Does revealing the owner of an anonymous forum account breach GDPR (or other) laws? This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member. I will explain the best I can: I'm a creative professional and frequent a forum dedicated to my industry. On the forum I have 2 accounts — one 'official' account under the name of my company, used to make official announcements etc, and a personal account under an anonymous username. On the forum I had a discussion about a competitor company and made some personal comments about what I think about them. It's a small industry and the competitor company is very influential, so I wanted to keep these comments separate from my official company account and posted them from my anonymous personal account. Weirdly (and this is what seems questionable to me) the forum owner has figured out that my personal account is linked to my professional account since they share an IP address, and has shared this info with my competitor. (As far as I know the competitor has a relationship with the forum owner because they advertise there regularly.) Now my competitor knows that the anonymous account belongs to my company and can see my posts about them. The whole thing has caused a stir for me professionally since they are interpreting these comments as the official views of my company. It seems like some law must have been breached during the sharing of this information? Does anyone have any insight? I don't necessarily even want to do anything about this, but am just interested in the legality around it.
It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR: The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. If the website terms which you agreed to don't include this data matching, then that processing is not lawful. The rest of Recital 50 is relevant and worth quoting in full: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations. It seems to me that an anonymous account could reasonably expect that the &quot;further processing&quot; of data matching is not in the public interest, an exercise of official authority, scientific or historical research or statistical. There is no link between the data matching exercise and the purpose for which IP addresses are normally collected: the operation and physical security of the website. Now, it may well be that the website terms do allow this data matching to discover links between accounts, or in any case prohibit having two accounts and allow reasonable methods to discover such links. It's also possible that a court has ordered the processing (as Iñaki Viggers has mentioned. We don't have that information; but ostensibly one wouldn't normally expect a personal account to be examined in this way, and certainly wouldn't expect any link discovered to be relayed to a third party.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
Does criticizing public figures constitute libel especially in a private group? It depends on the specifics, but a priori your description suggests that the defense of honest opinion would be applicable. This is regardless of whether the subject is a public figure and regardless of whether the statements were in private --albeit non-privileged-- communications. Case law surely provides guidelines or precedents on how the details and circumstances of the events would fare on the parties' legal position, but I am not knowledgeable of UK/English law. Does X have a counterclaim for illegally accessing the data? The matter seemingly depends on how the religious leader had or gained access to the data. Even if he gained access by stealing or hacking a device or account, X would not have standing to [counter-]sue unless the device or account belongs to X. Be mindful of the possibility that third party might have made the disclosure to the religious leader. In that case, actionability (if any) of the disclosure only encompasses the third party, not the religious leader. X's intent that his statements stay only among the participants does not necessarily imply that participants' disclosure elsewhere is unlawful.
IANAL. (1) GDPR is certainly relevant. (2) This is certainly "personal data" under the definition in GDPR article 4. (3) Maintaining this data is probably lawful under article 6 sections 1(a) (consent) - provided that the Terms and Conditions of the site make clear that the user by signing up is consenting to this information being held (3) There is certainly an obligation under article 14 to disclose that the information exists, and to say how it used. (4) Article 15 says that data subjects are entitled to see the information and know what recipients or categories of recipient have access to the information (I don't know whether it's enough to just say "moderators", or whether the moderators need to be identified). (5) I can't see any reasons why the obligations under articles 16, 17, and 18 regarding rectification, erasure, and restriction of processing aren't relevant. This is exactly the kind of situation that GDPR is designed to address. If you're restricting the service available to particular users based on a record of their behaviour or on judgements made by moderators, then they absolutely have a right to know, and a right of redress.
Why do you think Oracle have not been protecting their trade mark? Using a trade mark to describe the product (“Written in JavaScript”, “Seeking JavaScript developer”) is not an infringement and the trade mark owner is under no obligation to, indeed, cannot stop this. Where they are required to defend their trade mark is when it is being used in such a way that there is the risk of confusion that the goods or services could be confused with the trade mark owner’s goods or services. Further, they are not required to defend all breaches, only enough to show that they are actively doing so. Also it is not important that the trade mark be associated with the trade mark’s owner. Do you know who owns the trade mark “Ben &amp; Jerry’s”?
Just the email in such a list is annoying but not really concerning. There are millions of people who put their email into publicly available contact data, and after a couple of years of use any email is going to be exposed some way. That's why websites use passwords in addition to just the email and why mail programs have spam filters. Your email was probably not used to sign up anywhere. Instead, spammers pretend that you signed up to slow attempts to prosecute them. A bit of a joke, really, considering how hard it is to prosecute spammers. The valid/invalid remark is used to facilitate spamming, no need to send mails to long-inactive addresses. More concerning than a 'leak' of your email would be a leak of your email plus password. (Such things also happen, and they are a reason why one should use different passwords and 2FA/MFA on important sites.) If it is just the email, see my first bullet point. There is a significant likelihood that the 'website owner' you think you identified is another victim of the address trader. Getting to the real culprit will require significant forensic effort. That effort is unlikely to happen for just emails.
In the general case, it seems unlikely, based on the wording (which is convoluted). In certain cases, if the president of Russia posts "My name is Vladimir Putin", that post is personal data. On the other hand, you might, based on my writing, conclude that I am from the US, and you might even conclude that I'm in Washington state, but that doesn't distinguish me from 7.5 million others, so on those grounds that is not personal data. Eventually, though, you might identify me specifically from other things that I may have said on SE. The definition depends on two parts. First, personal data is "information relating to an identified or identifiable natural person". Any "information" provided by a natural person is "related to" that person (as is any "information" that is about such a person). The second part defines "identifiable natural person", that is, who is an "identifiable person"? Every person can, in principle, be identified by reference to some label or description of fact about them, so every person is an identifiable person, under this definition. This means that every piece of text that refers to an individual (not even text which can identify the person) is "personal data". Obviously, any individual can be uniquely identified by some collection of identifiers; the problem is that the wording of the law does not explicitly say "using that supposed personal data". If I mention that I have a relative named Knudt, that would technically be personal data: I've given information that relates to a person, though you have no idea (and could not possibly figure out) who that person is. Another term that the regulation defines and uses in a few places is "pseudonymization", which is defined as the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person The point of interest here is that this says that "personal data" which cannot be attributed to an individual is, nevertheless, still personal data. I think the most important part of the regulation is art. 6, which defines lawfulness of processing, especially para 4., which allows consideration to be given to safeguards such as pseudonymization.
Names clearly are personal data and so a good question to ask for GDPR compliance is: Do you need to do what you want to do in order to offer your product or service? For your scenario a common answer seems to be that websites ask for the users first and last name during account creation. The reason is that they need this information to confirm the identity of the account creator. But the public profile only displays a user name that the user can pick freely. In general there is no good reason to publically show the legal names of users so websites don't do it. So for your website ask yourself, why do you want to publically show the names of your users? If you have a good reason to do that specify it in the user terms and go ahead. If you don't have a good reason don't do it.