Can a company be sued for storing plain-text passwords? Even if most of the developers nowadays understand the necessity of encryption, a consequent amount of websites still store the user's password as plain-text. It can be easy to spot : just asking for a password recovery and see if they send back your old password in the email, or harder trough pen-testing in order to see how are the password stored. If by any method someone had to find a website like this, is it possible to sue the company for "voluntary making the information system weak" ? Or should we be more "nice" and politely ask for the webmaster to remove the concerned user from its DB ? (let's keep in mind that some people just disable accounts without removing them, c.f. Ashley Madison's hack). Can the law change on this kind of issues according to the country hosting the DB ? to the country where the webmaster is from ? to the country the user is from ? Thanks for reading.
Yes a company can be sued (since anyone can sue anyone). But in order to win a lawsuit, you have to have damages as a result of some action, AND you must prove that the action was done with intent to harm or was otherwise negligent. So following your website example, a lot of things would have to happen: The website would have to be hacked. If the passwords are encrypted instead of hashed (which still qualifies as "plain-text" once they email it to you), the hacker would have to figure out how to decrypt the passwords. (Which a good hacker could probably do.) The hacker would have to take those passwords and do something with them that causes damage to their owners. Even if all of those things happened, you would still also have to prove negligence on their part which would be pretty difficult to do because the flaw that was hacked would be the focus of negligence discussions moreso than what was stolen. That being said, if your goal is simply to get them to fix the problem, rather than receive monetary damages, then you could still sue for an action to be taken. You'd have to pay by the hour for the attorney since they wouldn't have a chance of winning monetary damages. But in all likelihood the website owner, upon seeing the lawsuit, would fix the problem before it gets to court, so I could see that having the desired effect. That is if you think it's worth the cost of filing the lawsuit in the first place. Perhaps you could save yourself the cost of an attorney and just threaten to sue if they don't fix the problem.
From what I can see on the USPTO registry, &quot;tweet&quot; is still not trademarked for the purposes you're talking about. Twitter has been working to secure that trademark, but I can't find any record of them having actually secured it. Just the same, I'd predict that using it will get you at least a cease-and-desist letter, and possibly a lawsuit. Whether you'd win that case seems to be a very open question, but that presumes you have the resources to litigate.
At least as of 2011, when regulations under the Information Technology Act related to privacy and data security were issued (some of the relevant statute sections and regulations are linked in this answer at Law.SE), there was no non-contractual right to have your data destroyed, although a terms of service for a site could give you that right contractually. Instead, usually, a term of service agreement will do exactly the opposite and give a site owner an irrevocable right to keep your data forever. I am not aware of any subsequent statutory, regulatory or case law developments in India which have changed this situation, but that kind of tweak of IT Act regulations in India wouldn't necessary make headlines outside of the local IT industry press coverage in obscure trade journals. The EU is the only place of which I am aware that has any individual right to have data destroyed or suppressed even if it doesn't violated copyright, wasn't obtained illegally and isn't fraudulent or defamatory. Even then, as I understand it, in the EU this is not a unilateral right that applies in all circumstances and is instead a specific remedy for certain situations that have a particularly intense privacy aspect to them.
I think this shows a misunderstanding of the meaning of the GDPR. A data subject has the right to demand information, correction, deletion etc. about some of their data held by some institutions, depending on the legal basis for the data processing. One John Smith does not have the right to see the data of any other data subject named John Smith, and he cannot even demand to know if there are other John Smiths in the database. The data controller has to make reasonable steps to ensure that an individual who seeks account information is in fact the individual who is the data subject. In the case of an email, that's usually easy -- if John Smith can access the mail account jsmith@sample.org, one can assume that he is the John Smith who opened the account. If not, then not. If the data controller has the birthplace and birthdate in their records, they can possibly match that against some government-issue identity document, too, but why would they have that data?
First of all, a contract is valid without a signature and even without being in writing; all that is needed is consent by the parties. Therefore, the signature is merely evidence of that consent and is only relevant if a dispute arises over the general consent or the particular terms that were consented to. A digital signature would make it harder for Bob to argue that those were not the terms he signed but if I have Bob's signature on them then the onus of proving he didn't sign rests with Bob, I don't have to prove he did. All of the methods you suggest are valid as would an email saying "Got the contract. I agree. Bob."
You haven't suffered a legally cognizable harm because you got your money back, before you even had a chance to complain, so you have no basis for a lawsuit. For what it is worth, pretty much every adult in the United States was affected by the Equifax breach. Also, usually Equifax wouldn't have had access to full bank account numbers in the first place, so that is an unlikely source of the problem. You could open a new account and close the old one (as suggested by @mkennedy in the comments) because then if anyone had access to your bank account number and was abusing it, they could no longer do so. The fact that it only happened once rather than involving many transactions, which is what you commonly see when there is a true identity theft, however, suggests a more benign possibility. There is a pretty good chance that this errant transaction which was reversed was simply a clerical error involving an inaccurate typing in of an account number that got your number instead of the intended one and was reversed when the money didn't leave the intended account (in contrast, identity theft incidents are almost never reversed without a complaint from the account holder). In other words, this may have simply been the banking equivalent of dialing the wrong number by mistake. If this happens again, you should definitely shut down the account, but so far, it seems more likely that this was a one off clerical error. Humans are just not built to input scores of fifteen digit numbers on a daily basis in a 100% accurate fashion. As long as this job is in the hands of humans rather than computers or robots, the humans are going to make mistakes.
Think through what really happened. You are using terms like fraud, while they may be thinking they're doing fraud protection, or otherwise following laws and regulations. You wrote that you didn't use it for a long time, could the credentials have been compromised? It sounds highly implausible that a platform would defraud a single user. Either there are many more people with similar stories, or your claim is a bit suspect. Think about what your goal is. Reactivating the account, or getting the balance back? Is the balance big enough to spend time and money? Check with which legal entity you have a contract. AFAIK BitPanda is Austrian, so they cannot refuse a GDPR information request on what they have about you all that easily. Consider communication in writing, by registered mail.
I do not have the phone number, email, or anything else associated with the account. Well, neither do I - so it must be my account. Unfortunately, the fact that you appear in most or all of the pictures on that account does not prove that you own it. It could be the photographer's account. Do I have ANY options here Can you reactivate the email account associated with the Twitter account? Or the phone number? Either would allow you to reset the password and access the account. You can go to court (in California) and seek an injunction ordering Twitter to delete the photos or give you access. Of course, you have the same issues proving ownership here as you did with Twitter but the court may have different priorities (justice) than Twitter does (corporate protection). I had an idea. If you (or your husband) own the copyright in the photos (i.e. one of you was the photographer) you could issue a DCMA take-down notice because the poster (who, according to Twitter, isn’t you) does not have permission (even if they did at the time: permission can be revoked). Twitter would be unable to contact the account holder and would be required to remove the images when they got no response.of course, if the photographer was someone else, they could do it. Or you could break the law and say it was you, although I would never recommend this even with a near zero chance of being caught.