Is it legal for a company to require you to delete your account to unsubscribe from marketing emails? I'm subscribed to &quot;Visual Studio Dev Essentials&quot; (so that I can download older versions of Visual Studio from the Microsoft website), but they are sending me unwanted marketing emails regarding both Visual Studio Dev Essentials, and other products. In the footer of the email, it says that to unsubscribe from the emails, I must unsubscribe from the service, which I don't want to do. Is this legal? Note that I'm based in the UK, but Microsoft (the parent company at least) is based in the US.
No, it's not legal. The General Data Protection Regulations (GDPR) apply given that you are in the UK (regardless of where the Data Processor is based). The UK GDPR is slightly modified due to Brexit, but the same principles apply. The only plausible legal basis for this actions would be that you consent to it, and you're entitled to withdraw that consent at any time. Some may claim that Article 6.1(b) applies, i.e. that it's necessary to send marketing email in order to fulfil the contract, but GDPR is clear that bundling such consent into a contract for service simply to permit the data processor additional actions isn't allowed, as I'll demonstrate. UK GDPR requires that consent to use your personal information (in this case, your email address) for the stated purpose be freely given. Consent to use your information for direct marketing is not freely given if it's inseparable from the consent to use it for some other service, as per para 43: Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. And Article 7.4 backs this up with When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. The intent of Article 6.1(b) is that only the processing required for the service you have bought is allowed (e.g. if you supply your address for delivery of stuff you've bought, the data processor can use that address to send you the stuff, but is not allowed to add a contract term that allows them to send you unwanted stuff). Examples of emails that Article 6.1(b) would allow (in my assessment) include things such as notification of upcoming downtime, or a reminder that subscriptions are due, but not unsolicited advertisements for other products. There's a grey area that's open to interpretation, where adverts are piggybacked onto actual service messages.
Making the game free makes very little if any difference to the position here. There are two kinds of IP issues that could possibly be involved: copyright and trademark. Note: both copyright and trademark are civil, not criminal issues (except in very limited circumstances which do not apply to the situation described in the question). You will not &quot;face charges&quot; but might possibly be sued. If you are asked to take down such a game and comply, this might end the matter, but if an IP holder claimed that damages had occurred before the game was taken down a suite might possibly still be brought against the developer. Copyright Names, like titles and other short phrases, cannot be protected by copyright. As long as no other text from anyone else, and no images are copied or imitated, copyright is not infringed. This means that there are no copyright issues. Game mechanics and rules cannot be copyrighted, although the words of game rules can be. Therefore, fair use which is a strictly US copyright legal concept, is not involved here. Neither is fair dealing, a somewhat similar legal concept from the UK and some commonwealth and European countries. Trademark Here is the main issue for this situation. The names of individual Pokémon characters are probably (almost surely) protected as trademarks. That means you cannot use them to identify your game, or any other product or service, and you cannot use them to advertise or market your game. This is true even if the &quot;selling price&quot; is $0. The use here does not seem to be nominative use, as you are not intending to refer to Pokémon or any of its variants. You are just reusing the names. As long as you make it very clear that your game is not made by, nor in any way authorized or endorsed by the makers of Pokémon, this is probably not trademark infringement. But if the makers of Pokémon become aware of your game, they might well send you a cease and desist letter, and they might file a trademark infringement suit. Even if you were to win such a suit, as I think you might well do, it might be costly to defend. Could you alter the names to ones you invent form yourself? That might save a lot of trouble and hassle. What is the value to you in reusing the well-known Pokémon names?
