How can you guarantee deletion of consumer data on the internet? I have a bit of conundrum in thinking of making a business directory site listing businesses and people in a community-driven/edited way (like Wikipedia). Say that a community of people add personal details of 10,000 business members online. One of those business people would like their name removed from the system. Okay we remove it. But what is to stop the community from creating it again? It seems there would have to be an endless cycle of adding/removing/adding/removing-request etc. The reason is, say you actually delete all traces of the user's record &quot;Jane Doe, jane.doe@gmail.com, @janedoe&quot;. Then someone goes to add a new person, &quot;Jane Doe, @janedoe&quot;. We don't know that was a previously removed person, to prevent from being added again. So that's conundrum 1. The next conundrum is, say we have a hidden internal database of previously deleted people, so we can match against when people try to add new people, and prevent them from adding existing people. First off, there is no real simple way of being able to tell that &quot;Jane Doe, @janedoe&quot; and &quot;Jane Doe, jane.doe@gmail.com, @janedoe&quot; are the same person. Perhaps they deleted their email address and someone else with the same name took it up. Or many other reasons it would be hard to tell. So we can't really prevent in that way. But we also still have this hidden internal database of previously deleted users. We need sufficient data for each user to know which users have been deleted, so we can optimally remove new users with the same identifying pieces of info. So then now it's basically, we have a private and a public database of users, the private one used to maintain security but requires detailed user info, and a public database that has whatever info we choose to make public. Also, having the &quot;deleted user database&quot; could be a security hole, whereby users try creating random addresses and usernames, until they get &quot;locked out&quot; of one of them, knowing they discovered a deleted account which must be a real account. So I don't really see a clear way to actually delete people's data in such a community-driven site, do you? What are the laws around this? Must Wikipedia delete the page of Barack Obama if he asks of it?
Neither the GDPR, nor the CCPA, nor any other data protection law that I am aware of, requires that when information is deleted on request, that similar information not be collected and stored in future. Under the GDPR Article 6 there would have to be a lawful basis for any processing, including storage, assuming that the GDPR applies to the directory in question. There could be a claim that such processing was lawful under article 6(e) &quot;performance of a task carried out in the public interest&quot;. I do not know if any such claim has been adjudicated. Thus there is no need to hold a database of previously erased records to determine if a new record should be blocked as &quot;previously deleted&quot;. The Wikimedia Foundation, which runs Wikipedia, I believe takes the position that the GDPR does not apply to Wikipedia, I am not sure of their detailed arguments. But surely articles on well-known people, such as a former US president, would be covered under the same provisions as would cover news reports and historical books about such a person. Perhaps that would also come under article 6(e)
Not that I am aware of. A person who 'owns' a domain is entitled to utilize that domain including for the purposes of receiving emails. With physical mail, it is a crime in most countries to intentionally interfere with mail that is not addressed to you. For example - Australia. However, this is statute law and as such does not extend to emails - even if it did, if you own the domain then you are the person to whom it was addressed. I note that you seem to misunderstand "confidential" - this only arises in the context of a special relationship between the person transmitting the information and the person receiving it. Usually this is a contractual obligation between A and B but it can be imposed by law (e.g. doctor-patient, banker-client, lawyer-client, GDPR etc.). If A sends confidential (as between A &amp; B) information to C, C is under no general obligation to keep it confidential if C has no relationship of confidentiality with A or B. If C discloses it and B suffers damage, B sues A for breach of confidence (or the government prosecutes A for breaking the law); B has no case against C. For your situation, where B has allowed A to send the information to an obsolete address then B has contributed to the breach to an extent that B would be extremely unlikely to succeed in a suit against A.
Intent would greatly factor into the case. As mentioned, possession of child pornography is illegal. There was a case, where a man had inadvertently downloaded such images. In the case, it was shown that there was sufficient evidence that it was accidental and without his knowledge. Presumably, if you by happenstance created an identical code through encryption/compiling, there would be a lack of evidence of intent or evidence of your intended use. For example, your stored password manager file happens to store data identical to an illegal image. The password manager output is provable and repeatable to show that it was simply circumstantial. If you have hundreds of such outputs that all "just happen to be illicit images" you would probably fall on the wrong side of reasonable doubt. As to whether you can keep the data, the programmers for the password manager would probably update their system to modify the output to avoid bad press. The general idea is that the "illegal number" is so incredibly specific that accidental cases are very unlikely to occur, and if it did, that there would be forensic evidence indicating intent and use.
