Does a web application ToS or privacy policy need to be in &quot;legal&quot; text? I created a web application where users can create content online. The data that they created is stored in an online database and others can see it with the link to their content online. I want to create a Terms of Service and Privacy Policy, but my options are limited. I can either copy some online free generator for these documents or I can write my own. If I write my own, I won't get into the exact legal ins and outs of everything. If I use a free generator, a lot of the text won't even apply to my app and some of it might be contradicting features of it. Can I just write some disclaimer that says how the data is processed and a few site rules or would this be problematic?
You &quot;can&quot; do it any way you want, it's just that there are certain risks associated with option 1 vs 2 vs 3 or 4. Generally speaking, the lowest risk is associated with hiring a lawyer to discuss your requirements and write the necessary documents. It's possible that the most risky approach is writing your own documents, depending on how much legal knowledge you have and also what laws you are concerned with. You might try saying &quot;I'm not liable for anything&quot;, but that doesn't make you not liable. Not all liability is waivable and there can be special requirements for waiving liability (&quot;prominent notice&quot;, which means what? in this jurisdiction). You can write rules, but they aren't necessarily enforceable. A type of situation that you don't want to get yourself into is where you boot a user for what you consider to be an offense, but in booting the user it turns out that you have breached your contract with him (you figure this out when he successfully sues you). A lawyer will (or should) know that a certain kind of clause is illegal, and a legal-language generating program may simply have systematized the legal knowledge of actual lawyers, so the program won't offer you an illegal clause (if it's a good program). So anything short of hiring a lawyer who is competent in the relevant areas increases your risk, and the conclusion that &quot;I can't afford a lawyer&quot; has to be weighed against &quot;I can't afford a $10,000 judgment against me&quot;.
Can a city request deletion of all personal data that uses a certain domain for logins? Well, they can, but they have no legal backing to make it happen. Their chances of succeeding are about as good as me requesting a Ferrari, a Yacht and a Mansion. I can make that request. People will laugh. I will not get it. I'm a little worried that I shouldn't allow certain domains to be used as logins in the first place, especially ones that might be school related You have no way to know who owns what email address. And it's none of your business. Your only interest should be in whether the address is owned by the person that is creating the account. You probably already do that by sending a confirmation link to the email address when people sign up. I'd like to have some idea for future reference if there's any case where the GDPR would require me to comply with such a request The only way you have to comply with such a request is if the owner can prove their identity. As far as I understood, the &quot;Finnish city&quot; was three degrees away from that. They could not provide any proof they are who they said they are, they could not provide a finite list of accounts they claimed to own and they could not even provide proof they own those accounts. They literally just wrote an email with zero legal meaning. I want to figure out the right way to reply to emails like this one The correct way to handle this is have a feature on your website where the account owner can delete their own account. GDPR compliant. Then you make a text template explaining how to use that feature and reply with that template to every request, no matter how stupid (like this case) they are. If they cannot identify themselves to you by proving they have access to their &quot;own&quot; email, they have no business wasting your time. Legally, they could provide you with a different method of identification. In case of a Finnish school, that would probably need to be power of attorney from all children's legal guardians and a specific way to identify the accounts that is consistent with the data given (for example if they entered their full name and address on your website). You would probably in your rights to demand a certified translation if it's all in Finnish. Apart from the fact that you as a private US citizen have no real means to check the validity of all that paperwork, personally, if I saw hundreds of pages of certified translated paperwork, I would probably just comply. Not sure it it were actually enough, but it certainly gets an A+ for effort to delete data from a private website. But a real lawyer might give better advice with a real case on their hands. Is deleting the data actually more of a legal liability than not deleting it in some cases? (People shouldn't be able to delete other people's accounts.) Indeed. You should not delete people's data because a random punk on the internet sent you an email. You need to identify who the request is from and if they are allowed to make such a request. Whether you have a legal duty to actually keep data, is up to you or your lawyer to find out. It depends on your data and laws. It is perfectly legal to make a website with a textfield that deletes any data you enter after a second. Destruction of data you own is only a problem if you break other laws with it. For example the IRS might not be amused if you destroyed invoices and other proof of taxable income. &quot;Some dude claimed I must in an email&quot; is not going to fly with them. That said, again, please, identify who you deal with, find out if their claim is valid. Don't do stuff because random internet punks write you an email. Because the next mail you get, will be from a Nigerian Prince. Please wisen up before opening that one. People on the internet, through stupidity or malice, might not have your best interests at heart. Don't believe random emails.
