Why aren&#39;t foreign VPN companies forced to keep logs? This link explains the inconsistency with what VPN services consider 'logging'. Certainly, there is no way for us to verify their claims without an extremely rigorous independent audit. But even that can be sabotaged. Regardless though, many VPN service providers vehemently claim that they do not keep logs. An example is NordVPN, which is based in Panama and so there is no domestic legislation that forces it to keep logs: NordVPN Privacy Policy: "Our top priority is customer data security. Operating under the jurisdiction of Panama allows us to guarantee our no logs policy, which means that your activities while using the privacy solutions created by NordVPN.com are not monitored, recorded, logged, stored or passed to any third party." What I do not understand is companies like NordVPN have hundreds of servers around the world, most of which are not in the country that they are originally based in. Surely, no-logging is impossible for most of their servers? Or are companies compelled to log depending on where they are based? So US legislation would not apply to a VPN server in the US which is run by a company based in Hong Kong - but this doesn't make sense - wouldn't US legislation apply to them regardless of where they are based? This link says, again, that one of the pros of VPN servers being based in Hong Kong is that companies are not compelled to keep logs (I assume this is in contrast with servers in the US and other countries): "There are no mandatory data retention laws in Hong Kong. Most Hong Kong-based providers offer a “no logs” service, and international companies are not required to keep logs relating to their Hong Kong servers (although some companies, notably US based ones, choose to do so)." Surely legislation does not discriminate based on where a company is based? Eg. all companies that operate in the UK are forced to abide by the Data Protection Act (DPA). Whether or not they are based in the UK does not matter. As long as the data that that company possesses remains in the UK, it has to be treated in compliance with UK law. Also, why would US companies with servers in Hong Kong willingly keep logs if the law is not forcing them to? Sounds like a great marketing tool if they were able to claim they intentionally choose not to log. My assumption here is that any legislation regarding mass surveillance of private citizens is followed by companies the same as legislation regarding anything else (DPA, legislation about the treatment of employees, etc.). Chinese companies with offices in the UK cannot treat their employees according to Chinese law, so why does are they allowed to treat legislation pertaining to internet traffic differently? As for who would do the forcing, the local governments. Eg. the US government, that passes mass-surveillance legislation. If the US government argues they need logs to keep track of the movements of criminals and especially terrorists, wouldn't a company saying "we do not keep logs by choice" be condemned as impeding government counter-terrorism efforts? If the law requires all VPN servers in the US to keep logs, wouldn't a company not keeping logs be in violation of the law and hence 'criminal'? If it's a legal loophole, it sounds like a dumb loophole if politicians are trying to claim they need logs to track down criminals (including terrorists), while allowing VPN providers to not keep logs.
This is tied up in the concept of sovereignty - nation states have control over their territories and citizens and they recognise the right of other nation states to do likewise. The USA, China (Hong Kong) and Panama are all sovereign states, they each decide what the law is within their own territory and they can’t tell each other what to do; they can ask, however, that’s what diplomats do. If a HK domiciled company provides HK based servers then they have to comply with HK law irrespective of where their customers are located. The USA could pass a law requiring US companies (like ISPs) to keep logs of traffic to and from HK servers but they cannot force a HK company to do anything, unless and until it operates in a place where the US has jurisdiction which means both the right and the ability to enforce their law.
Social media platforms are not publishers under UK law (at present), as such, they are not legally responsible for the content they host providing that there is a mechanism for alerting them to infringing material and that, when alerted, they remove it. As to "why", that is a political question.
The law on the web page is not current: as of the beginning of the year, RCW 23.86.030(1) reads (you'll find this under Sec. 9103) "The name of any association subject to this chapter must comply with part I, Article 3 of this act" and is otherwise unchanged. In Article 3, sec. 1301 governs names, giving the sec'y some discretion to deem a name to not be distinguishable from another, saying in (3) "A name may not be considered distinguishable on the records of the secretary of state from the name of another entity by virtue of...variation in the words, phrases, or abbreviations indicating the type of entity, such as "corporation," "corp.," "incorporated," "Inc.,". It does not list "co-op", but there is no legal requirement that the list be exhaustive. This discretion is, however, related to distinguishability. However, (4) then says An entity name may not contain language stating or implying that the entity is organized for a purpose other than those permitted by the entity's public organic record. and I think that means "no". Note that LLCs, LPs, LLPs, business corporations, nonprofit corporations and cooperative associations all have name requirements of the type "must contain" and "may not contain" (a cooperative association, oddly, has no "must contain" requirements). I would say that we have to conclude that "legislative intent" was to more closely align names and legal status, and the new "purpose-implication" language isn't brilliantly clear, but that is what the intent of the law is. This is one of those issues that could easily work its way to the Supreme Court, if someone wanted to make a state case of it.
