Date Privacy and Twitch; Do I have the right to access my chat logs? Under Data Privacy laws, the user has a right to access their data, erasure, etc. Yet under Twitch the users have no way to access their own logs, only the streamer and a team of mods. This has always struck me as odd, that I can one day, theoretically, start recieving personal information about myself, where I was, what I was watching, what I was typing, from an unknown party (mods) who has access to information that I didn't even know had been stored, accessed or perhaps that I didn't even know exist if sufficent time passed. It's something i've noticed recently, with the most recent unban system put in place. Users are requesting for unbans yet given no insight into what they said prior to being banned. Yet, years after the fact, these logs are available for mods to see. I believe the user should have access to that information and indeed the right of erasure in case of personal information accidentally being posted. Would I be mistaken? I compare it to something like Youtube comments. Where one can very easily modify, delete and view a history of their logs. Even Facebook has the choice to download a file of everything they have on record for their chat history and activity. Curious how Twitch avoids this responsibility when the act of commenting on Twitch feels no different than Youtube or Facebook commenting.
The Art 15 GDPR right to access is pretty absolute. There are only three grounds under which access to a copy of your data can be denied: Art 12(5): the request is “manifestly unfounded”, e.g. clearly just submitted for trolling Art 12(5): the request is “excessive”, e.g. if you repeat the same request very frequently Art 15(4): access to a copy would “adversely affect the rights and freedoms of others” Thus, I am confident that Twitch would respond to an access request with a copy of all your chat messages. Of course, the chat messages might be useless without context, but providing that context might infringe on the privacy rights of others (see Art 15(4)). There are two caveats to this right. The data need not be machine-readable, unless the more limited Art 20 right to data portability also applies. Twitch is under no explicit obligation to provide access in a self-service manner, e.g. through an app or web interface. It would probably in the best interest of Twitch to provide self-service means, but right now the Twitch privacy policy (permalink) asks you to exercise your rights by emailing privacy@twitch.tv. Alternatively, their privacy choices page contains an entry to “Obtain access to or a copy of certain personal data we hold about you”, which contains a barely-visible link to a web form where you can request chat data.
Your friend's relationship with the game company is one of contract. You don't say what the contract terms are, so it's impossible to say whether they were breached by your friend or the company. In any case, it is likely that the only remedy your friend could seek is damages, probably limited to whatever outstanding portion of the subscription they have not had the benefit of. It seems unlikely that it will be a large enough amount to be worth pursuing. As a private company the game provider can choose to contract with who they wish, or not as the case may be (unless they can be shown to be discriminating against protected characteristics).
I know of an app that did similar. They sold membership access and linked Youtube videos. One of the Youtuber's started to take legal action against them. I don't know what happened but the app blocked their content from being shown. Updated this comment to remove incorrect information. After looking at Youtube's recent terms and conditions; you aren't allowed to link, embed or use the API if you want to put content behind a paywall, or show it alongside advertising: Under the section: Permissions and Restrictions https://www.youtube.com/static?gl=GB&amp;template=terms So long as your app is free, and doesn't contain advertising you are probably okay.
What you are doing is commonly referred to &quot;web scrapers&quot; and they are legal in the EU. What you cannot do is extract personal data. Since the data you are aggregating is non-personal data, whether or not a chat button is available, it should be fine. EDIT As some of the commenters said - it's legal, but many websites detect scrapping. To (try to) avoid being blocked by the server, make it act human. Something like. I check once every 15 minutes with 3 minutes +/- is probably enough. That also is probably what a human would do using the website so it should strengthen your argument the website is unavailable.
