Applicability of Data Protection Laws When Talking to a Lawyer According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission. Can I tell such details legally to my lawyer when referring to individuals related to a case without the data owner's approval? I live in the European Union.
According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission. That is not correct. According to GDPR Article 2: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. This Regulation does not apply to the processing of personal data ... ... (c) by a natural person in the course of a purely personal or household activity; GDPR Recital 18 states in relevant part: (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. Personal data that is not processed by &quot;automated means&quot;, for example data which is transmitted verbally, by hand writing, or by manually sent email, is not covered by the GDPR. Data which is used by a natural person for &quot;personal activities&quot; is also not covered. Consulting one's personal lawyer might well be a personal activity unless it is a business matter. Even if such a transfer of data were in scope for the GDPR, consent of the data subject (DS) is not the only available lawful basis. GDPR article 6 permits any of several possible lawful bases to be used, particularly paragraph 1 point (f) which reads: (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Also possibly relevant is point (c) which reads: processing is necessary for compliance with a legal obligation to which the controller is subject; In short, providing one's personal lawyer with the names and addresses of relevant people in connection with a legal issue is not at all likely to be prohibited by the GDPR, nor to require the consent of the people whose names and contact info are provided. However, a comment by user PMF reads: The Data Protection laws are mostly for companies, not for individuals. This is an overstatement. The laws do apply to natural persons as DCs, although enforcement is largely targeted at businesses, particularly large, for-profit businesses.
That is private. Who you work for is not information that is disclosed publicly by any state actor in Germany, just like your taxes. In fact, that or who you are employed at is often regarded as personal and private information. Nigh impossible through agencies Public agencies like the Fiskus (tax), Agentur für Arbeit, and immigration are not allowed to give any information about a person to anyone but that person or another agency that has the right to that information. Yes, (generally speaking) the tax office may not even say that a person exists (or doesn't) and what their tax number is to anyone but the person in question.
The GDPR is about "processing" not "storing", so your actions definitely fall under the GDPR. Also you have stored the email address and the email you sent in your "Sent" folder. You need to reply with all the information you have associated with that email address. This will at least be the email you already sent. If you scraped the email address from GitHub then you have it in a table with (presumably) other information such as the repository where you found it, in which case send that row of the table with the associated column headers. If you really just have a list of email addresses then say so. If you merely saw the email address and then typed a fresh email then say so.
The European Convention on Human Rights has an article about privacy (article 8). Note that this is from the Council of Europe, which is not the same as the European Union: non-EU member states such as Russia, Turkey, and Azerbaijan are also part of the Council of Europe and therefore the ECHR. I'm not sure if you first have to go to a lower court, but the European Court of Human Rights is the authority on this (commonly mistaken for the European Court of Justice, but they are distinct entities). According to this ruling of the ECtHR, it is not illegal to monitor your employees' communications per se. However, the monitoring has to be: for legitimate purposes ("the employer had only accessed the account in the sincere belief that it contained only messages of a professional, not personal, nature"), proportionate ("it was the only possible way available"), and communicated to the employee (or, if the monitoring is not announced, at least the restriction on personal use should be communicated, for example through company policy). In the European Union, there is also the GDPR, but this does not change much. It applies to your employer the same as any other organisation and basically says that they have to be reasonable about it: collect only what they need, for a legitimate purpose, and tell you about it. I think you should be able to request a copy of any data they collected about you, ask a human to review an automated decision, and your other usual rights. They don't need your consent to start collecting data, as Esa Jokinen already commented: "GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data." In fact, your employer probably cannot ask you for consent: because of the employer–employee imbalance of power, the consent would probably not be considered to be freely given (where this article mentions "The GDPR states", I think they are referring to recital 43).
There is nothing extraterritorial about these laws. If a company sells a good or provides a service to individuals based in the EU, then this good or service has to comply with EU laws. This concept is self-evident for physical goods that are produced anywhere in the world and then sold in the EU and the GDPR just applies this concept to services provided over the internet. The same legal concept also holds in all other major jurisdictions. The only thing that makes this more complicated for the GDPR is the actual enforcability of these laws but that is a technical issue not a legal one.
The evidence will almost certainly be inadmissible And, of course, you will be disbarred and never work as a lawyer again, you might also go to jail for attempting to pervert the course of justice. Whether the person is convicted or not will depend on the strength of the other evidence the state has. In the notorious case of Lawyer X, Nicola Gobbo was acting as a barrister for a number of Melbourne underworld figures while simultaneously acting as a police informer. A number of those convicted have successfully appealed their convictions on the basis that they didn’t get a fair trial. In their judgement on AB (a pseudonym) v. CD (a pseudonym); EF (a pseudonym) v. CD (a pseudonym) [2018] HCA 58 the High Court said: But where, as here, the agency of police informer has been so abused as to corrupt the criminal justice system, there arises a greater public interest in disclosure to which the public interest in informer anonymity must yield. EF's actions in purporting to act as counsel for the Convicted Persons while covertly informing against them were fundamental and appalling breaches of EF's obligations as counsel to her clients and of EF's duties to the court. Likewise, Victoria Police were guilty of reprehensible conduct in knowingly encouraging EF to do as she did and were involved in sanctioning atrocious breaches of the sworn duty of every police officer to discharge all duties imposed on them faithfully and according to law without favour or affection, malice or ill-will. As a result, the prosecution of each Convicted Person was corrupted in a manner which debased fundamental premises of the criminal justice system.
Does this prove that the unlicensed attorney is practicing law outside their jurisdiction and is providing legal advice by representing the &quot;client&quot; in legal negotiations? No. Your quote of the email does not prove that the receiver engaged in unlicensed practice of law. Nor does it prove that the receiver/non-attorney is representing, or advising, the attorney's client or the adversary. It is quite possible and valid for the unlicensed lawyer (example: paralegals) to assist an attorney who actually represents the party.
It may be legal or it may not For example, if any of the users are in the European Union, then the GDPR applies and the person storing the information is a data controller and has legal obligations. These include, having a legitimate reason for storing them, storing them only for as long as necessary for that reason, notifying the individuals that the data is being stored and why, deleting it upon a users request etc.