False written accusations not made public - is there law to cover this? If a person makes a false accusation against me in written, but not a published form, such as email, is there a legal process I can enact which would force the accusing party to either retract the claim or prove it? posting using a dummy account to protect myself and all concerned. Background. As the DPO in my company, I'm handling the SAR of a former employee. It is a sensitive subject, as the employee has started process against the company against their treatment during their employment. To ensure data privacy, I've been in contact with the person by email to ensure they understand their rights under GDPR and explain why some data regarding other people is being redacted from the information requested. In response, the person has insinuated that the information they received has been edited in a way which harms his defence in his case against the company. If this insinuation becomes an actual accusation, what legal recourse do I have on this? If the accusation is printed publicly, libel laws would come into force. Since it is not public, I'm not sure if I am protected by law from this outright lie.
Defamation requires communication to a third-party I can say (or write) anything I want about a person directly to that person and, unless it is a threat, they have no recourse at all. I can call them a liar, a thief, a Nazi, or a goat fornicator. Of course, I have to be careful – calling them a “bastard” might be a slur on their mother communicated to a third-party (them) which would give her a right to sue although that would require a literal and largely archaic use of the term. That said, you do need to check with your lawyer if you can redact names in the face of a subpoena - complying with a legal obligations is a legitimate use of personal data under GDPR.
Typically in defamation law, claims made persuiant to litigation are not defamatory, since they are going to be tested for validity if the case goes to trial. I'm not familiar with any differences in what is generally done in settlements between the U.K. and the U.S., but since both are Common Law countries, and Settlements are very common in civil proceedings in the U.S., it's a good start. Generally a settlemant can occur anytime before the verdict of the case is rendered, although usually it will happen after preliminary hearings during the Discovery phase. In the U.S., Discovery is very broad and one need not prove that the requested items contain evidence but might contain evidence. This means that, for example, you could request a substantial amount of e-mail records from the opposing party because somewhere on the company e-mail server, there might be something to help your case. And even if after you sift through the emails and find no smoking guns related to your case, you could find some dirty laundry that's unrelated but still damning... if not more so than the initial case. Many people, especially big compainies, would rather just give the ex-employee some what he/she wants, if it means they don't get to see the proverbial man behind the curtain. Additionally the practice might fall into a legally gray area of the law that, if it reaches trial, could hurt the company or even the industry if a judge rules against the company, effectively saying that this gray area is now definately illegal. Better to eat the loss of capital with the settling out of court than to take the much larger hit of the buisness practice being illegalized all together. Typically in settlements, both parties agree to terms and sign a contract. While the whole of the terms are never discussed, almost all include that the plaintiff will drop the case and never bring the matter to court again and that both parties will sign a non-disclosure agreement (NDA) meaning that they won't discuss the rest of the settlement terms with anyone not party to them. If the plaintiff does break the NDA, the defendant can sue for breech of contract and recover at the least the monitary compensation they awarded in the settlement. Conversely, if the respondent breaks the NDA, the plaintiff can refile their initial suit with the addition of breech of contract (and this time it will get to court... and all the dirty laundry sees the harsh light of day.). While the respondent in a settled case can possibly sue for defamation if the plaintiff said the respondent did what the initial suit claimed they did (legally, it was never proven or disproven), or they were guilty (again, since no verdict was reached at trial, no guilt was established), the breech of contract is a much more airtight case and doesn't open up discovery to the respondent's cupability in the settled case (since the breech is about discussing the settled case at all, not the validity of the accusations of the settled case). Typically they would not go this route because then it opens the can of worms the settlement was trying to keep a lid on.
