Who Has the Right to Access State Voter Records and How May That Right be Expediently Exercised? A few days ago, I posted this question on the Politics Stack Exchange I am modifying and reposting it here in the hope of receiving a more substantial answer. In the United States, who (individual, group of individuals, political party) has access to state voter lists that indicate whether or not the given registered voters had voted in the last general election? If an individual has such a right, what is the most expedient way of gaining access to these records, with the objective being to determine who among the registered voters actually voted in the last election?
In most US states, anyone can buy such lists, covering either the whole state or a specific municipality or election district. Political campaigns routinely buy such lists and use them to organize door-to-door campaigning, as well as postal appeals. Some years ago I was a (losing) candidate for local office in NJ. I bought such a list covering the township I was running in. It showed each voter's name, address, age, party of registration, if any, and which of the last several elections the person had voted in. I think the lists were available from the board of elections, and local lists from municipal clerks. Exact procedures no doubt differ from state to state, as will costs. At that time lists were available in electronic and paper formats. Purchasers had to sign an agreement not to use the information for commercial marketing, as I recall. Updated lists including data from the latest election are not usually available at once, but are available long before the next general election.
To what degree are such emails admissible in court as evidence, and what weight do they carry? Your own statement, when offered by you as evidence, is hearsay, unless it comes within an exception to that rule. Recorded recollection might be one of the better exceptions. There is also a chance that you could get it in as a business record of the company if you were using a company email account and the company stores all of its email communications. The documents also sometimes come in to provide fair context for a conversation with a party-opponent's statements that are admissible. It appears that Canada does not follow the modern British rule (which repealed the hearsay rule in civil cases in 1995), which if it were available, would come in without any difficulty at all. But, Canada does have what it calls a "principled exception" (which is somewhat broader than the parallel U.S. residual hearsay exception) that is generally available if the document can be shown to be reliable and there is an unavailable witness, or if there proponent of the document can show that it is reliable and necessary for other reasons. Even if the document itself is not admissible since it is hearsay, you could still testify as to what the boss said from your own recollection, and then have your lawyer ask you why you are sure that this is what was said. You would answer that you contemporaneously wrote a confirming letter to the boss spelling out what was said and you reviewed it to refresh your recollection before testifying at the hearing or trial. These kinds of confirming letters are used quite frequently in business and employment litigation. And, in my experience, these statements tend to be surprisingly effective and persuasive, because, while they do not foreclose the possibility that the person writing it was lying or inaccurate in the confirming email account, it does rule out the possibility that you forgot exactly what was said, and you provided the boss with an opportunity to dispute you which the boss didn't feel an obligation to correct. If one party has a coherent account in confirming emails of what was said, and the other party is trying to remember what happened a year or two earlier without notes from the witness stand, the person with the coherent, documented account is almost always going to come across as more credible unless the other side can show that your confirming emails are not infrequently gross misrepresentations of what really occurred. (I've also dealt with witnesses like that now and then.)
The Right to Access is pretty absolute. However, there are some limitations: Is the service even the Data Controller for the data in question? Here, you're talking about notes of one user about another. Is the platform the controller for the notes, or would the note-taker be the controller? Or both, jointly? If the platform weren't a controller but merely a data processor for these notes, it would be illegal for them to disclose the information. Trish also correctly points out that the GDPR does not apply to processing for purely personal or household purposes, e.g. personal social media use. So GDPR would not provide a basis to compel a user to disclose their notes to the data subject, assuming that the note-taker is covered by this exception. Of course, this exception wouldn't apply if the notes are taken for other purposes, e.g. professional networking. Also, this exception doesn't affect the platform. There is an explicit limitation to the right of access in Art 15(4): The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Disclosing user A's notes about user B to user B would likely violate the privacy rights of A. The notes are both A's and B's personal data. However, the correct balance depends on context. E.g. an employer probably can't refuse to provide access to a performance assessment merely because it was written by an identifiable manager. The UK ICO has provided detailed guidance on this aspect to the right of access. They propose a three-step test: Step one – Does the request require disclosing information that identifies another individual? For example, it might be possible to redact other people's information (but not in your Mastodon notes example). Step two – Has the other individual provided consent? Step three – Is it reasonable to disclose without consent? What is reasonable is highly context-dependent, but UK data protection law gives some concrete criteria to consider. The EU EDPB has draft guidance on the Right to Access. They note that the Art 15(4) can cover a wide range of rights, not just other people's privacy rights. But as in all things, the data controller is required to strike an appropriate balance between user A and B's conflicting rights. In the Mastodon user notes scenario, I think that the note author's rights to privacy should be considered more important than the data subject's right to access those notes, thus making it possible to reject that part of a DSAR under Art 15(4) GDPR. If we assume that the note-taker A is a (joint) controller for these notes, then it would also be necessary to consult them before making a decision about the access request.
