Can 3rd party websites share my personal information without my consent or knowledge? I have stumbled across a few websites: https://www.truepeoplesearch.com/ https://www.familytreenow.com https://www.fastpeoplesearch.com www.truthfinder.com that contain a lot of detailed information about me: my age, and all the places I have lived in the U.S. possible names people I hang out with email phone numbers I know that I have never put my addresses anywhere online. In addition, they do share information about my associates (people I hang out with). I understand that you can see who hangs out with whom on Facebook, however, that information in principle can be hidden from public and Facebook shouldn't share it(or whatever) Is there a way to report websites like this? Can they legally share my information with the public like that? They do allow removal of the information, but I don't want to hunt down all websites and try to remove it manually. Can I report these websites to U.S. regulators?
The information in telephone books is public. so are postal change-of-address records. So are records of the ownership of real estate. So are vital statistics such as birth records. So are voter registration lists -- i myself purchased a voter registration list (in digital form) for a municipality which showed people's names, addresses, and the years when they voted, when I was a political candidate for local office in NJ. It cost about $100. I believe that many states also make driver's license information available for a fee to marketers. Credit records are available for certain limited purposes, also. No doubt there are other public sources I haven't thought of. If such a site relies on public records, or other publicly available data, it is not illegal. Many such sites offer to remove names on an opt-out basis, but there is no legal requirement that sites do so. This kind of information is not considered nto be "private facts" under US tort law. Aside from opting out, if the sites provide that option, I don't think you have any recourse. One could ask the local legislature to pass a law prohibiting such sites, or making them require consent, similar to the GDPR that the EU has. But I don't know of any such law in the US to date.
No. You are correct in that this is not related to Copyright. Copyright is meant to protect expressions of an idea. An URL is simply an address, like a street address. Can you legally stop people referring to your home address? No. Can you legally stop people from passing by and looking at your house on the street? Also no. A famous case related to hyperlink is Ticketmaster v Tickets.com (2000). Tickets.com used information Ticketmaster's website and deep-linked to there. The ruling established that: use of information is not infringing hyperlinking cannot be copyright infringement because no copying is involved. deep linking is not unfair competition If you feel that it is necessary to avoid people linking to specific pages of your site, you may consider accomplishing this technically. UPDATE It does not matter whether your site is meant to be public or not. For example, an knowledge base meant to be shared internally in an organization, but accessible on the internet since staff are geographically distributed. Again, you may think of it like a street address. A private corporate building meant for employees only. An address, like Room C, 16/F, Example Corporate Complex, 4321 Lucky Avenue can be shared like any other address. You cannot demand people to never refer to your office address. You can, however, setup a security post at the entrance and only allow certain guests to visit you. In the case of a website, you may state in your terms that one cannot share access information to any external parties. This will include the sharing of any authentication data (e.g. password) which can be used to access content.
Wikipedia explains this well enough: Particular numbers can be trade secrets, and their reproduction and dissemination may be particularly proscribed, e.g., by the U.S. DCMA. As a coarse analogy: Your social security number is not "illegal." But if somebody entrusted with it shared it in violation of law or contract then their communication of the number in a context that allowed potential identity thieves to associate it with you would be illegal. To answer follow-up questions in the comments: Sure, "mere possession" of a number can land one in jail for all sorts of crimes, just like "mere possession" of stolen property can. For example, if you possess a bank account number, credit card number, or PIN, and you "conspire, confederate, or combine with another" person who actually commits fraud or theft using that number, then you can be convicted of the same crime. This is so common that a search for "conspiracy to commit wire fraud" or "credit card fraud" provides ample reading.
