Legality of Using Unofficial API I have discovered a mobile app's backend API through reverse engineering. The public can access this API and it does not require specific authorization, however, it is not documented and it is not an official API that the public is meant to access. It was made solely for the purpose of that app. The app does not have a ToS. Is it legal for me to use this API to get data for my own purposes? By &quot;my own purposes&quot; I mean collecting data from the API, storing it on a database, and displaying it to users on my own website which was not built to make a profit.
If the app (and the service accessed from the app) truly doesn't have any EULA, ToS, or license agreement, to include restrictions on reverse engineering, you can probably create an alternate front end, so long as you aren't using their logos, etc. However, their data may be a different beast, depending on the nature of it. For example, extracting data from Twitter would potentially violate Twitter's license on the original text copyright held by the authors in question. Wikipedia explicitly includes redistribution in their license agreement with authors/content creators. If all you are extracting and storing is the temperature at a particular weather station, you might have less of a concern. Anything beyond merely factual runs the risk of a copyright infringement as you store the data in your own database.
Doing this is OK according to the GDPR and other European laws. The relevant bit is GDPRs rules for Lawfulness of processing, and in particular Article 6 (1)b, which says that it is legal to do this if processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; In your particular case, signing up for using your app is "entering into a contract" and it is the data subject who has requested to use your app that is subject to this processing.
I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password. It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier. If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.
There is nothing in the GDPR requiring you to collect individual personally identifiable information. If the website has no need, and the website owner no desire, to collect such information, there is no requirement to do so. The GDPR requires that if such information is collected, that there is a lawful basis, and that it be handled appropriately and stored securely, and deleted when there is no longer a need to retain it, or on a proper request. If no such information is collected in the first place, all the rules about how to handle it do not apply. It is possible that some law of an individual country in the EU might mandate collection of some particular information, but I have not heard of any such requirement.
If you want some boilerplate text to just drop in and have done, you are going to be disappointed. But you don't need a lawyer either. Treat it as a coding job. First, list all the ways you are going to store and process identifiable user data. If someone is going to process it on your behalf, identify them too. Draw a chart showing the paths that user data is going to take. (Storage is a form of processing) Then look at the 6 bases for processing user data and figure out which ones apply to each step. E.g. if the user asks you to do something then that is one basis under which you can process their data. See how much coverage you can get without asking for consent. For each third party (e.g. Google) figure out what data is to be sent to them, and where they will be. Google has data centres in the EU specifically so you can get them to process user data without sending it outside the EU. Check the third party contracts for these services, including the confidentiality clauses. Link that to the processing they will do for you. Finally, pull all this together into a single summary of what you are going to do with the data and the bases under which you will do it.
Yes, their waiver has no legal basis and is invalid under the GDPR. They should have hired a better lawyer. GDPR rights cannot be waived (mrllp.com). The last bit should have been: Therefore, in consideration of my participation in any project, I understand that retaining my name and email address, as described above, does not require my consent and that the right of erasure, as spelled out in the GDRP Article 17 (1) b does not apply. The legal basis for our lawful processing of this personal data is Article 6 (1) f ("processing is necessary for the purposes of the legitimate interests pursued by the controller"). I.e. there is nothing in the GDPR that compels GitLab to erase this information, but their waiver is bogus. Keeping track of individual contributions in a software projects is necessary for a number of reasons, including security (if somebody contributes code that jeopardizes security, you want to audit everything that person has contributed).
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
Of course, remote access tools and remote administration can be legitimate. But such tools also have substantial potential for abuse. You as the app provider might have a responsibility for ensuring security and safety of your system. In particular: consider whether other mechanisms are more appropriate for sharing pictures, e.g. a messenger app the user should always be aware when access is active, for example by requiring user interaction for starting a session during which access is allowed, and by showing a persistent notification while access is active the user should be able to withdraw access at any time before starting the session, the user should be informed about potential risks so that they can give informed consent the shared content should likely be protected via end-to-end encryption Scenarios that should be impossible, or at least prevented with reasonable safeguards: An attacker suspects their partner of cheating. The attacker installs a remote access tool on their partner's device and starts tracking it. Clearly, the partner being tracked will not have given consent here. A “tech support” scammer tricks the victim into installing the remote access tool and uses it to guide the victim into transferring money. Why you should care about such issues: If your app enables criminal acts, and you did not take reasonable precautions to prevent this, you might have some degree of liability. Apps that can be used as spy apps are likely to ran afoul of app store guidelines that you would like to distribute your app through. If you market your app in Europe, your app may only access information on the end user's device with the user's consent. Many of the safeguards suggested above (prior information, keeping the user fully aware of what is happening, making it easy to revoke access, no surreptitious tracking, no misleading users) are essential for obtaining valid consent. You as the app provider would need consent since you would act as the service provider / data controller.