Is there any protection regarding social media accounts and background checks? Suppose Alice was applying for a new role. As part of a background check she is asked for usernames for any social media she uses. She gives details of her public Twitter and LinkedIn accounts (which have been curated as a professional persona), but neglects to mention others: Stack Exchange: Some of her posts asking &quot;beginner questions&quot; could be considered detrimental to her performance of the role Grindr: Her use of the service could reveal that she has a protected characteristic (which had no relevance to her performance of the role) 4chan: Her posts included what could be considered as unpopular opinions (which had no relevance to her performance of the role) Suppose at a later date (after she has started work at the new company) the company becomes aware of one or more of these social media accounts. Would that be a legitimate cause for termination? Any jurisdiction would be interesting. I guess that in &quot;employment at will&quot; states in the US one can be fired for anything, but would hiding a protected characteristic be protected? In the rest of the world (the UK in particular) we have quite strong protections, but lying in the recruitment process is generally a good enough excuse for termination. Is there any specific protection for privacy in social media?
united-states Even in the 49 U.S. states that are &quot;employment at will&quot; states in the U.S., there are reasons for which termination of employment is prohibited under both state and federal law, and termination without cause entitles an employee to unemployment benefit if certain other conditions are met. Most unionized employees, most public sector employees, most private sector employees in Montana, and a small number of employees (mostly senior management) with written employment contracts that so provide can only be fired for cause. There is a split of authority in the U.S. on the status of not making full disclosure is something that the employer required you to disclose and that you represented that you did disclose in the hiring process, such as your social media accounts. This is commonly called &quot;resume fraud&quot; even though it actually applies more broadly than resumes. Also, sometimes the question might be resolved differently under parallel state and federal laws. In general, in the U.S., asking about social media accounts is something that an employer may permissibly ask unless it is use to facilitate discrimination on a prohibited ground. One rule, which applies in some jurisdictions, is that &quot;resume fraud&quot; (i.e. a material misstatement in a resume or employment application) discovered by an employer after an otherwise wrongful termination can serve as a lawful basis for terminating employment that excuses the wrongful basis for termination of employment (at least assuming that the information withheld or misrepresented was on a matter that the employer could lawfully consider). Even if the information not disclosed was not itself a basis upon which the employer would not have hired someone, the dishonestly in the hiring process would be a basis for termination of employment. For example: The Seventh Circuit, which covers Indiana, Illinois, and Wisconsin, has consistently held that it’s permissible for employers to reject job applicants and fire employees who are suspected of engaging in resumé fraud. The rationale for the Seventh Circuit’s reasoning is very straightforward: lying to employers is a legitimate and non-discriminatory basis for turning down an applicant or firing an employee. The cases of Carter v. Tennant Co., Aubuchon v. Knauf Fiberglass and Gilty v. Village of Oak Park all stand for this proposition. . . . . If the employer, as part of its investigation of the allegations in the lawsuit, discovers that the employee engaged in resumé fraud, can the employer use that belated discovery to its advantage? According to the United States Supreme Court, the answer is yes. More specifically, in McKennon v. Nashville Banner Publishing Co., the Supreme Court essentially held that an employer’s belated discovery of an independent, alternative basis for firing an employee (e.g., resumé fraud) can be used by the employer to reduce the plaintiff’s potential recovery. (Think of this as the employer’s “if we knew then what we know now, we wouldn’t have hired you in the first place” defense.) In other jurisdictions, &quot;resume fraud&quot; is not itself a basis for discharge, although it might be used as evidence to support an initially claimed valid reason for terminating employment in the face of an employee allegation that this was a mere pretext for wrongful termination. I don't know which states or how many U.S. states fall in each category. The former rule is the rule in almost all cases under federal private sector employment law. A variety of cases that address the question in the context of public employment sector employment can be found here. In addition to these general rules of law, there are also often reasonable questions of fact about whether a prospective employee substantially complied with an employer's social media disclosure question on a fact by fact basis that turns on the exact wording of the question and the reasonable interpretations that language could be given by the employee. For example, if a question has a social media disclosure requirement and one doesn't disclose a blog, one might reasonably argue that a blog is not a social media account, depending on the language used in the question.
