What does &quot;Russian person&quot; mean in EU legislations? The primary document of the EU sanctions against Russia (COUNCIL REGULATION (EU) No 833/2014) uses the term &quot;Russian person&quot;. The recent directive COUNCIL DECISION (CFSP) 2022/1909 has phrase &quot;Russian persons and residents&quot;. However, the term &quot;Russian person&quot; is not defined. Does it simply mean Russian citizens? Are Russian citizens with temporary or permanent EU member state or EU residences exempt from this?
The expression &quot;Russian person&quot; appears in Article 11 of the original, which says No claims in connection with any contract or transaction the performance of which has been affected, directly or indirectly, in whole or in part, by the measures imposed under this Regulation, including claims for indemnity or any other claim of this type, such as a claim for compensation or a claim under a guarantee, notably a claim for extension or payment of a bond, guarantee or indemnity, particularly a financial guarantee or financial indemnity, of whatever form, shall be satisfied, if they are made by: (a) entities referred to in points (b) or (c) of Article 5, or listed in Annex III; (b) any other Russian person, entity or body; (c) any person, entity or body acting through or on behalf of one of the persons, entities or bodies referred to in points (a) or (b) of this paragraph The &quot;Whereas&quot; clause first introduces the word &quot;person&quot; saying Those measures comprise the freezing of funds and economic resources of certain natural and legal persons, entities and bodies and restrictions on certain investments, as a response to the illegal annexation of Crimea and Sevastopol Article 2 then gives various prohibitions, which are broader that the March prohibitions against certain transactions &quot;to any natural or legal person, entity or body in Russia or for use in Russia&quot;. Since the regulation applies to things that are not human and cannot be citizens, it does not mean &quot;citizen&quot;. It does include &quot;a human&quot;, as well as artificial persons such as corporations, or government bodies. A Russian citizen who lives and works entirely in e.g. Germany is not in the prohibited set if they are not shipping prohibited goods to Russia. The Syrian Commander-in-Chief of the PLA (who is not a resident of Russia) is, however, prohibited from obtaining &quot;dual use goods&quot; to be taken to and used in Russia. Article 11 is different in wording from other articles stating various prohibitions, which repeat that long expression with &quot;in Russia or for use in Russia&quot;. Art. 11 says that under certain circumstances, contract claims shall not be satisfied if the claims are made by (a) entities referred to in points (b) or (c) of Article 5, or listed in Annex III; (b) any other Russian person, entity or body; Apart from the explicit list in Annex III, (b-c) or Art. 5 is (b) a legal person, entity or body established outside the Union whose proprietary rights are owned for more than 50 %by an entity listed in Annex III; or (c) a legal person, entity or body acting on behalf or at the direction of an entity referred to in point (b) of this paragraph or listed in Annex III. Therefore, the expression &quot;any other Russian person, entity or body&quot; refers to something much more expansive. On the face of it, it has to mean that no &quot;Russian person&quot; in any sense can sue for non-performance arising from this regulation.
GDPR &amp; EPD require user consent before storing a users personal information. Wrong. User consent is one of the ways that justify storing personal information, but there are others. You may check art.6 to see the several reasons that allow to store personal information. In this case, it seems reasonable to justify it under the paragraph f (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Of course, that means that the data has to be used for this purpose. Avoiding spammers and other banned users would be such a purpose, but you should ensure that you do not send those e-mail address commercial information or even a Christmas greeting. In any case, be careful with anything you store. If along with the e-mail you stored more info, this could be interpreted as excessive and beyond the scope of paragraph f. For example, imagine storing &quot;User wrote nazi statements&quot; explaining why the e-mail is banned; EU laws are very restrictive about storing information about political or religious beliefs.
It may &quot;seem[] normative&quot; that &quot;a law cannot enumerate any specific persons or companies to be included or excluded from its provisions.&quot; But in fact it is not generally the case. There are various kinds of laws that traditionally have named specific people or entities to define their scope. These include: In nineteenth-century England, a divorce could only be granted by a specific law passed by Parliament, naming the persons to be divorced. I am not sure when the practice stopped. In the US during the nineteenth century (and I think the early twentieth century also) a corporation was normally formed by a specific law granting a charter of incorporation to the named company. In the US during the period 1866-1870 there were a number of laws passed permitting former Confederate officers and officials who were presented by the 14th amendment from holding office under the US or any state to hold office again, as the amendment provides for. Eventually Congress passed a more general amnesty. It was once common for the English Parliament to pass bills of attainder. These were legislative declarations that a particular person was guilty of a particular crime, generally without any trial or other process. Sometimes the specific sentence was also imposed by such a bill. This was sufficiently resented that the US Constitution specifically forbids Congress or any state from passing such a bill. It was once common for actual laws to grant payments to specific people for specific purposes. This is no longer common, but there is no legal bar to it in either the UK or the US that I know of. The UK Copyright, Designs and Patents Act 1988 contains a provision enabling Great Ormond Street Hospital for Children to continue to receive royalties for performances and adaptations, publications and broadcast of &quot;Peter Pan&quot; whose author, J. M. Barrie, had given his copyright to the hospital in 1929, later confirmed in his will. This right is to persist even after the expiration of ordinary copyright for the play, but is not a full grant of copyright. Laws or ordinances invoking eminent domain to take the property of particular individuals for particular purposes are common, mostly at the local level. In the US, the Equal Protection Clause generally forbids laws which treat people, or groups of people, differently unless there is some rational basis for the distinction. But in some cases a plausible basis is asserted and such laws are passed.