Possibly, but probably not. Personal data is any information relating to an identifiable person. The statement “Alice is sick” is information, and relates to Alice who is identifiable. Processing personal data is not inherently illegal, but does require a legal basis per Art 6 GDPR, such as a legitimate interest. Here, the information is data concerning health, processing of which is prohibited unless one of the explicit exceptions applies (such as explicit consent, or legal obligations). So it is legitimate to have concerns on whether disclosure of this information would be legal. If these rules were breached, that would be on the data controller. Here, the company would be the data controller, not Bob (unless Bob acted against training and instructions and processed the personal data for his own purposes). However, GDPR probably doesn't apply to this specific interaction. In Art 2(1), the GDPR says that This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. A conversation itself would not be subject to GDPR rules – there is no filing system or similar structured data involved. What GDPR would prevent is to keep records on Alice's health status, but doesn't necessarily prevent talking about it informally. For example, the EUR 35.3M fine against H&amp;M in Germany was imposed not because managers talked with employees about personal matters, but because they then maintained detailed files about those personal matters. Data controllers are responsible though for ensuring security and compliance through appropriate technical and organizational measures (TOMs). TOMs can include things such as non-disclosure agreements and training for staff. If Bob acts against such training, there could be repercussions along the Bob–Company employment relationship. But that would mostly be an employment law thing, not so much a GDPR thing.
Corrections to your statements or quotations Your quotation "To fall within the remit of the GDPR, the processing has to be part of an "enterprise" (...)" is not from the GDPR, and is an erroneous statement. Also, the threshold of 250 employees you refer to, is only relevant with regards to the record-keeping obligations of Article 30. GDPR provisions relevant to your question The GDPR applies to individuals or students in accordance with the material scope of the GDPR, which is treated in Article 2 (2) c) where GDPR states that "This Regulation does not apply to the processing of personal data: (...) by a natural person in the course of a purely personal or household activity;" The Recital 18 of the GDPR gives some insight as to what would be a purely personal or household activity as follows: (18) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities. Interpretation To my knowledge, there are no specific guidelines regarding this matter to date from WP29. Those may be adopted in the future, or some requirements may already exist in local laws in one of the EU countries or from documentation available from local data protection authorities. If you are based in the EU, you could check this with your local data protection authority. There is, however, case law from the European Court of Justice as pointed out by Free Radical, interpreting the scope of the "personal use exception" in Directive 95/46/EC (which provisions are similar to the GDPR in this matter). If your hobby is not limited to your personal circle (yourself and the persons in your household), and thus if you plan to share the results of your data collection and processing with third parties (possibly teachers, other fellow students, or anybody else if you publish the results of your work) resulting from your "hobby" activity, you certainly would not fall in this exception to the scope. Case C-101/01 is an example of publication on the Internet made by an individual claiming to use its "freedom of expression to create internet pages in the course of a non-profit-making or leisure activity". The court clarified that: exception must (...) be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people Another, less optimistic interpretation from the examples given by the GDPR recitals, could derive from the spirit in which purely personal or household activity are to be understood. These examples actually refer to limited amounts of data and which are related to the individual itself (his own address book, his social networking activity, etc.), and creating limited risks relevant to the person herself and its contacts. In this view, there is a risk that a "hobby" in which you collect data about thousands of persons unrelated to you, could be considered as not being really purely personal. Actually, an interpretation of case law C-212/13 from the European Court of Justice also mentioned by Free Radical could support this reasoning. In this case, a video recording of people was stored from cameras installed by an individual on his family home for its own security purposes, but the cameras were also monitoring a public space. The court ruled that: To the extent that video surveillance such as that at issue in the main proceedings covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity (...) Extending this reasoning to your question, a "hobby" consisting of collecting "huge list of names, emails, zipcodes" unrelated to you could be regarded as "directed outwards from the private setting (...)". Conclusion As a hobbyist, or a student, if you can work on fake computer generated data and achieve the same results in your personal learning purposes you should definitely consider doing so.
