above, from a tort law angle there would be some confusion as to who owned the password in the first place. However, under US Federal Criminal Law, such action is explicitly criminalized: Title 18 USC§ 1030(a)(6)(A) [Computer Fraud and Abuse Act] provides that: (6) [Whoever] knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if— (A) such trafficking affects interstate or foreign commerce; or (B) such computer is used by or for the Government of the United States; ... shall be punished as provided in subsection (c) of this section. Subsection C then sets a punishment for such a crime at a fine and/or imprisonment for up to 1 year. Repeat offenses (this applies to any past offense under any part of the CFAA, not just password trafficking) have a maximum sentence of 10 years.
The issue is not exactly with minors, it is with FERPA and COPPA. This assumes that you have some indication of what students are connected to the web page. If you have students under 13 (surely you do), you need verifiable parental consent. The FTC approves or disapproves particular methods of verification, here is their page on that. One approved and patented method is ChildGuardOnline Technology (it;s a business, not a free service). The other concern is that you have to scrupulously protect "student records". You already know that you can't disseminate "student records" without parental consent, what this adds is possibly new concerns with online security. However, many schools are exempt from the COPPA requirements. Here are some "exceptions" to the rule, and nonprofit organizations are not subject to Section 5 of the FTC Act.
How can I truly say that I 'consent' to data collection and processing when I am coerced, so to speak, by the threat of failing my courses if I do not use this novel software? There is no need for you to "consent". Consent is just one of the reasons that allows a data processor to collect your data. There are other reasons that allows the data processor to capture your data. In this case, it seems of application the "legitimate interest clause", as it is in your university's legitimate interest to capture your activity in order to evaluate you. Of course, that covers only the data collected that is relevant to that interest. They will certainly capture your identity and your answers, they may log your sessions and may try to gather some data to detect if you are somehow cheating, but they would not be allowed to check which are your favorite pornhub videos because that is not relevant for the university's legitimate interest. Art. 6 of the GDPR states: Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This page also provides some in-depth analysis
No. This is governed by the HIPAA Security Rule which was a regulation that the HIPAA statute required the Department of Health and Human Services to adopt. The Rule does require someone covered by HIPAA to have a "Business Associate Agreement" (BAA) and a Service Level Agreement (SLA) with any cloud storage provider (which would be the usual way that a U.S. health care provider subject to HIPAA would have a foreign server), but the Rule does not require that a server be physically located in the United States. The lack of this requirement is a good one, because when you are transmitting data (which the Security Rule requires be done in a secure fashion), you can't know which servers the information will end up on in a trip from source to destination. Email and all other Internet content travels through what amounts to a pony express. It goes through a variety in intermediate server nodes which can change during the course of a session, and generally speaking, you never know which intermediate nodes are used. You could be seeing this answer via a server in China, for example, and you would never know it.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.