Company makes confidential CV publicly available and searchable. Legal recourse? A friend of mine was looking for a job last August. She sent CVs for various positions. Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure enough, the first result is her CV in PDF format, from the website of one of the companies she contacted. The link is in a wp-content/2018/08 format, which means it was uploaded on their website, but it’s freely available for anyone to search and download it. My question is: does she have any ground for legal action? Is such action worth the effort in terms of compensation? The location is Cyprus, covered by EU and GDPR laws.
She could refer this to the Cyrpriot Commissioner for Personal Data Protection, but I would try contacting the company first and telling them to remove her Personal Data from the public website - or delete it completely. If they don't give a satisfactory response, mention the CPDP. This could lead to the data being removed within a few days, while an official complaint is likely to take longer. She may have grounds for legal action which would result in the company being compelled to take down the data (or to close the website), but if your friend is thinking in terms of compensation, what compensation would she seek? If she can demonstrate and quantify financial losses that occurred specifically because of this disclosure there might be a possibility, but I suspect that would be difficult to prove.
It depends on the state. In some states the Secretary of State holds the records for business entities and in others, such as Arizona, it's an organization known as the Arizona Corporation Commission. Regardless of the state's organization that keeps the information, one of the pieces of information you will find when you look at a company's records is the "registered agent", "resident agent" or "statutory agent." The agent, whether a person or a representative corporation, must be located within the state where business is conducted. That agent is who or what gets served with papers for a lawsuit. Here's a good explanation at legalzoom. A personal example that may help: I am an owner in a business that does business in Louisiana and Arizona. Our LLC is registered in Louisiana and is registered as a "foreign corporation" in Arizona. However, we are required to have a registered agent in each state. We pay a company to act as our registered agent in each state and the registered agent has a physical address in each state in which we are registered. If someone wants to sue my company then they can look up the name of my company in either state and will find my registered agent along with the registered agent's physical address. Service to the registered agent counts as service to my company. The agent will forward to me any service which is made to them. EDIT: if you don't known the name of the entity, i.e., the name on the door of the business does not represent the name of the company, then you need to find the "doing business as," or DBA record of the company. I don't know what state you're in but all the states in which I've done business maintain a "Doing Business As" system that can be searched. I guess it's possible that you're in a state that doesn't maintain DBA filings or require them. Typically, you can search either way - search by owner or search by the DBA name. Some states, such as Arizona, record DBA names at the county level. I've seen some states allow searching by address also.
Any processing of personal data needs a legal basis, for example necessity for some contract or legitimate interest. If no other legal basis allows the processing, you need to acquire consent. Consent must be freely given. If something is gated behind consent without that consent being really necessary, this might coerce users and they would not be able to consent freely. The GDPR does not have a hard ban on this, but it explicitly calls out that this case must be considered when determining whether consent is valid. So what your company is trying to do is in a dark grey area. Not necessarily wrong, but likely so. Consent could be made free if users have an actual choice. For example, some online newspaper sites had success with a “pay or consent” wall. (Success in the sense that some data protection authorities allowed this). In your case, this could mean that users either consent to extra data collection, or that they buy some reasonably priced premium mode. But none of this is for you to decide. You can voice your doubts that the software would be compliant. You could also ask if the Data Protection Impact Assessment document for this proposed processing is available (creating such an assessment is likely mandatory in this case). But in the end, it is the company's obligation to be compliant, and this responsibility is largely shouldered by the company's data protection officer (to whom you can turn with further questions).
My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine. Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted. Another good clause to have in your privacy policy is to basically state if the user submits information about another natural person that they have consent from that natural person for that data and what it would be used for. The internet is the internet. People have been trolling it for years. People have also submitted false information for years. The best a business can do is simply outline what their site does, what data is collected and what it will be used for. That along with what legal basis it’s processed for and following it makes you GDPR compliant in that regard. As to withdrawing consent and the rights given by the GDPR that’s all specific to what infustructure a business has in place. As a developer I know the headaches of the GDPR. Most of it resides in the fact data is not centralized and thus can’t easily be retrieved, modified, or removed. Once you’ve tackled that aspect providing the user their rights under GDPR isn’t to far off.
The COVID restrictions are new enough that there are few court decisions on how to interpret them. There are frequent requests for court injunctions seeking temporary relief. Some pass, some are denied. The website might accuse locations listed there of breaking the restrictions. Making such an accusation in public sounds like a very bad idea, especially if there is no solid documentation. But the aggrieved party would be any location falsely listed. The site may or may not be hosted in Germany. If it is not, it becomes a really interesting question which law applies. You might inform the authorities, but beyond that, forget it.
Publishing government records is pretty classic First Amendment-protected activity. Keeping in mind that one can find a lawyer to sue for anything, I think that person would likely be operating well within the law. One thing in particular that I'd recommend staying aware of is how one might attempt to monetize this endeavor. There have been a lot of sites publishing arrest records, court records, and mugshots, and then charging people to have them removed to keep them from popping up in a Google search for those people's names. That is -- rightly -- regarded as sketchy behavior; while several states have passed laws prohibiting that business model, I don't believe any such law exists in Washington State at this point.
The employee must, during and after employment, without limitation in time, observe a duty of confidentiality regarding [...] the Company's internal affairs such as business plans, profitability, pricing, employees, methods, processes, routines, code and the like as well as other information that the Company typically wants to keep secret The pure information that the company had at some time a security problem with their product is internal knowledge you only gained through working there. By what is written here, you are indeed prohibited from speaking about it. If it were public knowledge, you could point to a press release and say &quot;I did that, that was me fixing the problem&quot;. That would work. Because it doesn't share anything that isn't public anyway. But you cannot share things the company wants to keep secret. Finding out whether that contract is legally enforcable in your country and juristiction is the job of a real lawyer, but just as written, they are right. You signed a contract to not do that, not talk about it an certainly not publish it on the internet. So you should not do that, unless a good lawyer you trust tells you otherwise. That said, &quot;I found a security flaw&quot; is about as impressive as &quot;I found a dollar on the floor&quot;. Maybe you can talk about your knowledge to prevent something like it happening. That says nothing about whether or not it happened in your old company, and for me as an employer it is much more valuable to have you on board with structured knowledge you can apply, than with your memories of being lucky once.
Law enforcement activities are out of scope of the GDPR, though there is a similar right to access in section 45 of the Data Protection Act 2018. Access to police bodycam footage can be denied or restricted on various grounds, including to protect the rights and freedoms of others. A separate right to access information held by public authorities is part of the Freedom of Information Act 2000, but it exempts the applicant's own personal data and refers to the DPA 2018 for further restrictions of this right – FOIA is just a fallback in case access is not regulated otherwise. If necessary to protect the rights and freedoms of party A, the footage released to B could be redacted in order to protect A. However, since A and B were both present the footage would not disclose information that B didn't already have. Therefore, redaction might not be appropriate. Given that there is no clear legal guidance and that all of this is context-dependent, I'd expect this to come down to the internal policies of the police department handling the access request. I see no grounds that would require A to be alerted when footage is released to B. A could also make a request to access their data, and should receive information about “the recipients or categories of recipients to whom the personal data has been disclosed”, but this might be limited to protect B.