There is no US law licensing journalists or people who report the news, or requiring such people to identify themselves by legal name. Nor can there be under the US First Amendment. There is also no law requiring a person to identify himself or herself by legal name online. Some sites, including Wikipedia, have policies against having multiple undisclosed user IDs for the same person, but that is a matter of the site's own rules, not a matter of law. Any US law mandating this would again run afoul of the First Amendment to the US Federal Constitution. This article on Anonymous Speech reviews and cites a number of US Supreme court cases on the subject of anonymity, mostly in political contexts. This article from the Electronic Frontier Foundation (EFF) discusses the same general subject. Both articles mention that The Federalist (analyzing and advocating for the then-unratified US Constitution) was originally published under the pseudonym "Publis". The EFF Article "Court Recognizes First Amendment Right to Anonymity Even After Speakers Lose Lawsuits" discusses the 6th Circuit case of Signature Management Team, LLC v. John Doe in which it was held that an anonymous blogger who lost a copyright infringement suit could nonetheless remain anonymous. This page apparently from a Harvard course, lists and briefly describes several cases on the same subject. In Doe v. Cahill, 884 A.2d 451 (Del. 2005) an elected official sued an online poster for defamation, and sought to force the ISP involved to disclose the poster's identity. The Delaware Supreme Court ruled against this, setting a standard offering greater protection for such anonymous online speech than previous cases had. This answer is very US-centric. Laws in other countries are different. The OP has not specified a country or jurisdiction.
Under GDPR article 6 paragraph 1 item (c) one lawful basis for processing personal information (PI) is: processing is necessary for compliance with a legal obligation to which the controller is subject; The obligation to attribute a reused work under a CC license is such an obligation. Moreover, the licensor has the option under any CC license to specify a pseudonym for attribution of that work, or to waive attribution totally. Not doing that while releasing content under a CC license that requires attribution could reasonably be considered consent to publish that name along with each re-released copy of the work, so there are at least two lawful bases for processing that name and making it public. In some jurisdictions the license has the status of a contract, which imposes an obligation to attribute the author properly under GDPR Article 6 paragraph 3, as described in more detail in the answer by amon. Also, usernames are PI if and only if it is reasonably possible to associate them with a specific natural person. If a person chose a user name for a single site, not used for any other, and did not post any info that allows the person's identity to be determined, it is not PI. Often, of course, the person can be determined.
The GDPR has a fairly broad concept of what it means for a data subject to be identifiable. The details are given in Recital 26: To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The good news is that this mandates a risk-based approach to identifiability. You don't have to prevent re-identification with absolute certainty, but you must make sure that re-identification is not “reasonably likely”. The bad news is that “identify” does not just mean “figuring out the real-world identity of the data subject”, but also “being able to single out the data subject”. Hashes of personal data are still personal data. The hashed password still allows you to single out data subject, since the hash now serves as an identifier that links multiple records. Equivalently, a random ID would serve as an identifier. Depending on the information in the linked records, this could reasonably likely also allow linking to a real-world identity. I'll also point out that the GDPR explicitly notes that “online identifiers … such as internet protocol addresses, cookie identifiers or other identifiers” enable profiling and identification, and are thus a kind of personal data. Note that it seems you have a user database that includes a password hash. This database includes rich links between the password hash and other, more directly identifying, data. Alternatively, consider that the software that collects tracking information along with this tracking identifier would also receive other information about the data subject that could allow re-identification, such as the data subject's current IP address. It would be reasonably likely that such additional information could be used to identify or single out the data subject. For this analysis, it is irrelevant whether you have any intention of singling out users – it only matters whether, under an objective analysis, the relevant means to do so exist. Related: EDPB thinks hashed phone numbers are personal data. There has been recent debate by regulatory bodies on the question whether hashed phone numbers are personal data. This debate was published by the EDPB binding decision regarding the Irish DPC's fine against WhatsApp, which uses hashed telephone numbers to intersect user's address books. The question in the context of the fine was whether this represents processing of personal data of users who are not WhatsApp users themselves. Originally, the Irish DPC argued that such hashes were not personal data. However, the German, French, Portuguese, and Dutch supervisory authorities pointed out that the specific hashing approach used by WhatsApp does not provide anonymization, for example because there still is contextual information (such as the user's social graph) that would allow indirect