This document is a handy summary of US laws. The primary distinction is between one-party and all-party consent states. In California, all parties must "consent" to recording, but in Georgia, only one party has to consent. "Consent" can be implicit, so if someone announces that they are recording, consent has been effectively given (that's not a hard and fast rule: you have to look at the actual case law and statutory language for that state, but usually this is covered by the "reasonable expectation of privacy" part of the law, where you don't have a reasonable expectation of privacy if someone announces that they are recording the conversation). As it happens, there was a case tried in California involving Georgia-to-California calls, Kearney v. Salomon Smith Barney, Inc., S124739 (Sup. Ct. Cal. July 13, 2006), declaring that California law must be obeyed by a person calling into California. The court declined to decide whether a person could be criminally prosecuted for such a violation of the law, but there is possible civil liability.
The law is really bad at protecting whistleblowers From my understanding of US law, this is not unauthorised access to a computer: the reporter made a legitimate request to a remote computer, that computer provided data,the reporter accessed the supplied data on their own computer. However, pointing out the failures of people in power is fraught even if it is not illegal. It is certainly within the Governor’s power to authorise an investigation of the reporter. On the face of the law, it seems reasonable to suspect that what was done might be a violation so there is nothing legally wrong with initiating an investigation. I suspect that such a broad interpretation of the law would fall foul of the First Amendment which may partly explain why it wasn’t prosecuted: the government doesn’t want to find out. Similarly they can issue press releases, which, due to the First Amendment, don’t have to be true, just not defamatory. Saying it’s a possible violation is true and not defamatory. Saying the reporter was an evil person who is only doing this for political purposes is a statement of opinion and not defamatory. It’s a fact of the world that people with power can use that power in ways that are malicious, unethical, and unfair but not necessarily illegal.
Sending a letter to the Governor is legal You can do it, I can do it and the elected officials of Lancaster County can do it. Thanks to the first amendment, that letter can say pretty much anything you like subject to limits that themselves are subject to strict scrutiny - things like threats and defamation. Outlining a course of action that you propose to take is legal even if that course of action is itself illegal. I will also point out that people - sometimes even politicians - have been known to say things they don't mean. However, that just begs the question ... This article explains what's going on and, more importantly, the actual letter is here. I've read it. Twice. I can't see where the county proposes to do anything concrete that might be considered illegal. Apart from the first paragraph, the entire letter appears to be a case for why the county should be permitted to move from red to yellow on May 15 and they are asking for the Governor's support. Even the first paragraph is ambiguous; while it asks the Governor to move the county from "red" to "yellow" and states that they "intend to move forward with a plan" it is by no means clear that that plan is moving from "red" to "yellow" even though you could get that impression on a casual reading. Basically, what they intend to do is so vague that it's impossible to tell if it's legal or not. Of course, just because something is illegal doesn't mean it can't be done. The USA is a free country and the fundamental freedom is to reap the consequences of your actions. If the county does something1 then the state can take them to court - the court will decide if it's legal or not. 1 Or threatens to do something sufficiently concrete that an injunction against it could be issued.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
Here is the technical manual: you want 11.015. It says: New Registered Owner Section—The name, address, and driver license or identification card (DL/ID) number for each new registered owner must be entered on the appropriate lines. If an owner has not been issued a California DL/ID card, their out-of-state DL/ID number, if any, is acceptable. Print the out-of-state DL/ID number and state of issuance in the upper-right corner of the face document or application. The out-of-state DL/ID number cannot be keyed, but will be microfilmed with the title. The word “None” should be entered for persons who have not been issued a DL/ID card from California or any other state.