Can online business in one country deny access via terms of service to entities in another country? Can an American company state in their terms of service that if an entity is from a designated country they are not allowed to use the service? In other words would that be a legal and enforceable provision in the United States?
Yes, and this is very common - Cuba, North Korea and Iran are often excluded. Mind you, this is from a US perspective. The banned country may have other ideas about the legality of the ban under its laws. But if you weren't planning to do business with that country anyway, that's not exactly going to hurt you.
I'm not sure about USA law, it's probably similar to UK law. In the UK a trademark is registered for a particular business activity, and you can't just blanket register for "all" activities as that would be anti-competitive. I have a trademark "Dreamcraft" for dream interpretation and related activities. However, the name "Dreamcraft" is also a registered trademark for a company selling luxury yachts, and again for a company selling up-market craft materials. A website or organisation that is a gripe-site using the same name would not be in breach of any of these trademarks because it wouldn't be in direct competition with any of these companies.
No, it is not legal. Regardless of their location, the only legal options for companies serving to EU residents are to either deny access altogether or to make consent truly optional1 Recital 42 states (emphasis mine): Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement[...] Recital 43 states: Consent is presumed not to be freely given [...] or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. 1 Of course, remember that consent is only one of several means that allow them to process data. For example, if you were getting a trial account for a limited time, it would be considered a legitimate business need to ensure that you are not just opening new trial accounts when the old ones expire. So, if they wanted some data from you to ensure that you are not a previous user and you refused to provide it, then they could deny giving you that trial account without breaking the GDPR.
This is permitted so long as it doesn't violate a valid trademark or service mark (or a few equivalent rights in names that are comparable such as collective rights to market beef under the name &quot;Waygu&quot; only if it is produced in a certain area of Japan under Japanese law) that covers goods or services of the same type in the same economic market. A trademark arises either when a term acquires a &quot;secondary meaning&quot; associating its use in connection with a particular kind of good or services in a particular market with a particular provider of that good or that service, or by registration of the trademark or service mark. &quot;Tresh&quot; and &quot;Cassiopeia&quot; are not terms that inherently are related to software, so they are permissible to use as trademarks for software unless someone else already has established trademark protection for them.
Yes If you are in the EU, or your players are in the EU and your service is targeted at some part of (or all of) the EU, then this pretty clearly falls within the scope of the GDPR. Such a service would be collecting data associated with natural persons. At least some of it would be made public along with an online identifier, and other parts would be processed and stored, even if disclosed only in anonymized form. (By the way it is a non-trivial task to anonymize data well enough that it is no longer persona data under the GDPR. But let's suppose yoru methods are good enough.) Under GDPR Article 6 the DC must have a lawful basis for such processing. If the basis is &quot;consent&quot; then the consent must be freely given, whch means giving consent may not be a condition of using the service. Under GDPR Article 13 a notice must be sent to the Data Subject (DS) when the data is collected from the subject, including some 11 items or categories of information about the collection process, the Data Controller (DC), the purposes of processing, the legal basis of processing (which the DC must define), who will receive the data, the data retention period, and various rights of the DS. Such a service must be prepared to respond to data access and data erasure requests, under articles 15-17, and data restriction requests under article 18. It must provide a method for a DS to easily make such requests. Other GDPR provisions may well apply in addition to these, but that is enough to show that such service is very likely to be within the scope of the GDPR, unless none of the DSs are present in the EU or the related market area.
Yes. Contracts do not excuse a site from obeying the law, and the law requires sites to obey court orders. "It violates my contract with a third party" is not a valid reason to disobey a court, and disobeying a court order is contempt. On the other hand, contract law (at least in the U.S. and U.K.) says that contracts that violate the law or public policy are invalid, and so you could not win a breach of contract suit if the defendant could not legally comply with the contract. Now, a contract might require the company to attempt all possible legal ways to get the court to revoke its order, or to avoid the order in the first place (for instance, if Google does no business in China, a U.S. court might not excuse them from a contract because they capitulated to the Chinese government). However, when push comes to shove, private contracts are lower priority than court orders.
Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR? Only if they offer goods/services to or monitor behavior of people in the EU (Art. 3(2)). Note that: having a commerce-oriented website that is accessible to EU residents does not by itself constitute offering goods or services in the EU. Rather, a business must show intent to draw EU customers, for example, by using a local language or currency. If it is then how (and by whom) would compliance be audited and/or enforced? Supervisory Authorities will care of it.
You can try, however, a US court when considering if it has jurisdiction will doubtless ask you to explain why a Canadian business wants to sue a Canadian company for an unpaid debt in Canadian dollars for services provided in Canada in a US court. If you can satisfy them that a US court is the appropriate venue (which I doubt) they will hear the case.