What makes a shareholder a &quot;shareholder of record&quot;? In public companies filling some reports with the SEC (10K for example), there is a mention of the number of shareholders of record. Example: &quot;As of April 20, 2021, we had approximately 40 shareholders of record of our common stock.&quot; Source: DTST 10K filling A. What makes me legally titled the shareholder of record? B. Is there a minimum equity to be owned to be recognized as a shareholder of record? For example, if I bought 1 stock, am I included? C. Can I view the list of shareholders, or get any information about them, or is it censored?
Companies have a registry of their shareholders. Anyone with at least one share registered in their name is a shareholder of record. However, the vast majority of people who consider themselves &quot;shareholders&quot; aren't actually registered owners of a stock. Instead, almost all public stock in the US is held &quot;in street name.&quot; That means that the stock is formally held in the name of a brokerage. What an individual has is &quot;beneficial ownership:&quot; the brokerage passes dividends on to the beneficial owner, will vote how the beneficial owner tells it to vote, and requires agreement from the beneficial owner before it can sell the stock. To make stuff even more complicated, the broker itself generally holds the stock in street name. Almost all public stock in the US is really owned by the Depository Trust Corporation in the name of Cede and Company (a general partnership of a few DTC officers). The reason public stock is mostly held in street name is efficiency. Transferring the legal owner of a piece of stock is a nontrivial process; until recently, it involved physically shipping stock certificates to the new owner. Even now that stock ownership can typically be transferred electronically, it's much easier to tell Cede &amp; Co. &quot;the new beneficial owner is this person.&quot; Because beneficial ownership is just a contract, you can skip all the formalities of updating the company's official register of shareholders.
This answer assumes Europe as jurisdiction, not the United States. This will vary wildly across jurisdictions, but given that this question is unanswered for two weeks now, I will provide an answer for Europe, specifically the Czech Republic. It will be somewhat different in other states. First, the list of criminal offenses a corporation can commit is specified in the law. It is exactly that, a list. Of the 300 crimes an individual can commit here, about 100 of them can also be done by a corporation. It is hard to discover why these hundred crimes were chosen specifically. Logic used to make this list eludes me. For example, a corporation can commit Rape, but not Murder. It can commit a Terrorist attack but not Terror. It can commit Threatening a public official but not Oppression. I looked through the explanatory notes for the law and I discoved the reason: Strictly only those crimes were created for corporations that were required by higher european law, which only moves the question higher up. I did not look up what the European Parliament had to say about this. There is one crime that was added specifically, later on, to the list, and that is Usury. In principle, all crimes committed by an individual can be done by a corporation, because a crime is considered to be committed by a corporation if the action is done by an employee in the name of the corporation.
Q1. Is there a requirement under GDPR for data processors to disclose sub-processing arrangements and the names of the organisations involved in this? "The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes." -- EU General Data Protection Regulations (GDPR) Article 28 Paragraph 2 This clearly states that the processor would need to make clear that they are subcontracting the services and get permission for this as part of the contract, but doesn't specify whether the subcontractors must be named and identified. Perhaps there is other prior existing subcontracting legislation that requires them to be named? Some procurement contracts as supplied by controllers may specify a list of nominated (allowed) sub-contractors or require the full identification of sub-contractors though I've not found anything in law that requires they be named other than as part of a specific contractual obligation. Q2. Is there a requirement under GDPR for data processors to disclose the country or countries where data is stored and processed? "Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: ... (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. ..." -- EU General Data Protection Regulations (GDPR) Article 28 Paragraph 3(h) This clearly states the data processor must make available to the data controller all details required to demonstrate compliance. It's quite likely larger organisations may choose to make this simple for data controllers by supplying this information in the form of a completed Data Privacy Impact Analysis document. "Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: ... (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; ..." -- EU General Data Protection Regulations (GDPR) Article 30 Paragraph 1(e) This clearly states the data controller must maintain a record of the country or countries involved if any of these are outside the EU, and so this information must be made available to the controller as stated above.