The BBC iPlayer restrictions are not, as far as I'm aware, based on regulations; they are based on licensing agreements (in fact, the page you link to says this explicitly). Whether the same is true of programs from other services in other countries--or even other services in the UK--is going to depend on the contracts between those services and you and the contracts between those services and their content providers.
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
The website owner brings in an expert programmer who testifies that the user cannot have gotten to a certain part of the site (or download, etc.) without having clicked to accept the terms of service, and that this document they're holding is a true and correct copy of the terms of service as of that date. That's evidence in favor of the site, and an adverse party has to have stronger evidence in order to overcome it. If the person didn't save a copy of the terms themselves, they'll have a hard time on this. Then the other party's attorney tries to discredit the programmer by asking questions like "how do you know there are no bugs in the software which could have allowed somebody to reach this without agreeing to the terms of service" etc. Apparently, some sites don't require users to click indicating agreement. If the company has significantly changed the site, terms of service, etc. since the time the user registered, and doesn't keep any copies of old versions around, and admits this, they'll have a hard time enforcing an agreement (as they can't produce a copy of it). If the user kept a copy, the user might be able to present that. It's up to the finder of fact to decide what to believe and how much weight to give the various witnesses' testimony.
For land ownership records and other similar scenarios such as business directors, the requirement for these to be public will be in legislation rather than a contract - this provides the legal basis, see GDPR Article 6(1c). Additionally when government departments are doing it they also have 6(1e) as lawful basis: "1. Processing shall be lawful only if and to the extent that at least one of the following applies: ... (c) processing is necessary for compliance with a legal obligation to which the controller is subject; ... (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;" -- GDPR, Article 6(1c,e). I'm not familiar enough with the specific legislation that will apply here but pretty sure this will be the case, and having said this you may well find public registries also become less public going forward. The reason ICANN has come under fire, is partly because under GDPR privacy is a protected fundamental right and therefore to comply personal data should be kept private by default and privacy never something you would be required to pay extra for. Any contract ICANN have in place with their registrars will not override legislation, it is in fact the other way around. "2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons." -- GDPR, Article 25(2). This doesn't stop ICANN from maintaining a register of domain name owners (registrants), but it does mean they can't just publish all records upon request to anyone anymore - whether people will be granted access to personal data will now depend on if they have a lawful basis for this, and in these cases their processing of the personal data will be limited to those purposes. Being nosey doesn't count! "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of the contract." -- GDPR, Article 7 (4) - Conditions for consent. What this means essentially, is that if the consent is conditional for the contract it will not be treated as freely given, and therefore not valid - it will no longer be acceptable to contractually bind the provision of a product or service with consent to publish personal data or any other form of processing such as marketing mailing lists. Looking now at the specific points you have raised: "GDPR article 6 allows for processing of personal data on a contractual basis (section 1b)" Whilst this is true, this is only part of it - it doesn't allow for unlimited processing for any purpose and sharing it with any people, if you look at Article 5(b) it states that the information is collected for specific explicit legitimate purposes. Each purpose requires its own legal basis and needs to be compatible with the principles of GDPR. Without consent, ICANN currently does not have a legal basis to make the WHOIS records public for EU citizens and should have adopted some technical controls to require them to opt-in if they wish to be included in the public register. They're coming under fire for non-compliance having been given 2 years to prepare and change their systems/processes. "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;" Again whilst this is true, not all processing is necessary for the performance of a contract. In the same way people must give consent to receive marketing communications, they must freely give consent for their information to be shared/published (separate to the contract for provision of service) in the absence of other lawful basis for this processing. "Also section 1c, processing is necessary for compliance with a legal obligation to which the controller is subject;" There is no legislation which requires them to publish the personal data of domain name registrants. In this paragraph 'legal obligations' refers to those required by legislation (i.e. statutory obligations), not contracts (or non-statutory obligations) which are covered under Article 6(1b). "And finally section 1e, processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;" ICANN has no official government-assigned authority, and publishing the personal data globally is not in the interests of the data subject's or others' welfare or well-being - this is what is meant by 'public interest'. As far as I can see what ICANN are actually doing to comply seems to be accepted by the European Data Protection Board, they are only 'under fire' as you say because they are late in doing so. The deadline was 25th May 2018 and they had 2 years to prepare like all other organisations.
Yes, but ... It doesn’t protect you. Let’s imagine you put such a clause in and a person in Europe used your service notwithstanding: they’ve broken the contract but you’ve broken the law. You get the fine and they get ... nothing. Because you can’t contract outside the law you never had a valid contract with them so you have no basis to sue. Further, because you are purporting to something you can’t legally do, you are probably on the wrong side of misleading and deceptive consumer protection law: which is another fine. If you can ensure that you don’t breach local law - like by not operating over the internet - then you can choose not to deal with e.g. Europeans. If you can’t guarantee that, then you’re stuffed.