Is a company liable if someone leaves their bank logged in on a company PC? If a company sets up computers in a break area for employees to access their timecard, payroll, bank accounts, etc., can the company get in trouble if an employee leaves their private accounts logged in?
The party providing the computer, ISp connecting the computer to the internet, or manufacturer of the computer would not be liable. A person wishing to sue for damages would have to establish that the defendant was negligent in their action. The underlying premise is that all parties have some obligation to all other parties to care, to some extent. The inquiry ask haw a reasonable prudent person would behave in this context when pursuing their goals to avoid harming others. A reasonably prudent person would not provide a rack of sharp carving knives on the floor of a daycare center. A reasonably prudent person would provide a rack of sharp carving knives on a work-table at a fish-cleaning business. In both cases, it is possible that a person might cut themselves. In the daycare center, the toddlers on the floor are not assumed to share any of the burden of care, in the fish-store, the employees are assumed to share some of the burden of care. The ISP knows that it is possible that a person will harm themselves when they surf the web, but that does not make them liable for damages when an irresponsible party deliberately and knowingly connects to a nest of viruses, likewise the computer maker. The alternative is that providing an internet connection always makes you liable, or building a computer: that would be the end of SE. Two parties can significantly and reasonably mitigate the risk: the bank, and the customer. The customer can either decline to use this unsafe computer, or they can take precautions, in particular remembering to log out. The bank can also do certain things without harming their interest: providing ample warnings (which they do), or automatically logging a customer out after a period of inactivity (a metric of the fact that the customer just up and left). Banks do that too. The only control that could be reasonably be expected from the company, short of simply not providing a computer in the break room, would be filtering to prevent any access to certain kinds of web sites, such as porn sites, banks, or SE. Filtering for the first type of site is overall consistent with reasonable company objectives (which is to accommodate reasonable employee interests in accessing or transmitting information during the work day). Given the reasonable goals of the company, the jury would not likely find that the company had breached their duty to the employee. The jury balances these interests of the parties, and would determine that the company could not be expected to filter out connection requests to banks, and that they can reasonably rely on prudent actions by the employee and bank to prevent whatever happened.
I believe in this case, your company (OrgX) is a data processor and your customer's organization (OrgY) is the data controller. OrgY is responsible for establishing a lawful basis for sending you (OrgX) the personal data for their employees. Note that consent is just one of six lawful bases outlined in article 6(1). I'm no expert, but I believe OrgY's admin can claim they have a legitimate interest in sending their employee's personal data for training sake. In either case, the data processor is not responsible for establishing the lawful basis for processing. Of course, data processors aren't completely off the hook. GDPR outlines specific requirements for data processors (see chapter 4, particularly article 28).
Could the victim report this as fraud, theft or some other related crime? They could, but it's unclear whether they would be successful. A criminal conviction would require intent on the part of the company or an employee, and that will probably be difficult to prove. In a big system like this, individuals can usually claim misunderstandings and errors of omission, which makes such a proof difficult. They could try to establish criminal corporate liability, but again this is difficult to prove. So while possible, it's probably not worth it. Would the answer to the previous question differ based on whether the victim was eventually able to recover the money through litigation or by disputing the charge with their bank? Probably not. For a criminal conviction, it's necessary to prove that the company or an employee deliberately took money they knew was not theirs. Whether they later gave it back is not relevant for determining guilt (though it may reduce the sentence). Would the company itself or the specific employees involved be liable? In principle, both could be held liable. Again, this depends on what can be proved in court. Would a binding arbitration clause in the contract have any effect on criminal liability No, arbitration clauses cannot protect from criminal liability, only from civil liability (within limits). Off-topic: The fastest way to resolve such situations is usually to write one stern letter explaining why you are owed the money. If that does not work, sue them - if the situation is clear-cut, you will most likely win, or the company will settle. Many jurisdictions have simplified court proceedings for clear cases like this, for example the Mahnverfahren in Germany.
In New Zealand, employers have a duty to take all practicable steps to ensure their workplace is safe for employees and for others who come onto the premises (Health and Safety in Employment Act s6). So if there was a wasp nest and they didn't do anything about it, presumably they would be liable. If it was a random bee, I doubt they would be liable, because they couldn't practicably prevent a bee flying in if, say, someone opened the door. The state would have to charge the company as HSEA is a criminal provisions act. If the plaintiff brought a claim based on the tort of negligence, they would have to prove that the company had a duty of care, breached that duty, the breach caused damage, and the damage was not too remote from the breach. The company does have a duty of care to their patrons. The standard for this is what a reasonable person would have done in the circumstances. If they didn't remove a wasp nest they may have breached their duty of care. The breach will have caused damage (a wasp sting). It wouldn't have been too remote since had they removed the wasp nest, the person wouldn't have been stung. However if a random bee flew in, the company probably wouldn't have breached their duty of care, and if the court found that they had, the damage would probably be too remote or not have been caused by them directly.
Liable, yes. How much liable, depends. There would be copyright infringement, and with copyright infringement the exact facts count. Like did you commit copyright infringement to make money, were you aware that you committed copyright infringement etc. With your contract, it seems clear you didn't set out to commit copyright infringement to make money (because you paid someone else telling them not to commit copyright infringement). Up to the point where you learned what happened, you didn't know it was copyright infringement. After this, you better remove all the infringing works, because now you know it's copyright infringement, and now you are saving money by not hiring a second developer. Obviously you can sue the employee for damages.
Yes. In the United Kingdom it is illegal under the Computer Misuse Act 1990. In other jurisdictions there may not be a law directly aimed at computer crime but if you sell it knowing that a crime is going to be committed with it that makes you an accomplice. Most computer crime is prosecuted under laws not directly aimed at computer misuse.
No. You cannot be held liable for violating the EULA if you have never used the software and are only reporting what people who did use it told you. Of course, people bring groundless lawsuits all the time and you might have to defend such a lawsuit if you are sued. In some places you could be subpoenaed to disclose your sources, and in others, a reporter's privilege would allow you to quash such a subpoena.
What's the worst that can happen? If you do nothing, it's a bit inconvenient. If you delete all that company's stuff, who knows what they could sue you for. I'm not saying they would be right, but being sued can be expensive, no matter whether you are wrong or right. Send a letter by registered mail, with a witness to the contents, that you are the only one with admin rights to these sites, and asking them how they would like to take over these sites, and informing them that you will delete anything on your personal email after a reasonable time if you don't hear from them. And since anything you do is work for you, you should expect some appropriate compensation. Deleting their property, even if it affects you, is risky.