In principle, the data subject's right to access involves a copy of all personal data the controller holds on them. There are no time limits by default. Of course, the controller can ask a data subject to clarify their request, e.g. to focus on a particular time frame. There is an implied time limit though: personal data may only be processed/stored for as long as the data is necessary to achieve the purposes for which it was collected. Afterwards, it must be deleted. A controller with good data management will be able to limit their effort by having as short retention periods as possible for their different records. Furthermore, a lot of data is not personal data, or falls out of scope of the GDPR because it is not processed with automated means or forms part of a filing system. For example, if thousands of old invoices were archived in paper form in boxes that are only sorted by year, there might be an argument that this isn't a filing system in the sense of the GDPR and that a DSAR would not have to involve looking through all the archived invoices (compare also Art 11). In your scenario, there is a clear retention period of six years. You are asking for records about how that data might have been used further in the past. To the degree that such data is actually available, that could reasonably be personal data and should be included in a response to a DSAR. E.g. they might have information like this: “File #1234 was included in a data set that was sold to EvilCorp in 2007. The entries in File #1234 that are older than 2014 have been purged, so we do not know which entries were included in the data set. The current name on File #1234 is Dave.” This information about the sale would be personal data because it relates to you, and you are identifiable. Of course, the controller might not be set up to perform this search unless specifically asked. However, more unspecific information might not be personal data. For example: “About 70% of our files were included in a data set that was sold to EvilCorp in 2007. We no longer have records indicating whether your file was included.” Since there is no link between the sale and your personal data, I don't think it would have to be included in a DSAR response. The primary reason why you should be told about sales of personal data is that per Art 15(1)(c), you should be informed about “the recipients or categories of recipient to whom the personal data have been or will be disclosed” in a DSAR response. So when making a data subject access request, it could make sense to explicitly referencing this paragraph. So you would be interested in receiving a copy of your personal data as per Art 15 GDPR, and in particular any available information per Art 15(1)(c) GDPR about the recipients or categories of recipients to whom your personal data has been or may have been disclosed in the past. Quite likely the response will be underwhelming, e.g. by just giving a broad category such as “potential creditors who are contractually obligated to use the data only in accordance with our policies”. Whether such responses are compliant (I don't necessarily think so) will not be clear until there's a good precedent, and that would require that someone sorts this out in court.
In general the primary purpose of creating a single-owner business entity is to shield the owner from liability. For example, if it turns out that (unbeknownst to you) your necklaces were manufactured with toxic metals then "you" as a seller could face ruinous liability. If "you" is a company, then you as a person might lose whatever value is left in the company, but at least you wouldn't lose your personal assets. There are many other potential reasons to conduct business through a business entity, and many types of business entities constructed and recognized for those purposes; but they are highly dependent on the jurisdiction, entity type, and particulars of the business.
The GDPR's right to erasure just applies in some specific situations. While messages you wrote on Slack are personal data, they are generally also part of a larger discussion with others. If your messages are removed, the discussion becomes incomplete, so that will violate the freedom of expression of those others. Art. 17(3) GDPR provides an exception for the right of erasure in such cases. So basically, whoever is the controller, you probably don't have the right to have your messages to be deleted. However, you would have the right to have your account pseudonymized like Slack replied in the Reddit post you linked to. See also my answer in "Does a user have the right to request their forum posts deleted?". Basically, it is correct that Slack can be just the processor. Even if the controller cannot get access to more than 10000 messages unless they pay. However, Slack is not allowed to do anything with those messages, except when the controller says so. In its Privacy Policy, Slack distinguishes between customer data and other data. It states to be the processor for the customer data, but controller for the other data. Because those are tied together, I am not sure this distinction can be made. If not, Slack and the customer will be joint controllers, but it requires probably a court case to decide on that. For example, the Court of Justice of the European Union has ruled (in the Fashion ID case) that putting a Facebook "like" button on your website, makes you a joint controller together with Facebook. And (in the Wirtschaftsakademie case) that also creating a Facebook "fan" page makes you a joint controller. But neither of those are very similar to the situation with Slack.
There is no law (that I can find) that requires the mason to keep records, and therefore require them to be produced, for work carried out that long ago. I have not been able to locate the applicable legislation for 2006 but, on the (near certain) assumption that it was either the same as now or has been superceded, businesses only need to keep records for 6 years according to the Revenue's section entitled Keeping records: If you run a business, you must keep certain records for tax purposes. Your records can be used to confirm information contained in your tax returns and they should clearly show the accounting process. If your accounts are prepared by an agent or accountant, they may keep your records on your behalf. However, you are ultimately responsible for your record keeping. If you are in a partnership, the precedent partner is responsible for keeping records. You must keep the original of these documents for six years. This retention period is mirrored for limited companies at section 285 Companies Act 2014: An accounting record required to be kept by section 281 or information or a return referred to in section 283 (2) shall be preserved by the company concerned for a period of at least 6 years after the end of the financial year containing the latest date to which the record, information or return relates. That said, there's no harm in asking.
Yes Companies can own companies - that’s what subsidiaries are. On a practical level, you know this is true because you actually have an example. Companies House would not have allowed its registration (barring error) if it was illegal. Why can’t it open a bank account? Banks (or any other business) can choose who they will and won’t do business with. Unless it’s discrimination on the basis of a protected characteristic, it’s not illegal. Since juridical persons don’t have protected characteristics (apart from nationality) it’s virtually impossible to illegally discriminate against them.