Facial Recognition Data of Minors I have a cool app a couple of high school librarians use. It's pretty simple: students scan their IDs when they enter and leave the library. Librarians then can then see who's in the library at any given time via simple dashboard. Student usage is then stored and is downloadable by the librarians should they want a report. I'm interested in adding a facial recognition feature to my app because I'm interested in machine learning. The idea is to replace card scanning with just looking at a camera. To do this, I'd have to train a model with the faces of the students. I was thinking of creating a webapp that allowed students to submit photos of themselves should if they're interested in the feature - otherwise they can keep card scanning if they want. Considering that they're all under 18, do I need parental approval if the students want to submit their own photos? Who else should I contact to get approval for such a feature? Other potentially relevant details: Currently the app tracks ~200 unique students per day, but has ~5000 students in it. I own the physical server that the webapp and proposed facial recognition feature would go on. I also have librarian approval for this feature. The high schools that use this app are in Washington state.
If you were doing this independent of the schools, you don't need parental permission as long as you're complying with COPPA rules, the most important part being whether the site is directed to children under age 13. If you are asking for the sanction of the school, you need to comply with the school's policy. The Washington law regarding student privacy are here. You would need to comply with the law regarding securing and disseminating such personal information – I assume that you do that. RCW 28A.604.030 addresses consent: you may do this "with the consent of the student or the student's parent or guardian". The school would also have to approve of your idea in order for it to be practically implementable – you can't force them to use your program. You would need to persuade them that they are not at legal risk in adopting your system, and also that the system distinguishes identical twins Dana and Donna.
This question needs more detail. As a cybersecurity professional I can provide some technical context around what I believe to be the situation. While I do not know the legal precedence, technically, IP addresses cannot typically be attributed to an individual person. There are a number of reasons for this. In a local network, IP addresses are not unique. Rather, they are distributed by the DHCP server, and are reassigned at intervals. Forensic attribution to an individual in most environments would require a DHCP log linking the IP to the machine’s MAC address, with time stamps that correlate to the individual’s logon to that machine at the same time. If the IP correlation involves a VPN, it gets more difficult. I would need to know where the log/evidence was obtained to determine what the IPs in question actually correlate to. If the evidence was obtained in local area network of the suspect, the IP addresses are likely assigned by the DHCP server (see previous). If they are obtained after encryption in transit to decryption, then very little can be determined. If they were obtained at the VPN server log, these IPs likely belong to an ISP which in turn may or may not be able to show what machine initiated the conversation. Digital photos often contain EXIF data, which is metadata about the photo. This data can contain details like, device make and model, sometimes location, time and date... If the defendant owns a Nikon such and such and the photo was taken with a Nikon such and such, and was uploaded using a VPN the defendant has an account with, and the defendant was in that location at the time and place of the photo... there may be enough there... but I’m not a lawyer. I believe the discovery should include any EXIF metadata and logs to be used as evidence. You may need a special technical whiteness to educate the court on what can and cannot be determined (technically) given the evidence. Things to consider for such a witness could include: EXIF, forensic certification, network administration experience, VPN, TCPIP, OSI Model, Network Address Translation (NAT). Again, nothing here should be considered legal advise. Seek professional legal counsel.
british-columbia I am not aware of any judicial consideration of this issue. The Liquor Control and Licensing Act, s. 78(1) says: A minor must not, except as provided under this Act or unless the minor does so with other lawful excuse, ... consume liquor. (One of those exceptions are when the alcohol is supplied by the minor's parents, spouse or guardian in a residence for consumption in the residence. There are other exceptions, too. But I'll assume you're asking about a circumstance where no exception applies.) The Liquor Control and Licensing Act defines a &quot;minor&quot; to be a person under the age of majority established by the Age of Majority Act, which is age 19 today. The Liquor Control and Licensing Act, s. 57 makes it an offence to contravene s. 78(1). The Interpretation Act, s. 25.1 states that &quot;A person reaches a particular age expressed in years at the beginning of the relevant anniversary of the person's birth date.&quot; The Interpretation Act also clarifies that the reference to time &quot;is a reference to Pacific Standard Time&quot; (or Pacific Daylight Saving Time, when it is in effect). Thus, a person is a minor until &quot;the beginning [in Pacific time] of the relevant anniversary of the person's birth date.&quot; It is most clear in relation to the identification requirements when selling to a minor, but the Regulations (s. 158) refer to the date of birth as displayed on the person's identification card. This all suggests that when consuming alcohol in the greater Vancouver area, a person just about to reach the age of majority must wait until the date in the Pacific time zone is that which is displayed on their identification. Or barring any identification, until the date in the Pacific time zone is the date that is the person's birth date.
Obtaining consent for cookies is not required by the GDPR at all. Instead it is covered by the e-privacy directive, which as a directive rather than a regulation, must be implements by specific legislation in each individual country. The exact requirements vary with the law of each country. An e-privacy regulation has been proposed, which would have scope similar to the GDPR, would replace the Directive, and would not require national implementing legislation. However it has not yet been adopted. Proposed versions have significantly different requirements than the current Directive. Nor does the GDPR require consent for advertising that does not involve the processing of personal information, unlike some other privacy laws such as the California CCPA. However, if the Google package sets cookies without consent that are not strictly necessary for operation of the web site, it might well fail compliance with some of those national laws implementing e-privacy. Also, even necessary cookies must be disclosed to the user, as I understand it, possibly only in general terms. Several national Data Protection agencies have said that cookie compliance is not a major priority, at least not until an e-privacy regulation is in place. But that does not mean that lack of compliance is legal. Unfortunately I see no way for a developer using the Google package to correct this issue within the package. One would either have to implement a different solution, or trust that Google will fix this before enforcement becomes a serious issue. However, the app developer could add a separate general cookie consent banner, and turn off all adds if consent is not given, I believe.