http://www.healthinfoprivacybc.ca/confidentiality/when-can-and-cant-they-tell-others is a pretty good summary. Different rules apply to private practices than public clinics and hospitals. I will assume that the clinic on campus is private. This is a summary of the summary about who your information can be shared with: Health care professionals can share information within your "circle of care". Specifically, they are allowed to assume your consent to this but you can explicitly withdraw that consent. This would include doctors within the same practice. Admin staff can access your information for administrative purposes. Anyone you have authorised them to share it with e.g. relatives, friends etc. The Medical Services Plan for billing and admin If you are unable to drive If there is suspected of child abuse If you are wounded by a gun or a knife If you are a danger to others For your specific questions: I asked about it and they said it's confidential, but confidential to the clinic. Correct, unless you explicitly revoke this. the counselling department can share information with the doctors This is tricker, these people may be either within your "circle of care" or they may be part of the same organisation. Notwithstanding, councillors are not doctors and are governed by the everyday laws related to confidentiality i.e. information given in confidence is confidential and everything else isn't. If you are told the limits of the confidentiality i.e. they tell the doctor, then those are the limits unless you renegotiate them. he would know I only have one kidney? Well you said "the counselling department can share information with the doctors" and this would require the information going the other way i.e. the doctor sharing with the councillor. Even if this type of sharing was OK in general (and I'm not sure it is, see above); the information shared should only be what is required for the councillor to do their job - the number of kidneys you have is probably irrelevant to this. What laws apply to situations like this where confidential information in one entity (medical office) decides to share it without the consent of the patients to another entity (the counselling dept.)? Well, we are not sure there are 2 entities: legally there may only be 1 - the university. Anyway, the laws are the Personal Information Protection Act and common law (Smith v. Jones, [1999] 1 SCR 455)
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
I assume this refers to the case covered here: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta The gist is: Under GDPR you can only transfer personal data from inside the European Union to the outside if you have procedures in place that ensures it is still protected to European standards. Facebook was found to have failed in that regards, specifically when it came to access by US spy agencies. It seems indeed quite plausible that it is not possible to transfer personal data from the EU to the US in a way that is compatible with both EU and US law. The EU and the US are in negotiations to find a way to make this legally possible. But until then, it seems that if you do have a European subsidary and want to keep all of your account data in the same place, it needs to be a place with robust privacy protections. That doesn't require it to be in the EU, but something like US, Russia or China would be illegal.
You don't need to "report" it to anyone in the US or do anything else. The US doesn't have any national registry of marriage. Any marriage or divorce conducted anywhere in the world is automatically recognized anywhere in the US (with some exceptions like polygamous marriages); the same is true in many other countries. How does the U.S. find out, for tax or insurance purposes? Obviously there's a little box that says [] Married but how would they know if I lied if I'm not registered in the United States? They don't, and don't need to. (The same is true for marriages in the US -- they don't directly "know".) You are required to use an appropriate filing status for your marriage status at the end of the year for each year's tax returns. If you don't, you are committing fraud. There are lots of things that you can intentionally lie about on tax returns, and they may not immediately "find out"; but when they do, you are in big trouble. Am I legally required to report it when I return? No. Would the Canadian/provincial government inform the U.S./state government? No.
Anything that helps you with your business and that you keep secret is a trade secret. The "keeping it secret" is an important part. Competitors are free to discover the same information themselves and use it, but stealing it from you is illegal. If a contractor needs to learn this information to do their job, you make them sign a non-disclosure agreement or confidentiality agreement which forbids them to pass that information on. That way, it remains a trade secret. If the contractor gives your trade secrets away, that is breach of contract and you can sue for damages. If a competitor pays your contractor to give them your trade secrets, that's not just illegal, it's criminal. On the other hand, if the contractor puts the information on his blog for example where everyone can read it, without having been enticed by someone to do this, then I believe your trade secret is gone and competitors can use it. Same as if you left documents on a park bench and your competitor finds them and reads them. You have to keep a trade secret a secret; if you fail to do so you lose. Asked about patents: If there is a non-disclosure or confidentiality agreement in place, then nobody can apply for a patent. The whole idea of a patent is that you get legal protection in exchange for disclosing your invention. Applying for a patent would mean violation of the non-disclosure agreement.