Isn’t this discrimination since nationals do not have to apply? Yes it is discrimination. But that does not make it illegal. In fact discrimination is in general legal unless it is based on some characteristic which is specifically forbidden as a basis for discrimination (e.g. race). And in general, all of the countries in the world allow and enforce discrimination based on nationality; for example non-nationals will not be able to run for Head of State (and additional restrictions may apply). The EU members allowing similar rights to the citizens of other EU countries is the exception, not the rule, and once the UK stops being bound by EU treaties it can impose its own legal system on non-nationals. And while EU treaties give lots of rights to EU member-countries citizens, they still allow for discrimination based on nationality (for example you cannot run for Prime Minister or MP of Spain as a foreign EU resident). Isn’t the UK Government breaking the law? This could go against EU treaties, but the point is that the UK will no longer need to comply with them. is the UK Government responsible for the harm and distress caused to the individual health and mental wellbeing? No, the UK Government is not responsible if you do not like its laws to the point that it affects your health. Is there any ground for challenging this scheme legality in court? Unlikely. In any case it will not be because you are frightened by it, any challenge would be in the grounds that the government actions act against some other UK law. For example, if the decision to make such a list was made by the Executive but it contradicts some law approved by the Parliament. If this list does not contradict any law, then there are no grounds for challenging it. Would there a breach of my human rights if I was not to apply for settle status and then subsequentially got deported (taken away from my children, home, business, etc.)? How about if I was refused, re-entry or access to public services (NHS for example)? If you do not apply you will not have any evidence that you were settled, and the government could legitimately believe that you are irregularly in the country and try to expel you; you probably would have an opportunity to prove that you were settled even if you were not in the list but that could be way slower, more expensive, riskier and stressful than just registering now. Get this clear: that settled person list is to help you to show that you were a UK resident before Brexit and to give you the protections that are being negotiated between the UK and the EU for expatriates. Probably you could choose not to enlist, but it would work against you.
The order itself is here. It applies to &quot;any United States person&quot;, which includes citizens, LPRs, entities with a US basis, and any other person in the US including tourists. It applies to transactions, and not static possession. There is no exception to the effect that &quot;you can trade as long as it's not on the NYSE&quot;, and it says Any transaction by a United States person or within the United States that evades or avoids, has the purpose of evading or avoiding, causes a violation of, or attempts to violate the prohibitions set forth in this order is prohibited The order is not just directed at brokers, or the NYSE, it applies to everybody / everything everywhere, if you are a US person. Apparently there was some unclarity on the OTC question, which was clarified by the Office of Foreign Assets Control, to the effect that it includes OTC trading.