You generally can request data for free, but keep in mind that the Act does not require every set of data to be published or released. For instance, it applies only to data that is subject to release under the Freedom of Information Act. This means that it has no effect on the Delaware Business Search database, because that data is not controlled by a federal agency, and therefore not subject to FOIA. There have been requests for bulk access to this data in the past, and as far as I know, they have all been rejected. Given the state's economic reliance on its very sketchy business laws, I would but expect that to change any time soon. You would suddenly have journalists and the like scouring the database making all sorts of connections and uncovering all manner of unsavory activity, and no one in a policy making role wants to have to deal with that.
The problem is that open source licenses incl AGPL have legal force because copyright prevents copying + modifying software by default (software is treated as a “literary work” and therefore enjoys copyright protection). But copyright on datasets and ML models is very different – if it is even recognized at all. Thus, similar copyleft techniques would only work in particular jurisdictions. For example, the EU recognizes “database rights”. A copyleft license that accounts for this is CC-BY-SA-4.0, meaning that in an EU context, databases based on the original database would have to use the same license. However, database rights are not recognized in the US (facts are not copyrightable, and the “sweat of the brow” doctrine is not recognized). Thus, the CC-BY-SA-4.0 license would not have any copyleft effect with respect to databases in an US context. Independently of copyright in the database as a whole, the data in the database might be copyrighted material, for example if the database contains text or images, complicating matters further. Machine learning models derived from a data set are much more difficult. Clearly, ML models that have been trained are not a creative work and are therefore not eligible for independent copyright protection. At most, it can be argued that the model is an automatically transformed version of the input data, so that copyright in the input data implies copyright in the model.1 Perhaps hyperparameter choices could reflect some creative input. This is very much an active topic of debate. Given this uncertainty, it would be impossible to create a public license that works reliably. 1. An interesting discussion topic is the potential effect on Microsoft's Copilot ML model which was also trained on GPL-licensed source code. Instead of deriving force from copyright law, it would be possible to impose conditions via a contract, i.e. EULA-like terms that only provide access to the material after the terms have been accepted. But again, this is difficult. Contract law differs wildly between jurisdictions. For example, a contract is defined by the “meeting of minds” in some jurisdictions; by offer, acceptance, and consideration in others. But how does such a contract ensure appropriate consideration? How can acceptance be ensured if the material is publicly available? For these reasons, I think that unless broad international agreement emerges about IP protections for machine learning models, such a copyleft system for ML models is impossible. It is worth noting that the lack of such protections is probably quite good for innovation and research, since researchers are free to improve each other's work without legal concerns. The idea of copyleft is a hack to subvert the “everything is forbidden by default” system of copyright, but “everything is allowed by default” might be better.2 2. To continue the Microsoft Copilot example: some copyleft advocates like Bradley M Kuhn are sceptical about Copilot's GPL compliance, but remind us that copyleft maximalism means copyright maximalism, and that this is not the goal of open source. https://sfconservancy.org/blog/2022/feb/03/github-copilot-copyleft-gpl/
One way in which it holds legal water is that if you use the website in violation of the terms, then you may forfeit your right to take civil action against the company. Analogous language especially regarding the age of the user may protect the site against actions by third party governmental entities (COPPA-like laws), though nothing patently obvious springs to mind (insofar as this deals with firearms and there is also an age 21 restriction both on the web site and in terms of US firearms law, this is not a totally crazy idea). The citation of 18 USC 1030 non-probatively points to an issue which may be disposed of by SCOTUS in US v. van Buren, that knowingly violating the terms of service is a crime (a proposition rejected by lower courts, see US v. Valle). Facebook v. Power Ventures in particular clarifies how &quot;being put on notice&quot; may make such unauthorized access indeed &quot;unauthorized access&quot; in the statutorily-relevant sense. This does not prevent a legally-authorized law enforcement investigation, pursuant to para (f), but if the &quot;violation of TOS = unauthorized access&quot; theory is upheld, it limits how LEOs can legally access the website (and the limitations extend past LEOs). It is a separate and potentially interesting question whether there actually are any legal limits on the investigative powers of the government – if any law enforcement officer has the liberty to investigate anyone they want, with no supervision or requirement of justification, then this would be a rather gaping loophole in their legal strategy. Web pages involve massive copying of copyright-protected data, and the function of terms of use is in part to conditionally grant access to that copyright-protected content. When a person copies protected material from someone's web page having been explicitly denied permission to copy, they run the risk of an infringement lawsuit.
The "Privacy Rule" (45 CFR Part 160 and Part 164, Subparts A, E) don't forbid this. Sect. 164.502 states the general rule: (a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter. "Health information" is defnes in part 160 as any information, including genetic information, whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. Your picture would not constitute health information (and anyhow, they are allowed to gather health information, just not freely disseminate it – the pictures on the wall were presumably with permission). There is no general law (which would be state law) against taking a person's picture (though commercially exploiting someone's picture would require permission, via the concept of personality rights), and it is directly required in a number of instances (for identification purposes – school ID, driver's license, passport, voting in some states). It is an unusual requirement and since they scanned your driver's license it is especially inexplicable. Assuming that this is just a story they tell all patients because they want before and after pictures (which you would have to consent to, if you didn't already in one of those "sign here" flurries), saying that this is for "security purposes" would be untrue, but I don't think it's actually illegal. Taking but not using a photo would not cause you harm, so if you had let them take the picture, there would not be a basis for suing. If they use it for advertising without permission, that would be a problem.