Yes, there is legal precedent against this that would only apply to a government employee. First, let's discuss the private sector. In this case, you are a private employee that comes to your place of work and accuses you of "stealing the cookies from the cookie jar" which is a serious criminal offense. They wish to talk and your boss is in the room. You plead the 5th, but your boss says you're fired if you don't talk to the cops. This is legal because you still have the right to refuse to talk, you just lose your job. A private employer has the right to free association, and wants nothing to do with cookie thieves, alleged or actual. However, in the government employ, your boss is an agent of the government. This same situation is different because the government pays the boss and the agent... so in essence the government is saying talk or be fired. This is unconstitutional as the government cannot retalitate against you for your refusal to talk. Generally, in order to talk to you, the investigator would need either a signed Garrity Statement or a Signed Kalkines Statement. The former is a statement saying that they are investigating a wrong doing but you cannot lose your job if you refuse to speak to the investigators, where as Kalkines says you must talk but you are granted immunity for your part in the wrong doing, so long as you make truthful statements. For more on this, check this legal blog. There is also the matter that a false accusation (and let me be clear... this is academic, I'm not saying the accusation in the real life topic is false, nor am I saying that the defense is false... we're merely discussing a possibility) is made to your employer and they do not offer the job on the basis of the accusation alone, this is grounds for defamation actions... and in certain jurisdictions, it's criminal defamation, so there could be jail time. It's interesting you mentioned teachers, because this happens alot. Kids do know that there are certain things that get a teacher fired quickly, so teachers do get the occasional false accusation of sexual assault (I know one teacher who has had multiple accusations over the course of her career). One of the few good things I can say about the Teachers Union is they cover the legal defense of accused teachers. The accusations do get the teacher removed from the class for sometime, but they don't lose their jobs over this matter. It's followed up but the accusation doesn't immediately lead to the teacher getting fired..
It may be legal or it may not For example, if any of the users are in the European Union, then the GDPR applies and the person storing the information is a data controller and has legal obligations. These include, having a legitimate reason for storing them, storing them only for as long as necessary for that reason, notifying the individuals that the data is being stored and why, deleting it upon a users request etc.
While @jqning is absolutely correct in stating that truth is always an "absolute defense" to a claim of defamation, keep in mind that truth can be a subjective thing. What is one person's version of the truth, may not be another's, even with regard to the same exact experience. Also, while "statements of opinion are not defamation" is typically regarded as true, it has very broad exceptions and is not something that can be relied on in isolation. Defamation is generally defined as a false, published statement that is injurious to the plaintiff's reputation. An online posting, even on an obscure website, will likely be seen by a few people, thus satisfying the publication requirement. A plaintiff cannot succeed in his or her online defamation claim if the defendant's defamatory statement is true. So, for example, if a customer posts a review of your restaurant on Trip Advisor claiming that there were roaches crawling around, you may sue them for defamation. You would then have to prove that there was no roach infestation, and thus, the defendant's statement was false. However, what if there was only one? What if he has a witness who saw it? His truth may be different from yours, and it is up to the trier of fact to decide. Also, getting sued, whether or not you prevail, is at minimum a pain and can be a very expensive ordeal. Opinions are exempt? OK: Following that line of reasoning, restaurant owner shows he's had monthly inspections and prophylactic measures to ensure against pests and the exterminator testifies. The defendant, fearing he's in trouble now, claims that his assertion of roach infestation was just his opinion based on his experience. Opinions are privileged under the law of defamation, right? Not always! Importantly, an opinion may be viewed, generally, as a statement of fact (employing the "reasonable person" standard) if it is something that is either provable or disprovable. What this means is that if the reasonable person would construe your statement to be factual, and not mere opinion, it will be deemed as such and if untrue then you're liable for defamation. The courts may interpret, "I think that [restaurant] has a roach infestation problem," as a statement of fact. This has occurred in numerous cases where people think they can say what they want as long as they couch it as an opinion, with words like "I think..." or "In my opinion...". But when someone says something that factual in opinion form, that is not protected. So, if Jane says, "In my opinion Joe Schmoe is a