I emailed a law and data privacy professor regarding an issue I was having to do with internet privacy law. Will I get in legal trouble for this? I emailed an American law and data privacy professor to ask to help explain whether google could reveal my information if a court order was taken out to identify me. I was very over emotional in the email saying things like “what’s going to happen to me?” They didn’t respond as this was Dec 19th however later on I realised what an idiot I was for emailing them something that I knew already was a small problem and apologised for wasting their time on such trivial matters. Then I emailed them another apology asking for their forgiveness blaming my anxiety on my impulsive decision and the way I overreacted to the situation. Could I get into legal trouble for this?
Could I get into legal trouble for this? No. Relax. Your three emails are very unlikely to cause a data privacy professor to feel harassed. Just move on regardless of whether he replies at all. Don't keep sending another email just because the recipient has not replied to your previous one. As for the issue that prompted you to start emailing the professor, what everyone else has told you is correct. And the other email user is unlikely to take court action for something like this. The effort and cost of drafting &amp; filing suit, and then pursuing discovery would dissuade most people unless they are incurring actual losses (which is not the case with your messages). Just move on so that this other user also can move on.
If person A deletes their account would that mean that person B no longer can view the email sent by person A? No. Person B's inbox implies overriding legitimate grounds that limit person A's &quot;right to be forgotten&quot;. See article 17.1.(c) of the GDPR. Furthermore, item 2 of article 17 is not applicable because the email service did not make A's personal data public. The email service merely sent to B the record with which A unequivocally addressed B. This means that the email service does not even need to notify B regarding A's request for erasure. All the email service needs to do is remove A's account pursuant to A's request.
a few quick notes that come to mind. As the commenters point out: DSGVO is indeed the German equivalent name to the GDPR (English term) "Imprint" isn't a privacy related topic that much, as such it's not really changed by the upcoming GDPR The GDPR changes many things, but the requirement for up front information isn't one of them - so it would've already been a rule to follow Sometimes the question who is responsible for privacy information might not be that easy to decide when you're on platforms. I take this situation as being pretty clear though. You are basically given a blank slate, you can do with that page whatever you want, and the visitor has no clue whatsoever that it might be hosted by Github. In addition to this, Github would be classified as a data processor (providing the tool) and you as the data controller who is in charge of practically everything except for the provision of the page. I hope this helps. Btw. it's not that hard anymore to write a privacy policy these days.
was there a good way to publicly shame Bob, and prevent him from getting his next job, without breaking Carol’s confidence? Apparently not. The conclusion that Bob's violations of company policy are short of breaking any laws leaves little to no reason for publicly shaming him. Details on the company policy, the facts, and the statements might make a difference, but your description is generic in that regard and would require us to speculate on what they could be. Could there have been grounds for a lawsuit? It largely depends on the terms of the publications, their veracity &amp; import, and --if false or unfounded-- their effect on Bob's prospects and/or whether the statements are defamatory per se. Would a truth defense for a statement such as, “We completed an investigation of Bob for professional misconduct,” require disclosing the investigation? Yes. A defendant has the burden to prove the [affirmative] defense(s) on which he intends to premise his position. Note that the statement “We completed an investigation of Bob for professional misconduct” in and of itself is not really a truth defense because it is inconclusive as to whether Bob was found to have incurred misconduct. The sole fact that Bob was investigated does not justify imputing to him disreputable conduct. Would a defense that the investigation gave them legitimate reasons to believe that the insinuation they made is true require them to disclose it? Yes. Bob is entitled to gather from the defendant the bases for the latter's allegations. Otherwise defamers would systematically elude their liability by sticking to generic allegations only. Are there other good defenses that could have gotten the lawsuit dismissed as frivolous? That requires us to speculate because we are given no details about the underlying events, Bob's pleadings, the evidence obtained during discovery, and so forth. That being said, a prevailing defense does not imply that the lawsuit is frivolous. Would the identities of the witnesses have been redacted? No. The fact that Bob did not break any laws suggests that the matter does not warrant measures akin to witness protection. Nor does your description reflect that the communications are protected by some privilege. Is it credible that Ethan had a good legal reason to keep this “in the family” for Carol’s sake? That is unanswerable because, inter alia, it is not about the law, it is unclear what exactly &quot;Carol's sake&quot; entails, and the substance of the company's other scandals as well as Ethan's reason(s) are unspecified. Ethan's &quot;good legal reason&quot; does not necessarily have to protect or advance &quot;Carol's sake&quot;.