You've asked a two part question. [Is this a violation of] the international policy that a country should never refuse entry to verified citizens of their own? In considering that question, the US example may be illuminative. The US requires US citizens to have a &quot;passport book&quot; when flying into the US, even though the US issues &quot;passport cards&quot; that serve as proof of nationality. If you can get to the border and prove your US nationality (by passport card or otherwise), they'll let you in, but airlines won't board you unless you have a passport book. If you don't have a passport book, you're supposed to get to the nearest consulate and apply for a passport before flying to the US. But note that the US obligation to admit its own citizens is principally a feature of US law. CBP does not waive 8 USC 1185 because of some international body; there is no body that enforces international &quot;policies&quot; of this nature. Rather, they do so because they know that the federal courts would require them to admit US citizens based on the right of free movement implicit in US law. If someone were unable to get into their country of citizenship and unable to gain legal residence elsewhere then unless they could remain on the run for the rest of their life they would eventually end up as the subject of negotiation between whatever country is trying to deport them and their country of citizenship. In other words, in the worst case, such people become a bilateral diplomatic matter between two countries. Therefore, any challenge to the restriction would have to go through the Italian or EU legal system. Is this a violation of the EU freedom of movement directive, whereby a verified EU/EFTA national cannot normally be refused entry to any EU/EFTA state? It certainly seems to be, but without a decision from an EU court, we can't be certain. From Article 5 of the freedom of movement directive (2004/38/EC): Article 5 Right of entry 1. Without prejudice to the provisions on travel documents applicable to national border controls, Member States shall grant Union citizens leave to enter their territory with a valid identity card or passport and shall grant family members who are not nationals of a Member State leave to enter their territory with a valid passport. No entry visa or equivalent formality may be imposed on Union citizens. This doesn't say anything about allowing EU citizens to board aircraft from non-EU destinations without their EU passports. So if Italy makes a rule that EU citizens need a passport to board a flight to Italy from outside the EU and Schengen area, that doesn't seem to violate Article 5 except by implication. It would be for a court to decide whether that implication is in fact present. Because Article 5 doesn't say anything about where the passenger has flown from, we can also consider the case of a dual citizen of an EU member state and a &quot;third country,&quot; who might fly to Italy using the third-country passport, and then present a national ID card at the immigration counter. If such a traveler were denied entry, that would appear to violate Article 5. If that traveler's other nationality were one that required a visa in the non-EU passport, the traveler might have a stronger case that Italy's rule infringes on the right of free movement. EU or EFTA citizens could also challenge the restriction more generally as an infringement on the right of free movement that is established in the Treaty on European Union (TEU), even if the directive itself does not prohibit the restriction. For example, one might argue that free movement is restricted because there are countries to which EU citizens can travel with only an ID card, but from which they cannot return to Italy with only that card. In addition, non-Italian EU or EFTA citizens could challenge the more restrictive regime applied to them on the argument that it violates the principle of non-discrimination articulated in Article 9 of the TEU: Article 9 In all its activities, the Union shall observe the principle of the equality of its citizens, who shall receive equal attention from its institutions, bodies, offices and agencies.... Furthermore, non-Italians residing in Italy could challenge the more restrictive regime on the basis of Article 24 of the directive: Article 24 Equal treatment 1. Subject to such specific provisions as are expressly provided for in the Treaty and secondary law, all Union citizens residing on the basis of this Directive in the territory of the host Member State shall enjoy equal treatment with the nationals of that Member State within the scope of the Treaty. The benefit of this right shall be extended to family members who are not nationals of a Member State and who have the right of residence or permanent residence.
First of all, in a GDPR contest, the process described is not strong anonymization. It may be hard for an outsider to go from the stored record to any PII, it is much easier for an outsider to &quot;single out&quot; an individual. This means that given a known individual, one can determine whether that person is among those listed in the records, or can determine this to a significant degree of probability. For this only the algorithm and the rotating salts are needed, one need not break the hash. Note also that the GDPR specifies that if a person can be singled out with the assistance of the site operator the data is not considered anonymized. Thus this data needs a lawful basis under the GDPR, and the various other GDPR requirement all apply. However, even if the data were totally anonymized, and say just added to a count of users with this or that User Agent, the process of reading local data (including but not limited to cookies) itself requires informed consent, and so a cookie banner or other interaction with similar info under the e-Privacy directive (EPD). The EPD, being a directive and not a regulation, must be implemented by national laws, and the exact provisions in those laws may differ somewhat from country to country. But I believe that all of them require consent before any local data is read.
Nicknames, usernames, or gamer tags are definitely personal data under the GDPR. You are operating under a very narrow definition of “identifying”, which is understandable since the definition of personal data in the GDPR isn't overly enlightening at first glance: […] an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; — GDPR Art 4(1) However, this definition does show that “identifiable” should be interpreted rather broadly. For example, indirectly identifying data is still identifying data – there doesn't even have to be a strong identifier like a name, passport number, or street address. It is also not necessary that identification enables you to determine the real world identity – identification is anything that allows you to single out a person, or to combine data into a profile of that person (compare Recitals 26 and 30). In any case, an online username or user ID is clearly an identifier and will fall under one of “a name, an identification number, […] an online identifier”. If in doubt, ask your data protection authority for guidance. You've correctly understood that you will need a legal basis to process this data, and that legitimate interest could be that legal basis. This doesn't have to be your own interest, so a community interest would be OK. You need to balance the user's rights against this interest. You have performed this balancing and have found that the interest outweighs these rights. You've noted that such leaderboards are a cultural norm and are generally expected, which strongly weighs in your favour. However, legitimate interest is not a free pass but just means an opt-out solution (right to object per Art 21). You should also inform users that the leaderboard is accessible publicly when they join your server (transparency principle per Art 5(1)(a) as detailed by the information obligations in Art 13). In particular, you should use a “message of the day” or welcome message functionality to link to your privacy policy. You should also be aware that other rights such as the right to access, erasure, and data portability apply. As an alternative to legitimate interest (opt-out) you could also consider consent (opt-in), though this results in slightly different data subject rights and is more difficult to do correctly. But I'd agree that legitimate interest is more appropriate here.