Does acceptance of communication with identifying characteristics originating from a disputed territory imply recognition of that territory? To give an example: One of the more well known currently disputed territories is Crimea. As telecommunication services, and users of such, do continue to operate from that territory under the aegis of a Russian persona, (like a Crimean based website using a .ru domain or personal and business phones in Crimea using a Russian country code), does acceptance of such communication imply recognizing the territory as part of Russia? To me it seems a bit tricky because in the ordinary sense the answer would be of course. It would be silly to accept a phone call, carry on a conversation, then refuse to accept the first few digits of the phone number. If this norm holds then the communication operators and their receivers are recognizing identifying claims. However, in this case that would mean accepting that Crimea is no longer part of Ukraine. And governments are receivers of communication too. (There does not seem to exist technical means to block the propogation of such communication. And it also may not even be possible, for internet companies specifically, to refuse recognition of any technically valid domain without jeopardizing their interconnections.)
No Recognition of territorial claims is the sole province of the diplomatic branches of national government, and of heads of state. In the US it is the State Department, and ultimately the President. The actions of telephone operators and people engaging in other forms of communication cannot and do not bind the decisions of the President, or of other heads of state. Besides, there may be cases in which a telephone country code or a web domain may not match the actual, undisputed legal status of a territory. Accepting a phone call does not affect a country's legal status. For decades the US did not recognize the communist regime in China. Legally, it considered that the Republic of China (aka Taiwan) was the only valid government, and the acceptance of telephone calls did not change that.
If the data controller has “reasonable doubts concerning the identity of the natural person making the request”, then “the controller may request the provision of additional information necessary to confirm the identity of the data subject” (Art 12(6) GDPR). Until the data subject provides this information, the request is paused. But what are reasonable doubts, and what additional information can the controller request? The GDPR itself provides no clear guidelines, though general principles apply – the additional information must be necessary, adequate, and proportionate for the identity conformation purpose. The controller's obligation to comply with access requests must be balanced with the controller's obligation to ensure the security of data by rejecting invalid requests. Just accepting any request without any verification would also be a breach of the GDPR. For example: If the company identifies data subjects by email address, then demonstrating control over the email address would be an appropriate verification step. But just mentioning the email address would not be enough since it could be someone else's email address. If the company provides a website where data subjects have created user accounts, then being able to log in to the account would be an appropriate verification step. In these examples, asking e.g. for government photo ID would not be appropriate because that doesn't help strengthen the link between the person making the request and the personal data being processed. Such data collection would be disproportionate and unnecessary. In contrast, if you walk into a bank and ask for a copy of your data, it would be entirely appropriate for them to ask for government ID because (a) the higher general risks warrant stronger checks, and (b) such ID will help confirm that the person making the request is indeed the proper account holder. The bank will also have been legally required to request ID when the account was originally opened, so that asking for ID as an identity verification measure during this later request won't involve collection of more data than they already have. (These examples were made up by me and are not official, but read on.) The EDPB has issued draft guidelines on the right of access 01/2022, which also discuss the issue of additional information for identity verification in sections 3.2 and 3.3. In particular, paragraphs 73-78 talk about IDs: 73. It should be emphasised that using a copy of an identity document as a part of the authentication process creates a risk for the security of personal data and may lead to unauthorised or unlawful processing, and as such it should be considered inappropriate, unless it is strictly necessary, suitable, and in line with national law. […] it is also important to note that identification by means of an identity card does not necessarily help in the online context (e.g. with the use of pseudonyms) […]. 75. In any case, information on the ID that is not necessary for confirming the identity of the data subject, […] may be blackened or hidden by the data subject before submitting it to the controller, except where national legislation requires a full unredacted copy of the identity card (see para. 77 below). […] 76. […] Example: The user Ms. Y has created an account in the online store, providing her e-mail and username. Subsequently, the account owner asks the controller for information whether it processes their personal data, and if so, asks for access to them within the scope indicated in Art. 15. The controller requests the ID of the person making request to confirm her identity. The controller's action in this case is disproportionate and leads to unnecessary data collection. […] Example: A bank customer, Mr. Y,, plans to get a consumer credit. For this purpose, Mr. Y goes to a bank branch to obtain information, including his personal data, necessary for the assessment of his creditworthiness. To verify the data subject’s identity, the consultant asks for notarised certification of his identity to be able to provide him with the required information. The controller should not require notarised confirmation of identity, unless it is strictly necessary, suitable and in line with the national law […]. Such practice exposes the requesting persons to additional costs and imposes an excessive burden on the data subjects, hampering the exercise of their right of access. 