Are Discord bots allowed to store deleted messages and let people view them? There are many Discord bots around which look at messages sent by users, but are they legally allowed to store messages in files, and even store messages which were since deleted by the users who sent them? I'm asking this question because my friend recently built a Discord bot which does just this. It includes a command (showlog) which sends some of the log in Discord. For example, this is some of the data which that bot recorded: BubkisLord - yeessss (Official Year 9 GATE - spam) BubkisLord - ahahaha (Official Year 9 GATE - spam) BubkisLord - showlog (Official Year 9 GATE - spam) BubkisLord - MAUH HAHAHAHAHAHA (Official Year 9 GATE - spam) BubkisLord - yeyesss (Official Year 9 GATE - spam) BubkisLord - showlog (The Server Of Bubkis - 🙂-general) Spock - ? (The Server Of Bubkis - 🙂-general) BubkisLord - showlog (The Server Of Bubkis - 🙂-general) BubkisLord - good (The Server Of Bubkis - 🙂-general) Anyone in the same server as the bot can view the log. Another one of our friends asked a question about whether it was actually allowed to store the deleted messages of users, and that got us confused. It might not be allowed, because if someone chooses to remove their content, it shouldn't be easily accessible to everyone, and it especially shouldn't be accessible to everyone in any server which that bot is in. But I skimmed through Discord's Terms of Service, and the Discord API Developer Policy, and could find no reference. Is it allowed? Is it not? By the way, all people affected at this point in time are living in Australia (specifically, Western Australia).
It may be legal or it may not For example, if any of the users are in the European Union, then the GDPR applies and the person storing the information is a data controller and has legal obligations. These include, having a legitimate reason for storing them, storing them only for as long as necessary for that reason, notifying the individuals that the data is being stored and why, deleting it upon a users request etc.
united-states Messaging (and other online communication) are fixed media. A face-to-face conversation, or a telephone call, does not exist at all - except in the mental recollections of the participants. And those are always very problematic as evidence, because people's recall is inaccurate. Whereas communication in a fixed medium is durable: a newspaper, a sound recording, security camera footage. It stands on its own and can be examined by experts. What catches a lot of people off guard about the Internet is they are mostly fixed media. Prior to the Internet, investigation of harassment almost entirely depended on anecdotal evidence. It was difficult to prosecute cases which were entirely based on the victim's word. The closest any of this came to objective evidence was a polygraph, and that wasn't reliable. Of course we want bona-fide victims protected, but what keeps a malicious actor from putting someone else in jail with words alone? Now with the Internet, much of the evidence is rendered in fixed media. This is a &quot;breath of fresh air&quot; for such prosecutions! However, just like any other physical evidence, it must be brought into evidence by the testimony of persons, and that testimony gets to be cross-examined. And this is where your concerns about provenance get addressed. A party will assert that the messages are forged, and that will be examined. The validity of evidence is itself on trial. There are two evaluations: first whether the evidence is even valid enough to present to a jury, and evidence that makes the cut is then examined and cross-examined in front of the jury. Keep in mind that contrary to TV drama, there's no &quot;surprise evidence&quot;. Almost any evidence - and certainly ALL evidence in a fixed medium - must be shared with the other party long before trial. Pre-trial, it will be challenged, the phone/device subpoenaed and turned over to experts for analysis. If it is evident that the party &quot;has conveniently deleted or lost&quot; the material, the evidence will be thrown out. And if the party is proven to have falsified the data, they're in much worse shape. A lot of chat services keep chat logs on the server/cloud, in the clear. Getting those is as easy as subpoenaing them, and that will be a canonical answer because the ISP would have no reason to lie. For a service where chat logs are kept in the clear only by individuals who choose to keep them, then &quot;reading those logs into evidence&quot; will involve a cross-examination of the parties involved as to their honesty and motivations. I don't know what and how WhatsApp stores when they log chats, so I don't know if there's any cryptographic information there that could be authenticated. But certainly if &quot;he&quot; presents one chat log, and &quot;she&quot; presents a different chat log, then we're clear around to &quot;he said, she said&quot;. But all of it together can be examined. For instance, linguists can look at other chats, discern the writing styles of each party, and then look at the disputed lines and examine who is more likely to have written those. And they give testimony on that. So it is evidence, but it gets two rounds of possible challenge: First as to whether the evidence is reliable enough to even present to the jury, and then experts testifying in front of the jury their opinion of its reliability.
In my opinion, you are totally free to publish the information. There are two areas of law that can be cosidered - private and public law. In the private law area, you can be liable for revealing trade secrets, but only if you agreed to keep them by a contract. Trade secrets do not exist by themselves (there are minor exceptions, eg. in competition law, but those do not concern us), they must be protected by contracts. Another private limitations, like libel laws, won't apply here. This is not uncommon, but not in cars - you can find clauses like these in software license agreements. Then there is the public area. Is there any regulation, any policy of the state, that prevents you from publishing it? I am not aware you whole legal code of your state, but I doubt there is. It would be a harsh limitation of freedom of speech. Even if the modification could lead to illegal effect (like, modifying toy weapon to kill by rising its power...) it would be only illegal under very rare circumstances. To conclude it - freedom of speech can be limited only if there is sufficient public interest to do so, and I don't see any.