What legal options do I have here? I don't think I can sue for defamation of character since the email was sent to me only. Your rationale about defamation is accurate with respect to the establishment (henceforth "company"). But you may sue the person(s) who approached the company to falsely accuse you of that crime. Being banned certainly qualifies as special damage (that is, concrete damage), whence you have a viable claim of defamation per quod. If the crime that was falsely imputed to you is a felony or serious crime, then you additionally have a viable claim of defamation per se. I was thinking that I may have some legal recourse since the email clearly threatens to defame my character if I re-enter the establishment You have legal remedies, although not necessarily from this angle. The company can credibly argue that it sought to discourage you from contravening the "safety measure" it adopted in response to the accusations made about you. If it turns out that the company fabricated any false accusations it divulges, though, then you could sue the company for torts related to --and in addition to-- its defamatory falsehoods. So far the information you share here shows no signs of company's involvement in inventing the false accusations. What legal options do I have here? You need to ask the company for source and details of the information. In line with this comment, you should also ensure the company is aware of the mistaken identity. If the company declines to listen to you --and ideally see any proofs you have--, that could evidence some sort of tortious conduct on the company's part. Beware that in Florida a defamed person is required to demand a retraction of the false accusations prior to filing a defamation suit. Absent that request for retraction, it will be very easy for the sued defamer(s) to have your complaint dismissed. If the company refuses to disclose the source of the false information, then you need to seek injunctive relief in court. That means suing the company so as to (1) compel the company to identify the person(s) who accused you, and perhaps (2) strike the ban that the company put in place as a result of the false accusations. Even if you don't prevail in striking the ban, the court proceedings would give you the occasion to set the record straight and prevent the company from defaming you if you legitimately expose (to the public) the arbitrariness of its ban. To be clear, the company can always indulge in defaming you for the sake of justifying its ban, although that would be dumb in light of what you will have proved in court by then. In jurisdictions where a request for retraction is not mandatory, a plaintiff who does not know the identity of his defamer(s) may (1) file suit against "Doe defendants", (2) subpoena the non-party company so as to obtain records related to the false accusations (obviously ensuring that these reveal the authorship thereof), and (3) upon production of subpoena records and requesting the identified defamer for a retraction, amend the complaint to properly identify the defendant. This would be more efficient than filing two suits (one for injunctive relief against the company, and another against the defamers). However, I am uncertain of whether this would work in Florida, given its pre-suit requirement of request for retraction.
There are no laws requiring that any company must publish all opinions from its customers. I'll admit it's fundamentally dishonest to only publish the positives, but there's no prohibition against it either. Look at movie advertisements, for example. They'll paraphrase or selectively quote a review, citing only what seems to be positive, yet if you read the review and quote in context, you'll understand the review quite differently. How exactly would you police it if you were to require companies to publish all reviews? Would you have some kind of litmus test to determine whether the critique is justified and fair? How often do people post false reviews (good or bad), and how would you account for them? Company web sites offering reviews form their own customers are doing nothing more than using the web as an extension of their marketing, so one has to expect some manipulation of the information in order to present products and services in their best possible lights. Why, for example, would I tell you how much someone hates my product when my goal is to sell it to you? This is why it would be better to use independent third-party review sites that have no dog in the hunt when it comes to honest feedback about the companies they cover.
While not categorically illegal, there is a risk that using a trademark in an email name is something that is being done with a purpose to defraud people into thinking that you are affiliated with that company (and indeed, such emails are frequently used for that purpose as are misleading domain names). So, while it isn't outright forbidden, it is generally unwise.
If a data controller fails to fulfil your data subject rights, lodge a complaint with your data protection authority. In Hamburg, the appropriate form is here. However, they are not required to investigate your complaint. Independently from a complaint, you could consider suing Wordpress for compliance – Automattic has a subsidiary in Ireland so this might actually be feasible. I'm not quite sure though that Automattic is indeed the data controller for wordpress.org, as opposed to the .com domain – the privacy policy isn't quite GDPR compliant. While your GDPR Art 17 Right to Erasure might not apply in this case, there's a definite GDPR violation because the data controller failed to respond to your request within a month as per Art 12(4). That your posts on the bugtracker were deleted doesn't look like an issue in this context, what does matter is that they didn't respond to emails to the addresses mentioned in their privacy policy. Whether you have a right to erasure depends on the legal basis for storing your data. In general, you have a right to erasure if: the data is no longer necessary; processing is based on consent (because you can always withdraw consent); or processing is based on a legitimate interest and they have no overriding legitimate grounds to continue processing despite your objection (Art 21). The data is still necessary to identify you for your actions on the bugtracker, but depending on your particular situation you may be able to object successfully and force them to anonymize your posts.
When someone registers at your website, they enter a contract with you. You need an email address, because you need to be able to contact them (at least for the password recovery). You probably want to verify the email address, otherwise you might not be able to contact them in the future. So the email verification is required as part of the performance of the contract. But also anti-spam laws might require you to use confirmed opt-in before you are allowed to send automatic emails. So at least Article 6(1)(b) (performance of a contract) would apply, but for the confirmed opt-in also Art. 6(1)(c) (compliance with a legal obligation) might apply. That means sending the verification mail is lawful. However you probably want to write this down in the privacy policy as Greendrake commented. Note that there must not be an option for users to agree with the privacy policy, it is just a statement which you make.
No AFAIK there is no such legal requirement. Why this company told you there was I can’t speculate. But I will. There may be under contract with MicroSoft to put their OS on every box they sell - that would be a legal requirement. Or the just don’t sell boxes without this and they employee told you it was a legal obligation to get out of the conversation.