Criminal liability is triggered by guilty knowledge. The people who run OnlyFans may know in general terms that it is probable that some illegal images exist on their servers, but so does everyone who allows the public to upload stuff. If that was illegal then the senior management of Google and Facebook would be liable to arrest on the same grounds and the Internet as we know it could not exist. Once the company becomes aware of a specific file that contains such material they need to remove it. If they fail to do so then they become liable. OnlyFans has been doing this: [OnlyFans] provides templates for each successive warning - explaining why material has been removed, and that failure to comply with terms of service may result in the closure of the account. [emphasis added] The site operators also become liable if they have a general policy of tolerating illegal material. This is a grey area; a prosecution would have to prove that the toleration was an active policy rather than merely ineffective moderation. There doesn't seem to be any evidence to support such a claim. Permitting an account to continue after deleting an offending file is not toleration of the offending file. The BBC report does not allege that the OnlyFans policy of multiple warnings has been applied to cases of underage content; rather it talks about cases of incest, bestiality and exploitation of vulnerable adults (such as homeless people), and only where the accounts were particularly popular. The linked articles do report cases where accounts have been set up advertising content by minors, but they were shut down as soon as the company was notified of them. The second article also quotes its source as saying that lots of such accounts get closed down all the time; there doesn't seem to be any evidence of toleration of that material specifically. So in conclusion it seems from the available evidence that OnlyFans have been complying with the law. It is telling that the BBC article specifically does not say that they have done anything illegal. If the BBC had found unambiguous evidence of illegal conduct by OnlyFans management then they would certainly have highlighted this.
This is possibly but not necessarily fine. The data controller (the garage) is responsible for safeguarding your personal data. They must take appropriate safety measures, but this depends a lot on their own risk assessment. For example, to protect the data from being used by employees for their personal purposes, the controller might use organizational measures like a policy “you're not allowed to do that.” Many companies allow employees to use their personal devices for work purposes (BYOD). When the data controller allows this and takes appropriate safety measures, everything is perfectly fine. The company still has to make sure that the data is only processed for legal purses and deleted afterwards. Implementing a BYOD policy in a GDPR compliant manner is difficult but not impossible. A data breach has occurred when the security measures were insufficient and your data was deleted or disclosed without authorization. Your scenario would only be a breach if the company did not have a BYOD policy and the salesman used their personal phone, and arguably then only if that device is also breached. However, do not discount the alternatives: they do have a BYOD policy and the salesman is acting within their instructions the salesman was using a company-controlled device, not their personal phone If you have good reason to believe that your data was mishandled (and these alternatives do not apply), then the GDPR offers you the following remedies: You can of course complain to the data controller, especially if they have a dedicated data protection officer. You can lodge a complaint with a supervision authority, which is the ICO in the UK. They expect you to attempt to resolve your issue with the controller first. The ICO can then decide if they want to investigate the issue. You can sue them for compliance and for actual damages suffered (you have none, though). Note that all of these alternatives are more effort than they are likely worth. In particular, the garage can always correct the problem, e.g. by getting your contact info deleted from the personal device or by creating a retroactive BYOD policy.
It follows from case law from the ECJ, e.g. C‑70/10 (28 January 2010) and C-582/14 (19 October 2016), that IP-addresses are personal data. Since my interpretation of the case law differs from the interpretation offered by @Greendrake, I'll go into the relevant case law in a bit more detail than I did in my initial answer. TL;DR: Yes, IP-addresses in server logs are personal data and you need to declare IP-address logging in your privacy policy. As I said, we need to examine the case law I mentioned in the introduction to find out whether IP-addresses are personal data. The first of those are ECJ C-70/10. In this, the court concludes that all IP-addresses are "protected personal data": It is common ground, first, that the injunction requiring installation of the contested filtering system would involve a systematic analysis of all content and the collection and identification of users’ IP addresses from which unlawful content on the network is sent. Those addresses are protected personal data because they allow those users to be precisely identified. (my emphasis) Then, in 2016, the ECJ ruled in a more narrow case ECJ C‑582/14 specifically ruling on dynamic IP-addresses: The court goes through a number of deliberations, then concludes: Having regard to all the foregoing considerations, the answer to the first question is that Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person. It is very clear from this text that the court does not challenge or invalidate ECJ C-70/10 on static IP-addresses. The court is very careful, in its ruling to point out its ruling is specifically about dynamic IP-addresses. So the ruling of ECJ C-70/10 still stands for static IP-addresses, these are always protected personal data. I believe this case law is summarized in Recital 30 of the GDPR. This recital lists the identifiers that may make natural persons identifiable: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis). Since it follows from case law that static IP-addresses always makes the data subject identifiable, and dynamic IP-addresses may make the data subject identifiable, I will conclude, based on jurisprudence alone, that: Unless you are able to filter your logs to exclude static IP-addresses. I think you must consider IP-addresses protected personal data under the GDPR. However, in ECJ C‑582/14, the ruling about dynamic IP-addresses hinges on the controller having legal means to identify the data subject by connecting the IP address to some other data. The court seems to think that getting access to ISP logs is the only means of doing that. This is wrong. In 2015, the Norwegian computer scientist Einar Otto Stangvik identified 78 Norwegians who seem to have downloaded abuse material starting only with their IP-addresses. Stangvik did this while working as a consultant for Norway's larges newspaper VG. I know Stangvik and I am familiar with the methods he used. I've tried them myself, and they work. Stangvik did not have access to ISP logs, he did not do anything illagal, and the 78 natural persons identified only by means of their IP-address, combined with other data the Stangvik had legal access to. I will not go into details, I will just say this: If you know how to do this, getting to the natural person when you know the IP-address is not difficult or labour-consuming. To return to the question: It also follows from the GDPR that logging of IP-addresses falls under its definition of "processing". Your privacy policy should list all personal data personal data that is collected by yourself and third parties ("processors" in the terminology of the GDPR) that you rely on. Your hosting company is such a third party, and you need to declare the logging of IP-addresses in your privacy policy.
