Is it considered a breach of confidentiality if data is uploaded to a website which only makes that data available to the uploader? I'm a developer working at a company that handles sensitive banking information and recently, I've had troubles organising my code and thus posted it in a private repository on Github, which only I can access in any way. A week later, I got a notice from management to delete everything and a general aura of &quot;you messed up&quot; is hanging around me. The only information I'm getting at the moment is &quot;check your contract&quot; which says the following: § 8 Confidentiality The Employee agrees to keep confidentially any business and trade secrets as well as operational matters of a confidential nature which are designated as such by the management in writing or orally or which are apparently recognisable as such, not to make them available to any third parties without the prior approval of the management, and to protect them against unauthorized access. This obligation shall continue even beyond the termination of the employment. To the best of my knowledge, I have respected said clause since I have not made it available to anyone but me. I'm just an intern freshly out of school so I might not fully grasp the details of this. Would uploading the code to GitHub count as making it available to a third party? EDIT : With hindsight, I was totally in the wrong. The code itself was Python/SQL scripts for data analysis and collection but no credentials were stored. While it wasn't a security breach since even with those no data could be accessed, it was not acceptable to store &quot;company owned&quot; code on a 3rd party. We are using Git internally now, so all is well.
Assuming none of these terms are defined elsewhere in the contract: A third party is a party (a person or company) that is neither you nor the other party to the contract (here, presumably the company that hired you). Since GitHub is neither you nor the company, it would therefore be a third party, and thus it would in fact violate that contract as written to upload the company's code there. Keep in mind that GitHub is not an autonomous system with no humans involved; it's run by a company of people, many of whom could theoretically access the code in private repositories. That said, from a practical standpoint, most companies aren't going to fire someone for a mistake made in good faith, especially if actual disclosure to any humans is rather unlikely. However, do remember that we don't know the company's rules, what training you may have received, what exactly you uploaded, or what regulatory/contractual rules they must comply with. Any of that could affect their decision-making, so you should take this as a general answer and use your own judgement when applying it to your situation.
I don't believe GDPR makes a distinction between 'real life' and 'online'. It's all real life. You can tell anyone that they don't have consent to keep your personal data, but that doesn't mean they always have to delete it. There are six lawful bases for processing of personal data, so if an organisation is using and can justify one other than consent then they don't necessarily have to delete your data when they ask. The six bases are listed by the UK Information Commissioner's Office: (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/#ib3
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
Not legal advice - you should consult an attorney who knows your local jurisdiction. That's a general statement, but especially true here because the GDPR does not include personal liability for directors (or others) in the event of a data breach, but domestic laws may indeed do just that. The UK is one example where certain circumstances can lead to criminal liability for directors of a firm in the event of a breach. That said, your company should care. The fines for knowingly allowing a breach or not reporting it properly in a timely manner have been made more significant than the prior Directive. There are things you could do to potentially mitigate consequences in the event of a breach and a fine being levied on the company, such as aligning with best practices and getting certifications. In sum, the actual punishments for noncompliance will vary by jurisdiction, but any business that handles data in the EU should undoubtedly be ensuring it is aware of what, if any, obligations it has and taking steps to comply before May's deadline.
If you merely provide software for your client to use, you are not processing personal data on behalf of the client. But if you have access to systems that store personal data, then you must consider the GDPR. Or more accurately: your client must consider the GDPR. Under what legal basis can they give you access to the data in these systems? The easiest way to solve this is indeed if you act as the client's processor. Processor status is never the default, but requires a binding contract with the data controller. This contract will require you to only process personal data as explicitly instructed by the client, and may require you to take certain security measures as a precaution. Without such a contract you aren't a data processor, but possibly a data controller of your own (with all the compliance obligations that implies).
Short Answer No. Not everything that is efiled is publicly accessible. Long Answer Most documents are public, but there are default levels of security for different kinds of documents. The e-filing system can support several levels of security. Some kinds of documents can be (and routinely are as a matter of course) sealed by court order following a motion to do so. Also, every time someone efiles a document, the filing party has to certify all required redactions of documents that are efiled have been made before they are filed at the relevant levels of privacy/security. Nonetheless, the amount of information which is publicly disclosed in a bankruptcy is very substantial and far exceeds what would have to be disclosed publicly in a non-bankruptcy context, and exceeds what would have to be disclosed publicly in other kinds of litigation. The exact contours of what is and is not disclosed publicly is quite technical and detailed, and isn't all spelled out in one place. Some of it is in general national efiling rules, some is in local court rules, some is in non-rule efiling procedures, some is in standing court orders of a judge or a particular court, and some is in case specific orders, or is implicit in how the efiling system interface works. Generally speaking, the petition, summaries of finances, motions and responses and replies to them are public, as are court orders, but exhibits to motions and responses and replies are often not public. Impact Of A Recent Breach As a matter of practical reality, all sealed and protected documents on PACER were recently (within the last few months) the subject of a malicious hacking attack that compromised the privacy protections of all of electronically filed documents in the entire federal e-filing system. As security breaches go, it was one of the most epic breaches in the history of the Internet and has been attributed to Russian hackers. The federal courts, including the bankruptcy courts, are currently engaged in temporary work arounds that don't used the efiling system for documents with privacy protections as fixes are prepared and the cause of the breach is evaluated.
You are framing it wrong. It is not that "they have put a barrier" to public domain information, it is that they have added an additional source of that information. The new source has a barrier, yes, but that does not prevent you from accessing the same information elsewhere. If you own a copy of some public domain data, you are not allowed to prevent other users from accessing other copies (by claiming copyright infringement or the like); you cannot even prevent people from doing copies from the copies you did provide them. But you are not forced to allow other users to access your copy. Consider the logical conclusion if that were the law. The moment that you downloaded some public domain file into your computer, you would be forced to give access to your hard disk from the internet, isn't it? Would you need to leave your home door open if you happened to have a printed copy of the text there? Of course, there is a need to discriminate between "public domain" (without licence) and "not public domain but open licence" (BSD, CC, GPL, etc.). In the later case the licence could be tailored so that the work could appear in archive.org but that it would be illegal to provide it with the business model of Academia.edu1. But that would be possible only for works not in the public domain. 1 To be decided by a judge on the basis of the wording of the licence and jurisdiction.
You are right that this is probably a private space; you are wrong in thinking it is your private space; it isn't. The space belongs to your employer and they can do whatever they want with their space unless there is a law that says they can't. As to what type of "hidden surveillance" is allowed that depends on your particular circumstances including what state and federal laws apply and the employment contract you are covered by. As a starting point, if this was happening in Australia then: If you gave permission, all would be legal If you did not give permission: it would be illegal to record anything taking place across a public telecommunications system (i.e. phone tapping) it would be legal for anyone to make an audio recording (not phone tapping) of any conversation to which they were a party it would be legal to make a video recording without sound.