pedophile..." without absolute proof that Joe is, in fact, a pedophile, then this is libelous (defamation if published or spoken to another). This is because the statement in and of itself is one of "verifiable fact couched in opinion" and it is so damaging to Joe's reputation that if it's not true it is libel per se (defamatory if published &ndash; meaning shared). A statement of verifiable fact is a statement that conveys a provably false factual assertion, such as someone has committed murder or has cheated on his spouse. While the law varies some, and sometimes substantially, from state to state, here are some often used examples arising from California courts. Libelous (when false): Charging someone with being a communist (in 1959) Calling an attorney a "crook" Describing a woman as a call girl Accusing a minister of unethical conduct Accusing a father of violating the confidence of son Not-libelous: Calling a political foe a "thief" and "liar" in chance encounter (because hyperbole in context) Calling a TV show participant a "local loser," "chicken butt" and "big skank" Calling someone a "bitch" or a "son of a bitch" Changing product code name from "Carl Sagan" to "Butt Head Astronomer" Since libel is considered in context, do not take these examples to be a hard and fast rule about particular phrases. Generally, the non-libelous examples are hyperbole or opinion, while the libelous statements are stating a defamatory fact. Modified photos that can be shown to scandalize persons or businesses are clearly defamation, and are quite popular on social media. So, for example, if you threw the flyers (I assume you didn't but as an example) all over, and then photographed and published your opinion about the business littering neighborhoods, this would be libelous. The less obvious and absurd the modification, the more likely it is that a court will find it defamatory. So, a picture of a woman with a man's naked torso photoshopped on will not be defamatory, a version photoshopped showing what is to be purported to be her naked body, is. In your case, you face two issues that you should ask yourself: Is your opinion really verifiable (or non-verifiable) facts couched in words that try to make it opinion, or is it truly just your opinion. If fact, is it absolutely true? If the answer is yes, it's fact and yes, it's absolutely true, you're OK. Keep in mind though what I mentioned about truths differing: What if the business didn't know they were put there, or, what if they were placed on cars in a public place and blew in the wind? That could be a problem. While you are most likely fine, you may want to just say, X business's fliers are all over the place, littering the neighborhood and (assuming you called and asked them to pick them up, or wrote them) they refuse to pick up the litter. It sounds like the statements you made are fine, because you don't say that the business littered, or that they put them there; you say they are "plastered" all over, but you don't accuse them openly. That isn't to say it wouldn't be found to suggest fact that they would have to show isn't true (or that they didn't get permission from the property owner). My point is only that, in general, be careful. If he felt that you misrepresented what he did by way of distributing fliers, or if he thought you doctored the photo or set it up, he could sue you if he felt it damaged his business's reputation.
From a German perspective, it would be absolutely normal and expected that you're providing identity &amp; contact information publicly. Per §5 TMG (Impressumspflicht / Anbieterkennzeichnung) this is required for German tele-media offerings, such as websites or email providers, even if non-commercial. Whereas for you as an upstanding and diligent email provider an abuse@... address should be enough, the German context expects a street address where you could be served with a lawsuit… There absolutely are privacy and free speech issues with this compelled self-doxxing. But by running an email service, you're not just acting as a private person. Your privacy interests and the transparency and security interests of other people have to be balanced. Now since you are not in Germany, the TMG does not apply to you. You have no legal obligation to provide this information. However, the ISP also has no legal obligation to to deliver your email. The ISP does have an obligation to apply appropriate organizational and technical safety measures. It seems that one organizational measure they have found appropriate is that they will only deliver emails from providers that provide public contact information, as would be the norm in Germany. I am not entirely sure how the GDPR applies here. The GDPR doesn't really allow or prohibit disclosures of personal data, it just requires that every purpose of processing for personal data has a legal bases per GDPR Art 6. One such legal basis is a legitimate interest, which boils down to a balancing test between your rights and freedoms and other people's interests. I'm also not sure if the contact information should be classified as personal data in this context, because the contact info primarily relates to your role as an email provider. I'm also not sure if the ISP is processing your personal data in the sense of the GDPR when they merely require you to publish it on your own site. They would be processing it as soon as they scrape, store, or otherwise use this info.