I'm not a lawyer, but I am an NHS employee, and can more concretely answer your questions. Has any crime been committed, and if so, is there any point in pursuing this with the police? If so, how do I go about it? Yes, in-fact, several crimes have been committed. Firstly, NHS employees are prohibited from viewing patient's personal information that they are not specifically treating. In opening your letter from the NHS, the nurse in question violated this practice. It's a breach of both privacy and trust. This is taught at the NHS and the nurse would be aware of this. Secondly, by cancelling your appointment, the nurse has committed workplace fraud. They have impersonated a patient, and in doing so, cost the NHS money and time it won't get back by cancelling your appointment. Again, this is also taught within the NHS, and the nurse would be aware of this too. Thirdly, by cancelling your appointment, the nurse may have put a life in danger in doing so, which is effectively gross negligence at a minimum. Although this can be reported to the police, it'll be more effective to report it to the appropriate NHS bodies. Even if a crime has not been committed, I would think that at the very least, opening someone's mail and then impersonating them and cancelling the surgery would at least be viewed as unprofessional, especially for someone employed in the NHS. Is there a procedure for making a complaint against an NHS worker? There are several different approaches, given the various breaches of trust. As BlueDogRanch mentioned, you can file a compliant to NHS England, which includes via email. Be sure to get appropriate information like the nurse's name, address, and if possible any details (like appointment reference numbers) to aid the investigation. Secondly, because of the cost incurred via the malicious cancellation of an appointment, costing time and money (and running the risk of opening the NHS to litigation), you can also report the fraudulent aspects to the NHS Counter Fraud Authority.
If it’s relevant, yes However, Twitter’s position is that they have disclosed all the data that the contract requires them to disclose. It is likely that case will turn on whether they have or not. Data they haven’t disclosed is not relevant to answering that question.
I'm not going to comment on the specifics of this law; rather, I think this question shows a misconception of the way the legal system works in general. Here's the question: do you actually have "legally privileged" material on your phone? If not, what's keeping you from claiming that is that it's not true, and lying to a police officer is a bad idea. And just putting a letter from your lawyer on the phone doesn't mean you've established a legal privilege--attorney-client privilege is not a magic spell, it's a reasonable system of protection that only covers certain communications. The bottom line is: the statute in general, and that clause in particular, were included in the law to protect real, important, and substantial legal right. The courts interpret the law in light of that purpose. If the police officer finds a solution that protects your rights while still carrying out the purpose of the statute, the court will be unlikely to fault him or her. In this case, if you tell the officer that there is a letter from your attorney in a particular folder, the obvious solution is for the officer not to open that folder. Problem solved. In practice, in the United States at least, these cases are dealt with routinely; computers are seized, and attorneys and judges work together to ensure that privilege is protected while still allowing reasonable access to seized materials. I would imagine the same is true in the U.K. The bottom line is: the law is not a game, and technical "gotchas" are rarely effective. Common law systems allow judges enough leeway to avoid this sort of pointless technicality.
Yes, it triggers the GDPR obligations Considerations: Can you surely identify those residing in Europe? In that case you should ask them to sign up again and confirm the consent. A lot of mailing lists are doing just that. Did they previously give consent and you can document it? If so, then you can argue that you have the required consent. Do you have business in Europe? If not then I don't think they would bother to go after you. You could just walk away from the fine. What other personal informastion are you storing? If you know who reside in Europe then you already have more info than just the email. The email address itself wouldn't be much of a documentation issue, SAR or Portability task.