HOA creating accounts on a third-party website without my consent This question is in regards to a situation in Colorado in the US. I began receiving emails from a website distributing community information. The emails did not have an unsubscribe link so I sent them an email asking to be removed from their listing. They told me I had to create an account and change my preferences to not receive emails. I informed them that I did not authorize them to have my information and they told me my HOA signed me up. As a technical person I then asked them a bunch of questions regarding the data and how it was transmitted to them. They told me that the HOA creates the accounts manually. This seemed very wrong to me so I contacted the HOA and they told me they only created the accounts using publicly available information. I did not want to get into a fight with my HOA until I understood the possible ramifications of what they had done. Does this break any laws in how they created these accounts without my permission? edit.. I received a list of fields that they use to create the account. Those fields are Name, Address, Phone Number and Email. I guess my hangup with this is not that I was receiving the emails but that they created the account without my permission even if the data was mostly publicly available.
Colorado HOAs are required to make many kinds of documents available to HOA members. The Colorado Common Interest Ownership Act (CCIOA) includes the following language in section 38-33.3-209.4. Public disclosures required It is the intent of this section to allow the association the widest possible latitude in methods and means of disclosure, while requiring that the information be readily available at no cost to unit owners at their convenience. Disclosure shall be accomplished by one of the following means: posting on an internet web page with accompanying notice of the web address via first-class mail or e-mail; the maintenance of a literature table or binder at the association’s principal place of business; or mail or personal delivery. The cost of such distribution shall be accounted for as a common expense liability. If the distribution includes information the HOA is bound to share to you, and this service is at no cost to you, it would appear on the surface of this law that the HOA is afforded the &quot;widest possible latitude in methods and means&quot; of disclosure, and that they have exactly performed &quot;posting on an internet web page with accompanying notice of the web address via ... e-mail&quot;
According to this article, the Malmö Administrative District Court found that the intent of the user is immaterial to whether a camera is being used for surveillance, so even if that is not why you are doing this, it counts legally as "surveillance". The law requires a permit from the länsstyrelse (county? government), according to the Kameraövervakningslag (2013:460) (article 8 states the requirement for permit, art. 16 tells you who to apply to). I believe that a tennis court would be considered a "public place", even if privately owned. Art. 17 tells you what goes into an application (there is probably a form), and art. 18 says that the kommun gets to weigh in. Presumably it would be critical to have a consent form signed before any recording happens, and you would include that in the application.
Residents agree that the receipt of mail by any individual not listed as a Resident or Occupant in this Agreement at the Leased Premises shall be proof of occupancy of that individual and a violation of this Agreement. I assume that the lease states that only the listed individuals can reside in the unit. Maybe they think that this says that receipt of mail by an unlisted person is a further violation of the lease, I don't think that is clearly enough stated that the courts would agree that receiving mail is itself a violation of the lease. Instead, it seems to be intended to say something about an existing clause – you can't have other people living there. The courts would look at the requirements of the lease, and ask "did you comply"? The question of whether you did a certain thing is a question of fact that has to be resolved in court. However, the revised lease language does not state that all mail must be addressed to Johnny Johnson – it only addresses receipt by a person not on the lease. You are (apparently) on the lease, so you may receive mail there. Nothing in the lease controls how such mail can be addressed. If you receive mail addressed to Tommy Thompson, your defense is that you received the mail, and you are on the lease, so you will not have violated the new clause.
You're misreading the law. You need to keep reading the section you referenced (emphasis added): The disclosure...shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business Thus, the option to have the disclosure sent by mail only applies to consumers who do not have an account with the business. Since presumably a large number of sites only maintain personal information for users with accounts, such sites need not provide a mail option. Further, it doesn't say there needs to be a button: you just need the ability to say you'd like it mailed to you in the request somehow, and then they need to comply when you do.
We cannot dispense personalized legal advice: that is what your attorney is for. However, I agree with your analysis that this is most likely covered by fair use, and indeed it is not obvious that you have taken anything that is protected. There is no creativity behind a number such as entries in the &quot;I did N pushups&quot; column. The arrangement of data into a web page passes the smidgen of creativity test, but &quot;210&quot; is not a creative number. The terms of service of a website cannot negate your right to use the website however you want in a non-infringing way. If your use is &quot;fair use&quot;, then they can't tell you that you can't use it. In case it turns out that &quot;fair use&quot; fails, the matter would hinge on what exactly the TOS says. They may have granted you permission to make use of their &quot;information&quot;. So there are three positive avenues for you to consider: not protected, fair use, and permitted. A practical difficulty is that a university lawyer is only interested in the interests of the university, and they are as likely to say &quot;don't do that&quot; or &quot;get permission&quot; as they are to say &quot;that is fair use&quot;. You can hire a lawyer who is paid to care about your interest, though there is never a guarantee that the lawyer's advice is correct. I think it is likely that the lawyer will tell you to not say anything until legally forced to, given the apparent rebuff of your request for special permission.
It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR) The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person. There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability. To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used. You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent. So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear. Some previous questions and answers here on law.se dealing with GDPR consent that seem possibly relevant: User consent required under GDPR What provisions should I make regarding GDPR consent when users do not sign themselves up? GDPR - Withdrawn user consent Opt Out Consent under GDPR
Desuetude is the Latin word. https://en.wikipedia.org/wiki/Desuetude Typically there is more to it than just that there was no enforcement for a while. It usually occurs when prosecutors agree not to prosecute and judges don't punish or punish harshly for it. Normally an HOA is just rules for your apartment building and not actual laws so it would not apply there.
Sorry, what did I agree to? NDA means New Drug Application, right? Or is it Notre Dame Academy? Maybe it's Nebraska Dressage Association - don't want to cross those guys, their horses are mean. When you are trying to form a contract with someone, it's very important that you and they are talking about the same thing. What can't I disclose? That I had a phone call? What I said? What you said? Only the confidential bits? If so, what are they? Can I tell my business partner? My lawyer? My secretary? The IRS? Another important thing about making a contract is to agree on the terms. Post-facto contracts are not a thing After you paint my fence, you can't demand payment. We have to enter into a contract before the thing that happened happens. Elements of the call might be confidential anyway I am bound to respect confidences that were entrusted to me where a) the information is confidential b) it was imparted to me in a situation of confidence and c) disclosing it would cause harm. We don't need a Non-Destructive Analysis to document that.