77. Without prejudice to the above general principles, under certain circumstances, verification on the basis of an ID may be a justified and proportionate measure, for example for entities processing special categories of personal data or undertaking data processing which may pose a risk for data subject (e.g. medical or health information). However, at the same time, it should be borne in mind that certain national provisions provide for restrictions on the processing of data contained in public documents, including documents confirming the identity of a person (also on the basis of Art. 87 GDPR). Restrictions on the processing of data from these documents may relate in particular to the scanning or photocopying of ID cards or processing of official personal identification numbers. To summarize: controllers can request IDs only in comparatively niche scenarios, and must then take additional safeguards to protect the sensitive document (e.g. instructing the data subject to redact parts of the ID, not making copies, and immediately deleting the ID after successful verification). A lot here comes down to national laws, which may explicitly require or forbid use of the ID in this context. The EDPB guidelines are not binding or normative, especially since this guidance is still in the public consultation phase. However, the guidelines present an overall consensus of the national data protection authorities in the EU, and the guidelines are regularly cited by courts. In practice, many controllers do ask for disproportionate amounts of data. Sometimes this seems to be an attempt to discourage data subject requests, which would clearly be non-compliant. In some cases, this is due to a narrow interpretation of “reasonable doubts” in which they try to eliminate any doubt about the identity. If the data subject and data controller cannot agree on a suitable identity verification process, then the data subject can: Art 77: lodge a complaint with a data protection authority, and/or Art 79: sue the data controller in court, both for compliance (fulfilling the request) and for compensation (if damages were suffered). It is worth noting that the data controller is responsible for being able to demonstrate compliance (Art 5(2) accountability principle), such as demonstrating the apparent reasonable doubts to a supervisory authority or to a court. When the controller requests ID, the controller has the burden of proof to show that this is compliant.
See this working paper by Silvia Ferreri for an excellent write-up of this issue. The key point is that because each linguistic version of legislation is equally authentic, none can be taken as the authentic version. The court then resolves this by applying two principles: comparing the linguistic versions and giving deference to legislative intent. This is necessarily a case-by-case analysis. The paper calls attention to Case C‑445/09 arising from the Netherlands, where 9 different linguistic versions are compared and shows that the straightforward Dutch reading of the legislation in question isn't compatible with the other linguistic versions or legislative intent. In paragraph 25, the decision also contains a concise summary of the general principle of interpreting laws in multiple languages: According to settled case-law, the need for uniform application and, accordingly, for uniform interpretation of an EU measure makes it impossible to consider one version of the text in isolation, but requires that it be interpreted on the basis of both the real intention of its author and the aim which the latter seeks to achieve, in the light, in particular, of the versions in all languages (see, inter alia, Case 29/69 Stauder [1969] ECR 419, paragraph 3; Joined Cases C‑261/08 and C‑348/08 Zurita García and Choque Cabrera [2009] ECR I‑10143, paragraph 54; and Case C‑473/08 Eulitz [2010] ECR I‑0000, paragraph 22).
There is no exhaustive list of material banned specifically in WhatsApp profile pictures, but there is an exhaustive list of crimes that § 140 StGB applies to: Whoever rewards or approves of publicly, in a meeting or by disseminating material (section 11 (3)) in a manner which is suitable for causing a disturbance of the public peace one of the unlawful acts referred to in section 138 (1) nos. 2 to 4 and no. 5 last alternative and in section 126 (1) or an unlawful act under section 176 (3), sections 176a and 176b, under section 177 (4) to (8) or section 178 after it has been committed or culpably attempted incurs a penalty of imprisonment for a term not exceeding three years or a fine. In turn, sections 138 and 126 enumerate various crimes, whereas the other mentioned sections relate to (child) sexual abuse. Section 138 (1) no. 5 lists: murder under specific aggravating circumstances (section 211) or murder (section 212) or genocide (section 6 of the Code of Crimes against International Law) or a crime against humanity (section 7 of the Code of Crimes against International Law) or a war crime (section 8, 9, 10, 11 or 12 of the Code of Crimes against International Law) or a crime of aggression (section 13 of the Code of Crimes against International Law) The last alternative is indeed a “crime of aggression” which is defined in particular as “the use of armed force by a State against the sovereignty, territorial integrity or political independence of another State, or in any other manner inconsistent with the Charter of the United Nations”. In Germany, there is a clear consensus that Russia is waging a war of aggression against Ukraine. The “Z” symbol is used in a Russian context in support of this invasion. It is therefore understandable that a prosecutor has the reasonable suspicion that publicly posting a Russian flag with the Z symbol is public approval of this crime of aggression. Spiegel Online reported of 140 similar cases across Germany. Thus, the photo could be real. Of course, the accused should not accept this invitation to talk to the police and instead get themselves a criminal defense attorney. A defense strategy would likely argue that the profile picture was not “suitable for causing a disturbance of the public peace” so that the conditions of § 140 StGB were not fulfilled. More realistically, the defendant would not contest a fine.