I think that one cannot answer a question such as "Will the personal use exception in the GDPR apply to personal blogs?", because it is unclear if you refer to: personal information published on the blog pages personal information collected from the Website, by way of forms, cookies, server logs, strictly collected and processed for the purpose of operating the Website for your own personal purposes as a blogger (by yourself of through a subcontractor in the sense of GDPR) and not personal information collected from the Website's operation, transferred or provided to third parties for their own purposes (this would include cookies used to identify and track users across multiple domains) Regarding 1., a personal blog wanting to benefit from the exemption should not publish third party's personal information without their consent or another legal basis, and C-101/01 certainly applies here. About 2., if the information is strictly collected and used for the own personal purpose of the operation of the blog, I would tend to agree that it should benefit from the exemption. I feel that C-212/13 would not necessarily be an indication that because the blog is publicly accessible it is then "directed outwards from the private setting" in the sense of this ruling, and should not be considered as "purely ‘personal or household’ activity". C-212/13 case was relating to a camera installed by an individual on his family home for its own security purposes which was also monitoring a public space. The persons filmed on this public space had absolutely no direct connexion with the person collecting their images. In case of a blog, the visitors of the blog interact with the blog for fulfilling the own personal purpose of the operation of the blog of the publisher of the blog. Another argument is given by the Recital 18 which you quote: a personal blog can be viewed as a type of social networking or related online activity. Finally, about 3., there is no doubt for me that, in this case, the publisher of the blog is engaged in an activity which is not personal, since it willingly provides personal information to third parties which they use for their own purposes (and not as subcontractors in the sense of GDPR). There may be other approaches apart from these 3, but that's a start for your considerations.
The "Privacy Rule" (45 CFR Part 160 and Part 164, Subparts A, E) don't forbid this. Sect. 164.502 states the general rule: (a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter. "Health information" is defnes in part 160 as any information, including genetic information, whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. Your picture would not constitute health information (and anyhow, they are allowed to gather health information, just not freely disseminate it – the pictures on the wall were presumably with permission). There is no general law (which would be state law) against taking a person's picture (though commercially exploiting someone's picture would require permission, via the concept of personality rights), and it is directly required in a number of instances (for identification purposes – school ID, driver's license, passport, voting in some states). It is an unusual requirement and since they scanned your driver's license it is especially inexplicable. Assuming that this is just a story they tell all patients because they want before and after pictures (which you would have to consent to, if you didn't already in one of those "sign here" flurries), saying that this is for "security purposes" would be untrue, but I don't think it's actually illegal. Taking but not using a photo would not cause you harm, so if you had let them take the picture, there would not be a basis for suing. If they use it for advertising without permission, that would be a problem.
Invasion of privacy and false light torts would probably not be applicable here. Very few states have adopted the false light tort because of its conflict with First Amendment principles and there was no agreement or even request to keep the text private. The copyright issue is trickier. First all, the TOS may provide that the copyright belongs to the text service provider or that there is a license. But, even in the absence of an express license, sending someone a message which is equivalent to sending them a letter, probably gives rise to an implied license that the person to whom it is sent can use the message that arises merely from the act of sending it without restriction or qualification. Implied license and fair use also heavily overlap. Publishing the text exactly as it was sent to you protects you from defamation liability because it is true. On the whole it would be extremely unlikely for there to be any legal liability for publishing a text from someone that they sent to you. Of course, one can imagine exceptions. If the person receiving the text was in an attorney-client relationship, or priest-parishioner making confession relationship, or was communicating regarding classified national security matters, or there was a non-disclosure agreement in place, among other possibilities, an evidentiary privilege and duty of confidentiality could apply and disclosing the material without the permission of the privilege holder could breach a duty of confidentiality and give rise to liability. If the picture was a nude picture of a minor, there could be a criminal and/or civil liability issue, and some states have also made posting "revenge porn" a criminal offense and/or a basis for civil liability. If the disclosure was effectively a way to facilitate insider trading that could be a problem. If the contents of the text were accurately transmitted but known to be false and were disseminated without disclosure of its falsity for the purpose of defrauding a third party, that could be a problem. But, no facts that obviously flag any exception are identified in the question. The mere fact that the posting may be embarrassing, or hurt someone's reputation, or was made without someone's express consent, in general, would not be a basis for liability.