In my opinion, this should be enough. The GDPR regulation is general - it does not attempt to address these issues directly, precisely for the reasons we see here: You can never predict how the technology will develop. When interpreting the GDPR, we must keep the intended goal in mind. What is the purpose of the "right to erasure"? To prevent anyone from further processing the personal data. If you "crypto-shred" it, it can't be processed anymore, not even theoretically. The encryptec file cannot be used to identify the subject, therefore it is not even personal data anymore. In case it can be decrypted in the future... Well, that is just a speculation. The courts can go to great lengths in interpreting what personal data is (dynamic IP address is considered personal data, since it can be linked to a person by the police with a court order), but i am pretty sure that "it can be theoretically possible in some distant future" is beyond the limit. As for the second question, I am not aware of any applicable case-law, but I guess that current security and technological standards will be used to assess the delay. You have a right to protect your data, the subject has a right to erase them. Those rights must be balanced, neither fully overrules the other. The delay should be short enough so the right to erasure is effective, and it should not extremely long compared to other (economically viable) backup solutions available, in line with current industrial standards.
There are only two arguments you can make: The match making website did something wrong. I don't see how you can make this argument unless you have some reason to suspect they actually did something wrong. Strict liability applies. I think this fails for two reasons. One is that no theory of strict liability that I know of would apply to this situation. The other is that this is precisely the kind of risk that a user of the site should be protecting themselves from because it is much easier to detect fraud when you have extensive contact with someone than when you just operate a matchmaking service. So absent some evidence they did something wrong, such as ignoring specific warning signs from this particular user, there is no way such a suit could succeed.
First, when using profiling third party services (Analytics is "profiling" as defined by the GDPR), your main concern is not such a trivial thing as cookie compliance, but the security of processing I've analyzed Google's IP anonymization in some detail (as part of the DPIA I do for clients). My conclusion is that for most of the web-sites we manage, Google's IP anonymization is adequate to ensure security of processing as required by the DPIA process. However, on some sites that are likely to visited by users interested in what the GDPR calls "special categories of personal data" (Article 9), we either do not use Google Analytics, or we add additional layers of security in case the USA Government orders Google to disregard the stipulations in the DPA and hand over the data (yes, the US Government can legally do that - read the fine print in the Privacy Shield accord). As for Facebook Analytics, I think you've simply misunderstood their policy. Nowhere in that policy document does Facebook say that they "are not collecting Personal Identifiable Information". AFAIK, they collect tons of it, in all sorts of obnoxious and sneaky ways. What they actually say about PII in the context of Analytics is this: We do not share information that personally identifies you (personally identifiable information is information like name or email address that can by itself be used to contact you or identifies who you are) with advertising, measurement or analytics partners unless you give us permission. Let me remind you that one of their "analytics partners" was Cambridge Analytica, so if this promise not to share is true, it looks like a pretty new policy. OK, moving on to cookie compliance. To you (the controller), both Google and Facebook are processors. Given the history of the NSA and the methods it have used and AFAIK still use to get US-based companies to hand over the personal data about Europeans through orders issued by secret FISA courts, plus the fact that total nutcases currently are in charge in the USA, I am not going to rely on the privacy policy of any US-company for protection of personal data. So if I make use of Google Analytics (and I often do, they provide a great service), I always make sure that my users opt-in on that (hard cookie concent), even I make use of their IP anonymization feature (YMMV). As for Facebook, the fact that they promise not to share PII with third parties is irrelevant because they collect personal data. You will always need consent from your users to hand over their PII to Facebook in the first place. This is not optional. PS: If was a user, that consent would never been granted, no matter how great or valuable your site might be. If you have any sort of relationship with Facebook, I'll give you my personal data when you pry it from my cold, dead hands.
As someone who is not a lawyer, but is familiar with FERPA and university policies as a former instructor, I would be more than willing to bet that you signed or otherwise agreed to some type of Terms of Service before being given access to that type of service. There are almost certainly numerous things you signed to become a student, as well as various policies you agreed to in first gaining access to the computer services, which would apply here. I can tell you with certainty that the school where I was a student had a policy that I agreed to that they would make certain information available to other students unless I chose for it to be restricted. However, my university did not have any photos of students that were viewable by other students in a directory. That said, there were also times I participated in extra-curricular activities where I was required to sign release forms giving the school the rights to video tape, record, and photograph me, and to do what they wished with those things. So, with that in mind, I suspect that's partly due to FERPA restrictions, but also largely due to their own privacy policies that go beyond what FERPA requires. All in all, I doubt they would be okay with you using their photos for your own private use - student privacy is something that is taken very seriously.