Update: On 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that cookies require explicit consent regardless of personal data is being processed. (Where the exceptions don't apply). (paragraphs 68-70 of the ruling). That does probably invalidate my answer below. However, because I have based my answer on information provided by the Dutch DPA, I will not update my answer until that DPA has responded on this. Basically, your thoughts are all correct. The Dutch DPA (Autoriteit Persoonsgegevens) has written a manual how to use Google Analytics compliant with the GDPR without having to ask for consent. But unfortunately it is not available in English. Based on Art. 28 GDPR, you need a Data Processing Amendment with google. Open the settings menu from Google Analytics Go to Admin Choose Account Settings Scroll down to the data processing amendment Open it Accept it Click Save Anonymize your visitors IP Address. A full IP address is considered personal data. It is possible to remove the last octet before it is processed by google. Add { ‘anonymize_ip’: true } to the tracking code on your website Create a screenshot of the change, so you can prove later at which date you made this change. Disable Data Sharing with google. By default Google uses the data for 5 different purposes. Each of them would require consent from the visitor of your website. So you need to switch that off. Open the settings menu from Google Analytics Go to Admin Choose Account Settings Scroll down to the data sharing settings Uncheck all checkboxes (Google producs &amp; services, Benchmarking, Technical support, Account specialists and access for sales experts) Click Save Disable Data Collection for Advertising. This has to be disabled at a different location, for the same reason as the previous step. Open the settings menu from Google Analytics Choose Property settings Choose Tracking info Choose Data collection Turn off these two options (remarketing and advertising reporting) Click Save Disable the User-ID feature. This is probably turned off by default. But it is important to keep it turned off. So you need to verify this. Open the settings menu from Google Analytics Choose Property settings Choose Trackinginfo Choose User-ID Disable it Click Save Even though you don't need consent to use Google Analytics, you still need to inform your users, for example by adding a few lines to your privacy policy explaining: You are using Google Analytics cookies. You have a data processing agreement with google. You have enabled IP anonymization/masking. You have disabled data sharing. You are not using any other google services in combination with Google Analytics. The Autoriteit Persoonsgegevens still recommends to offer an opt-out for Google Analytics, but it would not be required. As the Autoriteit Persoonsgegevens is a DPA as defined in chapter 6 of the GDPR, you have to assume their advice really is GDPR complaint. In the past they also had performed other investigations to the privacy policies of google.
It could be. Accessing any web page is subject to whatever the terms of use are for the page, and if those terms state that the page may only be accessed from within the US, then accessing the page from outside the US is a violation of the TOS (hence use is infringing): see 2.4(h) of the Netflix EULA. There are EU rules that override such terms, within the EU. The usual way to circumvent technological location-restrictions (where the web page says "I'm sorry, I can't let you do that") is to use a VPN and pretend to be somewhere else. Use of a VPN is not per se illegal in most countries (there are exceptions), but using it to circumvent geo-blocking may be. Again returning to the point that the TOS may itself say "No you may not", the interesting question is what to conclude if there is no such statement, for example I did not see anything in the PBS TOS that restricts access to the US (I didn't look very deeply). Terms of service can't be secret: you can't be held to following rules that you cannot reasonably know of. If you attempt to access a page that uses un-announced geo-blocking technology and it informs you that you can't use the page because of your location, then you have effectively been put on notice that there is a rule. If you happen to be using a VPN and access an un-announced, (reasonably) undetectable geo-blocked site, that would not be a breach of the terms (because you have not been put on notice that location is a term of use).
To preface my answer, this aspect of UK law is unclear at best and I try to set out general principles where available. If you are acting in a private sphere, then the recording of conversations are unregulated, however this is only for personal use – i.e., should you desire to make notes on what was said for your reference at a later date. Should you wish to share it with a third party, then you would need consent from all participants or be able to demonstrate that it would be in the public interest. If you are acting as an employee or a company, then the situation changes. Firstly, you need to check your contract, whilst this does not constitute a crime, it may be against the terms of your employment. Secondly, a company can only make recordings without knowledge under statutory conditions, such as to establish facts, ensure regulatory compliance or demonstrate standards that are achieved or need to be achieved by training. It is a general principle that conversations recorded without consent are inadmissible in court, particularly in terms of a criminal proceedings. In civil matters, it similarly follows the concept that a claimant should come to court with clean hands. However, judges are usually more pragmatic in civil cases and if parties are aware of the existence of the recording, then it often be subject to usual rules of disclosure, though this may open the creator of the recording to subsequent litigation regarding the illegality of the recording under Data Protection Act or others.
You have no right to privacy in public What you do and say in public is … public. In general, in common law jurisdictions, anyone and everyone has the right to record you unless you have a “reasonable expectation of privacy”. Where the exact line on that is situational but if you are shouting racist slurs, you don’t have it. The person who made the recording owns the recording and none of the people in the recording have a say in what they do with it. However, under privacy laws like the GDPR, a person’s image and voice are personal data so any data processor must have a legal reason for processing it. However, such laws do not usually extend to private individuals acting in a private capacity. So images captured on a private phone are unlikely to be caught while images on a corporate CCTV system will be.