Depending on your jurisdiction, such lists may be protected, but not by copyright. For example, in Germany there was a court decision that scanning all the country’s phone books and selling them on CD constituted “unfair competition” and was illegal, while hiring 1000 typists who would manually type in all this information would not be. Databases are protected in many jurisdictions, and a list of the 1000 most commonly used English words could reasonably be called a database.
One way in which it holds legal water is that if you use the website in violation of the terms, then you may forfeit your right to take civil action against the company. Analogous language especially regarding the age of the user may protect the site against actions by third party governmental entities (COPPA-like laws), though nothing patently obvious springs to mind (insofar as this deals with firearms and there is also an age 21 restriction both on the web site and in terms of US firearms law, this is not a totally crazy idea). The citation of 18 USC 1030 non-probatively points to an issue which may be disposed of by SCOTUS in US v. van Buren, that knowingly violating the terms of service is a crime (a proposition rejected by lower courts, see US v. Valle). Facebook v. Power Ventures in particular clarifies how &quot;being put on notice&quot; may make such unauthorized access indeed &quot;unauthorized access&quot; in the statutorily-relevant sense. This does not prevent a legally-authorized law enforcement investigation, pursuant to para (f), but if the &quot;violation of TOS = unauthorized access&quot; theory is upheld, it limits how LEOs can legally access the website (and the limitations extend past LEOs). It is a separate and potentially interesting question whether there actually are any legal limits on the investigative powers of the government – if any law enforcement officer has the liberty to investigate anyone they want, with no supervision or requirement of justification, then this would be a rather gaping loophole in their legal strategy. Web pages involve massive copying of copyright-protected data, and the function of terms of use is in part to conditionally grant access to that copyright-protected content. When a person copies protected material from someone's web page having been explicitly denied permission to copy, they run the risk of an infringement lawsuit.
The length of a literary work doesn't determine if its use is fair use. Copyright does not cover names, titles of works, catchwords/catchphrases/advertising slogans etc. or lists of ingredients (like in a recipe or chemical instructions), however, the procedure can be copyright. The work must also be original. If the tweet copies something that already exists then there is no copyright in the tweet - if the thing that is copied has copyright protection then the tweet itself may be a violation. That said, assuming that the Tweet enjoys copyright protection, the owner will be the author: presumably the owner of the Twitter account. For anyone else to legally use it, the use must be either: Licensed by the copyright owner Fair use (USA) or Fair Dealing (most everywhere else in the English speaking world) For Item 1, the Twitter terms of service say: You retain your rights to any Content you submit, post or display on or through the Services. By submitting, posting or displaying Content on or through the Services, you grant us a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Content in any and all media or distribution methods (now known or later developed). In case you don't know what that means, Twitter gives you this plain English summary: Tip: This license is you authorizing us to make your Tweets on the Twitter Services available to the rest of the world and to let others do the same. So, you can get permission from the copyright holder or from Twitter. Well, Twitter has given permission: Except as permitted through the Twitter Services, these Terms, or the terms provided on dev.twitter.com, you have to use the Twitter API if you want to reproduce, modify, create derivative works, distribute, sell, transfer, publicly display, publicly perform, transmit, or otherwise use the Twitter Services or Content on the Twitter Services. Providing you use their API, you can "reproduce, modify, create derivative works, distribute, sell, transfer, publicly display, publicly perform, transmit, or otherwise use the ... Content ..." Therefore, fair use/dealing considerations are irrelevant.