Is it possible to renounce all responsibility for files on a web server? (Sweden) I'm going to build a Web server that allow users themselves to upload files, video clips and so on. This will only be available in Sweden. Then my question is: Is it possible to renounce all responsibility for files on a web server or file server and put it on the User? Do you have any tips or have this be done by a professional?
People running web servers are generally liable for contributory culpability, when some user breaks the law by putting the material on the server. There are legal mechanisms for relieving the server guy from this burden. The best-known mechanism is "DMCA takedown", where you publish contact information so that an offended person can serve up a proper legal claim that you are distributing material that they own copyright to. If you follow the rules, you may enjoy "safe harbor" protection against contributory liability: one of the requirements is that you have to take infringing material down. The specific requirements can depend on the nature of the liability and jurisdiction, but generally involves a "hands off" involvement where the person has no knowledge of what's going on on his server. So just disclaiming responsibility does not work. There are other more serious violations, such as distribution of child porn or transmission of top secret information. Jurisdiction is not totally central to internet questions, and I could sue you (the server guy) in US courts, or (depending on the offense: copyright infringement of a particular item) in UK courts. Nailing this down specifically to Sweden is harder, but recall that The Pirate Bay had a whopping judgment against them.
OK, so you understand that clickwraps do create enforceable contracts. the person "agreeing" to the dialog can arbitrarily manipulate the contents of the agreement terms So what? I can do a similar thing with a pen and paper agreement. You send me an agreement, I tell you I accept but secretly I have changed it. Well, guess what, when this ends up in court the judge won't care if I wiped my ass with it - I communicated my acceptance of your terms; therefore that is what I accepted. Under the hood, Google can show what the HTML was that their server sent to you and the http response that you sent back. They said "Do you accept?" you sent back "yes", deal done. What you did with the html in your computer does not matter one iota; just like what you did with pen and ink terms would.
Yes, there would still be an obligation to comply with erasure requests – if the data subject can be identified, and if the GDPR applies. This is a case for Art 11 GDPR: processing which does not require identification. The pastebin site is not required to collect identifying info just in order to facilitate later deletion. If the site is unable to identify the data subjects, then the data subject rights (like access, rectification, erasure, restriction, or data portability) do not apply. Other rights like the right to be informed and the right to object do remain, though. But if the data subject provides sufficient additional information that makes it possible to identify their records, then the data subject rights apply again. In practice, this is likely going to mean that anyone with access to a paste will be able to request deletion, since the site would have no ability to verify the identity of the data subject beyond the information in the paste. None of this absolves the site from implementing appropriate technical and organizational measures to ensure the security of this data. Even though the pastes might not be directly identifying, they are personal data and are far from anonymous. Common practices like numbering pastes with a sequential ID or showing recent pastes on a homepage have to be viewed critically. My go-to recommendation is to assign a cryptographically random UUIDv4 ID to the post, so that it is practically impossible for anyone to find the paste unless they were given a link by the uploader. Your idea to delete pastes after a fairly short retention period is also good. This helps with security, and it is in line with the GDPR's data minimization and storage limitation principles: data may only be kept as long as necessary for its purpose. On the other hand, quick deletion might not be in line with the purpose of these pastes – it all depends on context. You mention that this is an US-based site. If so, there's a question whether GDPR would even apply. GDPR will apply per Art 3(2) if the data controller is offering its services to people who are in Europe. Here, “offering” does not mean mere availability of the website, but that the data controller intends the service to be used by such people, in particular if the service is somehow targeted or marketed to such people.
I believe the relevant section is 28 CFR 35.150 - Existing facilities § 35.150 Existing facilities: (a)General. A public entity shall operate each service, program, or activity so that the service, program, or activity, when viewed in its entirety, is readily accessible to and usable by individuals with disabilities. This paragraph does not - Because of this, it seems theoretically possible that someone could complain that the youtube videos of lectures are not accessible enough to disabled persons, and therefore have them taken down. Regardless, it seems that UC Berkley decided to preemptively take down the videos in order to &quot;reset&quot; their online lectures catalogue and make large improvements. But yeah, nothing in the statute says they must take such videos down, but it would be a theoretical violation of the law to leave them up.
The platform will get in trouble for copyright infringement. The disclaimer that you are not liable does not work, legally, since the person suing you hasn't agreed to the TOS on your webpage. You can be sued for &quot;secondary infringement&quot;, meaning that not only the uploader but also you the service provider are liable. The solution to this quandry is the &quot;DMCA safe harbor&quot;, a set of rules which, if you follow them, you won't be held liable. The specific piece of law is here. The essence of the rules is that you have to have a &quot;designated agent&quot; who receives takedown notices: if a copyright owner finds their stuff on your page, they officially notify you, then you take the material down – expeditiously (no dawdling). You notify the uploader, they either accept the takedown or file a counterclaim, you notify the rights-holder, there's a waiting period, then the rights holder can file a lawsuit, or not. If the rights-holder doesn't file suit, you can put the material back up. You cannot rely solely on the intricate DMCA notice / counter-notice dance, because under para (c)(1)(A)(ii) of §512, you also must not be &quot;aware of facts or circumstances from which infringing activity is apparent&quot;.
In German Law you need to give your agreement ("Willenserklärung") to a contract or in this case terms of service. This is done by telling the other part. In some cases this can also be implied by an action (example: putting your bottle of beer onto the cashiers table is an offer to buy this bottle). As a second criteria a "Willenserklärung" needs to be the exact will of the part that declares its will (the website user in this case) §§ 133, 157 BGB or that the other side (you) could only see so (not the case here as this mainly speaks of content). If you visit a website and there are terms of services, the "Willenserklärung" is only given when the user read and agreed to the terms. If he did not, the terms of service are not applied until the user agrees to them. So I would recommend to block the website until the user agreed (overlay) as you need to proof he did when in court. Additionally there are so called AGB's in Germany. Those are contracts that are used or planed for many (more than 3) uses and set by one side (you). This may apply here, so you need to follow a lot of other rules like making sure the user had access and agreed, then there are many content restrictions and so on... I recommend consulting a German Lawyer specialized on this topic as this is very complex and includes other German laws for Media too, depending on the content of your site and terms. Also note that everything said is only based on my own knowledge and can not be used as safe legal source.
Neither the GDPR, nor the CCPA, nor any other data protection law that I am aware of, requires that when information is deleted on request, that similar information not be collected and stored in future. Under the GDPR Article 6 there would have to be a lawful basis for any processing, including storage, assuming that the GDPR applies to the directory in question. There could be a claim that such processing was lawful under article 6(e) &quot;performance of a task carried out in the public interest&quot;. I do not know if any such claim has been adjudicated. Thus there is no need to hold a database of previously erased records to determine if a new record should be blocked as &quot;previously deleted&quot;. The Wikimedia Foundation, which runs Wikipedia, I believe takes the position that the GDPR does not apply to Wikipedia, I am not sure of their detailed arguments. But surely articles on well-known people, such as a former US president, would be covered under the same provisions as would cover news reports and historical books about such a person. Perhaps that would also come under article 6(e)
As I understand it there is no obligation to 'triage' SARs or keep data 'just-in-case' that would otherwise be deleted as a matter of routine. Can we amend or delete data following receipt of a SAR? It is our view that a SAR relates to the data you held at the time you received the request. However, in many cases, routine use of the data may result in it being amended or even deleted while you are dealing with the request. So it is reasonable for you to supply the information you hold when you respond, even if this is different to what you held when you received the request. However, it is not acceptable to amend or delete the data if you would not otherwise have done so. Under the DPA 2018, it is an offence to make any amendment with the intention of preventing its disclosure. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/