identification (and because their hashing was pretty weak and reversible with reasonable effort). Such hashing would only be pseudonymization, not anonymization. The Hungarian supervisory authority makes the argument that WhatsApp could always re-create the hash from the original data, thus permitting re-identification of the hash. This is in line with my above argument that the hash allows singling out. Again, the hash should be considered pseudonymous, not anonymous. The EDPB upheld all these objections against the Irish interpretation as “relevant and reasoned”, and largely agreed with their merits. Some parts of the resulting analysis are specific to issues around phone numbers, in particular that there are comparatively few phone numbers. However, a recurring point is that the hashed data cannot be viewed in isolation. It must be viewed in the context of how it is created and used, and in the context of other data that the data controller has. Conclusion It is possible that in some cases the hash could serve as an anonymous token. But this would require careful analysis about how the hash is created and used, and about what other data you have available and could potentially link or correlate with this token. Unless you are extremely sure that there are no means that could be reasonably likely used to perform re-identification or singling out, you should consider such tokens to be pseudonymous data. Pseudonymization is a great security measure, but such data is still personal data. I suggest reading the WP29 opinion 05/2014 on Anonymization Techniques (WP216) (PDF link). It predates the GDPR and is slightly outdated in both legal and technical matters, but still contains highly relevant guidance on the matter of proper anonymization in the European data protection context. Aside from identifiability issues, I am concerned about using the password (or derived hashes) for anything other than authentication. Even in hashed form, this is fairly sensitive data. In most cases where you would use a password hash, you can likely use a random number instead.
You must get opt-in affirmative consent to process personal data, including tracking people's use of your site or providing targeted advertising. The banner on StackExchange is likely in violation of the GDPR. Do not copy it. It does not have an explicit opt-in, only an opt out which is onerous (leave the site, then manually go in and delete any cookies they set, which may be hard to identify if they are from 3rd parties). The sites you mention that have a gateway are a more correct implementation. Consent must be acquired before processing of data begins, and it must be explicit.
There are some problems with this kind of vandalism, one of them clearly that the internet is international and vandalism can be performed from everywhere on servers everywhere in the world. And so it may be (both technically and legally) difficult to get hold of the vandal. Therefore, most wikis primarily focus on blocking offending accounts or their IPs and hope that this helps at least for a while. Only if it doesn't and the vandalism continues for extended time periods, legal measures are considered. Legally speaking though, vandalism is prohibited by many jurisdictions and of course by the terms of use of the wiki operators. For instance, the Swiss criminal code Art 147 explicitly puts &quot;abusing of data processing equipment&quot; under penalty and hence gives website operators a legal backup for setting up rules for the use of their services. Computer fraud Art. 147 1 Any person who with a view to his own or another's unlawful gain, by the incorrect, incomplete or unauthorised use of data, or in a similar way, influences the electronic or similar processing or transmission of data and as a result causes the transfer of financial assets, thus occasioning loss to another, or immediately thereafter conceals such a transfer shall be liable to a custodial sentence not exceeding five years or to a monetary penalty. 2 If the offender acts for commercial gain, he shall be liable to a custodial sentence not exceeding ten years or to a monetary penalty of not less than 90 daily penalty units. Technically, the law even requires prosecution ex officio, even though without a hint from the operator, the police won't start an investigation. I'm sure the US has a similar law. The problem is, as with all internet crimes, it's practical application, particularly because often website operator and offender are not living in the same country. Edit After reading the exact text again (it was unavailable yesterday) Art 147 is mostly about fraud performed by computers (classical &quot;hacking&quot;) but it shouldn't be difficult to argue that fighting and reverting vandalism requires significant (technical and personal) effort and hence the operator looses money. Additionally, there's Art 144bis which matches even better for the scenario here: Damage to data Art. 144bis Any person who without authority alters, deletes or renders unusable data that is stored or transmitted electronically or in some other similar way shall be liable on complaint to a custodial sentence not exceeding three years or to a monetary penalty. If the offender has caused major damage, a custodial sentence of from one to five years may be imposed. The offence is prosecuted ex officio. Any person who manufactures, imports, markets, advertises, offers or otherwise makes accessible programs that he knows or must assume will be used for the purposes described in paragraph 1 above, or provides instructions on the manufacture of such programs shall be liable to a custodial sentence not exceeding three years or to a monetary penalty. If the offender acts for commercial gain, a custodial sentence of from one to five years may be imposed.