First of all, although the GDPR is stated to apply to any site which processes the data of any person who is in the EU, it is not clear how a site not located in the EU, does not business in the EU, and does not primarily target EU residents as its audience can be required to comply with the GDPR. To the best of my knowledge, no such case has yet been brought, much less decided. There has also been some debate on whether an IP address constitutes Personal Data under the GDPR, and if it always does so, or only under particular conditions. The European Court of Justice (ECJ) held that (under the predecessor Directive 95/46/EC) that a dynamic IP address was personal data. But in that case the web site was run by the German Federal Government, which surely has wider scope for getting info from a German ISP than a small private US web activist does. There is not yet any case law that I know of on the applicability of the GDPR to IP addresses in any case at all similar to the one in the question. Joe would in my view be wise to at least learn that logs are being kept, and post a disclosure of this on the site. Whether Joe needs to do more than that is less than clear at this time.
You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine. It is also curious that you are using consent as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that legitimate interest would be a much more straightforward approach in your case.
&quot;Botnet&quot; refers to an illicit collection of remotely-controlled computers taking commands from a C2 (Command and Control server) and is thus by definition always illegal. However, there is no law against releasing or using software which accepts commands of various types from a central server, and this is quite common for remote access tools, as long as the user consents. It is only called a botnet if the users do not consent to its presence. If they do consent, it's not a botnet. One example is DarkComet, which includes features such as remote file editing, screen viewing, and keylogging. All of these features have legitimate uses, and a network of computers controlled with this software would not be considered a botnet unless it was created illegally in the first place. It's like the term &quot;battery&quot;. Battery is never legal, but that doesn't mean that boxers are breaking the law by participating in that sport and punching each other. If you consent to being punched, then it's not battery. Likewise if you consent to running a remote access tool, it's not a botnet.
Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions. Personal data from users/customer is carried for lots of reasons, not just marketing. What if you're asked to delete data that is needed to bill customers, information that may be relevant to a legal case or information that needs by law to be retained for the purposes of audit? GDPR does not make it illegal to carry personal information, it simply needs you to justify why you are keeping the information - inform the named person about this and provide them with a timescale for deletion. For example if you are required by law to store a record of emails to document the work done, but the user asks you to delete that information. You would be entitled to keep that information but only for the purposes of maintaining that audit trail. You would delete all associated customer data that was unnecessary such as CRM info, payment details etc.. but could keep the audit trail. The proper way to respond to the user's deletion request would be "your data will be kept in a secure server for the purposes of maintaining an audit trail for x amount of time. Once this time has elapsed it will be deleted. If you are unhappy with our use of this data please contact our data officer". GDPR isn't designed to catch you out - if you have a legitimate reason to keep that information then you are entitled to. The law was designed to stop marketers and advertisers hoarding huge amounts of information, as well as undermine Google/Facebook's duopoly on our personal information.
You are right that a visitor of a website does not expect to be tracked upon opening the website. But when using Google Analytics configured in the way explained in my other post, the visitor is not tracked. At least not in a way which violates the GDPR. You worry about the cookies. I also found this article which also does and suggests to either: change the _ga cookie to a session cookie, so it will be removed when the browser is closed. To do this, set the Cookie Expiration variable in your Google Analytics Settings to 0. completely disable cookies. (GA does not require cookies). To do this, set the storage field to none: ga('create', 'UA-XXXXX-Y', { 'storage': 'none' }); If you do not disable cookies, cookies can be used for tracking, which is more general defined in the GDPR as profiling. Profiling is defined in Art. 4 GDPR as: ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; Art. 22(1) GDPR disallows profiling. Therefore in the settings menu from Google Analytics you have to disable data sharing and data collection. So data will only be used for the analytics function. But because you have configured to Anonymize your visitors IP Address, the part of the IP address used for this, is no longer considered personal data. This is because approx. 250 other users share the same part of the ip address which is stored, so data is not distinguishable between those 250 users. The anonymisation used by google is currently considered good enough. At least by the Dutch DPA. This might change if someone proves it is not good enough anonymized. Note that I am not a lawyer either, but I have read from multiple experts that analytics can be a "legitimate interest", the same way marketing can be a legitimate interest. This way configured the privacy impact is considered very low. It is also very important to note that a DPA consideres GA Google Analytics compliant. Even if a court would not agree in the future, you are acting in good faith if you follow those instructions, so you will probably not be fined. The DPA does currently not suggest to change the _ga cookie to a session cookie, or disable cookies completely. Note that the GDPR does not require doing anything to make it technical impossible to track someone. If a website has access to the data to track someone, but "promises" not to do that, that is fine. And rules regarding the usage of cookies in general, is not part of the GDPR, but (currently) part of the ePrivacy Directive. Only the way to ask for consent for storing cookies is defined in the GDPR.