Does vehicle information count as personal data? Does a car’s registration number count as personal data under the EU’s General Data Protection Regulation? How about the VIN? (Vehicle Identification Number)
In Germany it's not so clear: https://www.lfd.niedersachsen.de/themen/datenschutz_im_kfz/kfz-und-datenschutz-148981.html The situation is different with regard to personal data collected in connection with the vehicle. Data is personal if it relates to a "specific person" or at least to an "identifiable person". A person is "identifiable" if, for example, he or she can be identified via the vehicle identification number or other additional knowledge. The Federal Data Protection Act (BDSG) therefore applies in these cases. The BDSG in turn contains a clear statement: the data "belong" to the data subject. Related to the motor vehicle: The data "belong" to the driver or owner of the vehicle.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
There is no such thing, legally, as &quot;an attack on someone's writing&quot;. The only way in which any use of one person's writing by another could be the subject of legal action would be if it infringed copyright. But individual words, short phrases, and individual numbers are not subject to copyright protection. In theory such things might be protected as trademarks, but that would give protection only if they were being used &quot;in trade&quot;, that is, to sell or advertise something, and then only if it is in the same industry or market. But a license plate is not selling anything. You may have assigned code meanings to particular numbers. Many people have done this before, using many different schemes or codes. It would be hard to demonstrate that a license plate is referring to your coded meaning and not to some other code. But even if the user admitted an intent to reference your use of a particular number, you have no legal cause of action. You might as well ignore such references, because you cannot do anything to prevent them. Plagiarism is not a crime, nor a tort when there is not copyright or trademark infringement, even if it is openly admitted. If you could prove harassment or some sort of stalking you might have a case, but nothing you have described (in the question or associated comments) comes close to that. If a police car actually hit yours intentionally or negligently you would clearly have a case, but the plate numbers would be no part of it. Response to recent comment: The source of authority (which is not the same thing as jurisdiction) to place license plate numbers on police cars is state MV laws and regulations. To the best of my understanding, such numbers are assigned automatically and sequentially, and have no reference whatever to anyone's blog or political statements. No evidence seems to be cited to show otherwise. The question asks What jurisdiction authorizes these reappropriations of my work/writing/speech? But no one authorizes tjhings that did not happen, and as far as i can see no appropriation occured. Jurisdictions, by the way, do not authorize things, people and organizations do. The question asserts: For my writing I coined &quot;317&quot; and &quot;037&quot; but no one can &quot;coin&quot; a number, and people use numbers in many ways. Use of a similar number on a license plate need not be a reference of any sort to a particular blog or writing.
Art. 17 GDPR, Right to erasure (‘right to be forgotten’) requires “erasure of personal data concerning him or her”. That’s all personal data. However, this only applies when this article applies. Section 1 details when this is and sections 2 and 3 detail limitations and exceptions to the right of erasure. For example, you would be allowed to keep financial records that you're legally obligated to keep. So, if they have the right, you have to delete all their personal data that is not exempted. Aggregate statistics and other anonymous data in the sense of Recital 26 are not personal data and don't have to be deleted. Whether the kinds of data you have mentioned would be sufficiently anonymous would require further analysis.
Generally speaking, what isn't illegal by law is legal. It's possible for law enforcement agencies to share crime rates, maps, and their data, but within any laws regarding access and sharing of that data. Such crime data may be publicly available, but that depends on local and state laws. The local or state agency would have to enter into a legal licensing agreement - if local and state laws allow such sharing - with the GPS company to provide the data, update it, and reasonably assure that it is accurate. The more realistic reason GPS systems might choose to not show crime data may be public relations. If a GPS user lives in an area that has been objectively identified by data as having a higher than baseline crime rate, i.e. for carjackings, that user may not be very happy with that designation. Worse, what happens to public relations when data errors show an area is wrongfully identified as high crime? What kinds of lawsuits could result? Real estate agents suing since bad data from a GPS unit soured the sale of a house?
Possibly, but probably not. Personal data is any information relating to an identifiable person. The statement “Alice is sick” is information, and relates to Alice who is identifiable. Processing personal data is not inherently illegal, but does require a legal basis per Art 6 GDPR, such as a legitimate interest. Here, the information is data concerning health, processing of which is prohibited unless one of the explicit exceptions applies (such as explicit consent, or legal obligations). So it is legitimate to have concerns on whether disclosure of this information would be legal. If these rules were breached, that would be on the data controller. Here, the company would be the data controller, not Bob (unless Bob acted against training and instructions and processed the personal data for his own purposes). However, GDPR probably doesn't apply to this specific interaction. In Art 2(1), the GDPR says that This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. A conversation itself would not be subject to GDPR rules – there is no filing system or similar structured data involved. What GDPR would prevent is to keep records on Alice's health status, but doesn't necessarily prevent talking about it informally. For example, the EUR 35.3M fine against H&amp;M in Germany was imposed not because managers talked with employees about personal matters, but because they then maintained detailed files about those personal matters. Data controllers are responsible though for ensuring security and compliance through appropriate technical and organizational measures (TOMs). TOMs can include things such as non-disclosure agreements and training for staff. If Bob acts against such training, there could be repercussions along the Bob–Company employment relationship. But that would mostly be an employment law thing, not so much a GDPR thing.
Why does the name matter? Today, I entered into a contract to buy petrol and, later, beer and a Caesar salad. In neither case did I exchange names with the other party. If you entered into a contract under a false name with the intent to avoid your responsibilities then that would be fraud. But then, so would doing so under your real name.
This issue touches upon two distinct GDPR rights: Art 15 right to access: you have a right to receive a copy of all personal data concerning you that are undergoing processing (including storage). Access may only be denied where this would “adversely affect the rights and freedoms of others.” Art 20 right to data portability: if processing is being carried out by automated means, and processing is based on certain legal bases (consent or contract, but not legitimate interest), then you have a right to receive a copy of your personal data in a machine-readable format, for personal data that you have provided to the data controller. Whereas the right to access is fairly straightforward, the right to data portability applies under much more narrow conditions. Basically, it's a right that you can download any data that you've uploaded so that you can move to a different service. Google Takeout is primarily concerned with your right to data portability, and provides your data in a machine-readable format. Any photos that you've uploaded to Google Photos, you'll be able to download. Thus, it could be technically compliant to exclude information that they've inferred about your personal data, such as image-recognition results. Such results would still be personal data under the GDPR definition of the consent, and would be covered by your right to access. Google might argue that you already have access to this data through the web interface. In my opinion the GDPR clearly requires the data controller to provide a “copy”, i.e. the data in some durable form – not merely access through a web interface. Whereas your question is specifically about Google, the same issue applies to other services as well. E.g. Ruben Verborgh has an interesting blog series on trying to get access to all their data from Facebook, though unsuccessful so far. Similar to your scenario, Facebook offers a download for personal data but does not include all personal data in this download. In one of the documents provided by Facebook in the course of the exchange, they note that they allow access to photo tags through the web interface, but do not include this in downloaded data – without providing further justification.