Can it be illegal to have/use a &quot;wipe data&quot; login on your device? Suppose I have a computer and I set up two logins that are identical other than one sanitises my data SSD upon logging on. This would cause any information I have on said drive to be inaccessible to anyone. Have I committed any crime? Assume the data itself is legal, and is not evidence of a crime I have commited. An important use case of such a tool would be reporters who may have evidence of crimes they are investigating. If that changes the situation that should be mentioned in the answer. Suppose someone verbally requests the login credentials of the computer, and I provide the sanitising one which they proceed to use. Have I committed any crime? Any jurisdiction would be relevant, as would any values for the &quot;someone&quot; above (such as employer, police officer, border agent). Cases where such a question would be particularly relevant seem to occur at borders in particular, with examples in the USA, Canada and most recently in the UK. So I can be specific about what I have done I have used the example of a general purpose computer, but I assume the same thing would apply to commercially available tools.
canada If this is done with the specific intention of obstructing justice (see R. c. Charbonneau, 1992 CanLII 2979 (QCCA)), then this is an offence contrary to s. 139(2) of the Criminal Code. The offence is not dependent on the deleted evidence being evidence that would have been used against the deleter. Every person who intentionally attempts in any manner other than a manner described in subsection (1) to obstruct, pervert or defeat the course of justice is guilty of [an offence]. A couple of examples: In R. c. Renaud, 2019 CM 4021, the accused had asked someone to delete photographs and texts off of their smart phone. He was found not guilty on this charge because the mens rea was not proved. In R. v. Subia, 2022 ONSC 1693, the accused admitted that he used specialized software in an attempt to delete traces of evidence (images) from his phone. He was found guilty of attempted obstruction of justice.
Yes, their waiver has no legal basis and is invalid under the GDPR. They should have hired a better lawyer. GDPR rights cannot be waived (mrllp.com). The last bit should have been: Therefore, in consideration of my participation in any project, I understand that retaining my name and email address, as described above, does not require my consent and that the right of erasure, as spelled out in the GDRP Article 17 (1) b does not apply. The legal basis for our lawful processing of this personal data is Article 6 (1) f ("processing is necessary for the purposes of the legitimate interests pursued by the controller"). I.e. there is nothing in the GDPR that compels GitLab to erase this information, but their waiver is bogus. Keeping track of individual contributions in a software projects is necessary for a number of reasons, including security (if somebody contributes code that jeopardizes security, you want to audit everything that person has contributed).
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
This question really depends on the specific countries involved, as all law depends on jurisdiction. However, there are essentially two ways that breaking into foreign computer systems could be illegal: 1) Your own country has laws against hacking that include hacking into foreign computers or 2) The country you're breaking into has laws about hacking that are not limited to citizens. In the first case, your own country would find such "hacking" illegal; in the second, your target country would find such "hacking" illegal. If you violate the first, which is the less likely option, you could be traced, located and prosecuted by your own country. If you violate the second, which is the more likely option, the target country would target you for extradition and prosecution. Depending on the amount of political power your target country has, this could result in you being shipped off to another country to face their courts, without the protection of your own country. In other words, it could very well be illegal, though the specific sentence resulting from such a crime is far too specific to even attempt to address in the general case.
Intentional sabotage of a TSA computer system is almost certainly a serious crime and would also almost surely give rise to civil liability, although you might avoid both if you warned the TSA that the phone was set up to intentionally break their system, in which case it might be confiscated as contraband. If the product had a "feature" unknown to you and that you had no reasonable reason to know of that caused the harm, you would ultimately have no criminal or civil liability, although the manufacturer might be strictly liable to the TSA under a product liability theory, and you would probably be detained as a witness to figure out what happened. If the product had a "feature" that broke the TSA computer that could be de-activated and that you meant to de-active but carelessly failed to, you would have negligence liability to the government and might or might not have criminal liability (I'm not enough of an expert in the relevant statutes to know). You might be liable for a strict liability Federal Communications Commission offense for having a device that is in violation of their regulations.
Generally speaking, what isn't illegal by law is legal. It's possible for law enforcement agencies to share crime rates, maps, and their data, but within any laws regarding access and sharing of that data. Such crime data may be publicly available, but that depends on local and state laws. The local or state agency would have to enter into a legal licensing agreement - if local and state laws allow such sharing - with the GPS company to provide the data, update it, and reasonably assure that it is accurate. The more realistic reason GPS systems might choose to not show crime data may be public relations. If a GPS user lives in an area that has been objectively identified by data as having a higher than baseline crime rate, i.e. for carjackings, that user may not be very happy with that designation. Worse, what happens to public relations when data errors show an area is wrongfully identified as high crime? What kinds of lawsuits could result? Real estate agents suing since bad data from a GPS unit soured the sale of a house?
Is this legal? Yes Or does it mean that employee will be in breach of his/her contract? Yes You are assuming that if the evidence is allowed to be presented then that automatically means that keeping it for that purpose is not a breach of the contract. This is not necessarily so; it can be both at the same time. That said, it is unlikely that an employer would attempt to sanction an employee for this as the courts would (rightly) see it as an attempt to pervert the course of justice. As in most things in the law it is possible for all parties in a matter to be on the wrong side of it. If you want to come to the tribunal with "clean hands" then the best thing to do is make a record (not a copy) of the relevant documents and return then to the employer. Before going to the tribunal get your solicitor to subpoena the documents that you want - they will have to produce them and you have them without breaking your contract.
You quoted the definition of personal data from Art 4(1) GDPR. This definition of identifiability is further explained in Recital 26: […] To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. […] If the user ID is unique, then the hashed user ID will be unique as well. Thus, the hashed ID will enable “singling out”, and would still count as identifying in the sense of the GDPR. You also claim that there's no way to reverse the hash. This is not quite correct. Assuming that the hash function itself is secure, then the only way to crack the hash is to brute-force the input. The difficulty of brute-forcing depends only on the entropy of the input data, not on the size of the output hash. It is thus comparatively easy to crack hashes of short low-entropy strings like sequential integer user IDs, IPv4 addresses, or weak passwords. In contrast, it would be difficult to crack long random user IDs, such as UUID version 4 identifiers created from a cryptographically secure RNG (CSPRNG). Even if the hashes can't be cracked, they are not anonymous – you can link them to the original user ID, after all. The GDPR only considers data anonymized if there are no “reasonably likely” means to re-identify the data subject. If this de-identification is reversible, it's called pseudonymization instead. If storage allows, a better technique to generate pseudonymous IDs is to create a table that maps the true ID to a CSPRNG-random ID. Unlike a hash, the random ID cannot leak extra information about the original ID. This pseudonymization technique could perhaps also be turned into irreversible anonymization by deleting the ID mapping, assuming that no “singling out” can happen. Pseudonymization is a very good security measure. It is explicitly mandated whenever appropriate in Art 32 GDPR. So you should probably use it. It's just that GDPR continues to fully apply to processing of the pseudonymized data. Since the pseudonymized data is the data subject's personal data, you may be required to delete it when receiving an Art 17 request for erasure. You may also be required to forward the request to others with whom you shared the data. However, the right to erasure has many conditions and exceptions. If you actually need to keep the data for a particular purpose, chances are good that you can keep it.