That a company (C) has a website that can be accessed from a given county does not mean that the company operates in that country. If C is located in country A, markets and advertises to country A, offers products designed to appeal in country A, has its site only in the primary language of country A, uses servers located in country A, and has all its assets and physical offices in country A, it is not operating in country X, even if a few people from X do business with C over its web site. Country X may have laws which claim to apply to C or its web site. It will find it hard to enforce those laws, particularly if owners and officers of X do not travel to X. It will find it hard to extradite anyone for violations of the laws of X unless those actions are also crimes under the laws of A. If X is a major, powerful country such as the US, the UK, or the EU it may be able to get A to enforce its court orders, or to use its influence over the banking system to impose penalties on C. If X is North Korea, or even Brazil, it is probably out of luck. Thus the management of C needs worry primarily about the laws of A, and to a lesser extent the laws of major countries that make some effort to enforce their laws outside their own borders, such as the GDPR, or certain US laws. It probably has little reason to worry about the laws of other countries. If A is itself a major country that can easily resist any pressue from X, C has even less reason to worry. If C does significant business in countries D and E, and particularly if it opens physical offices in D or keeps assets in E, it will have much more reason to worry about the laws of D and E. If it does advertising in the D &amp; E markets, this also gives C more reason to be concerned with their laws. There is always some risk of X finding a way to enforce its laws, but the risk is small.
The &quot;letter&quot; you quote says more than what Ionos says publicly, the latter not mentioning any date. The most obvious possibility is Treasury Department sanctions against Russia: while the sanctions don't necessarily prohibit servicing and any all Russian nationals or residents, Russia is subject to sanctions and that's what the TOS says. A problem is that the TOS refers to a &quot;country subject to U.S. Treasury Department embargo restrictions&quot;, which is not legally defined. Here is the Treasury Department's explanation of that point (which is that there are very many types of restrictions: there is no legal category of &quot;embargo restrictions&quot;). One could then argue, in one's breach of contract arbitration hearing, that the clause cannot reasonably be interpreted the way the company (possibly) intends it to be. The force majeure clause does not seem relevant unless they see some way in which the invasion of Ukraine makes it impossible for the company to fulfill the contract with Russians.
The international laws of war are generally much easier to apply in the context of a group of people claiming to be a state, than in the context of a group of people who do not claim to be a state. For example, one of the critical questions for classifying an individual under the laws of war is whether the enemy combatant is publicly identified as a soldier of the entity against which a country has declared war. In the context of an entity that claims to be a state, like Daesh, the distinction between identified soldiers, civilians, and covert combatants is relatively workable to apply. There are actually tens of thousands of people who personally identify themselves as regular soldiers loyal to a particular Islamic State with a defined territory, chain of command and political leaders, and there are millions of people who personally identify themselves as civilian subjects of Daesh who are not soldiers, and there are probably even people who personally identify themselves as covert combatants for Daesh - like some of the European terror incident perpetrators we've seen over the last couple of years. People applying the laws of war still need to do their best to accurately determine who fits in which category, but the categories in question are bona fide meaningful categories that are mutually socially agreed to by everyone involved that are reasonably well defined. Recognition of something as a "state" for law of war purposes is also something quite different from recognition of something as a state for diplomatic purposes. Inherent in the laws of war is the understanding that one side may believe that the other side is an usurper or illegitimate government. In contrast, in conflicts with many organized groups that are clearly non-state actors in the eyes of all involved, the distinction between publicly identified soldiers of a state and covert combatants is often ill defined. Calling people citizens or subjects of that non-state group is likewise hard to analogize to the kinds of situations contemplated when the laws of war were devised. Does one have to be a "member" of the organization to qualify as a subject? Does one have to provide "material support" or conspire to carry out some specific acts? Or, does subjective support or a bare public statement of allegiance on a facebook page or bumper sticker suffice that did nothing material to aid the cause suffice? This matters because, under the laws of war, subjects of an enemy can be interned humanely even if they are not combatants, and the lawful treatment of public and covert combatants is very different under the laws of war.
The UN charter is really hard to amend It requires approval by two-thirds of its member states, and ratification by two-thirds of its member states, including in both cases by the five permanent members of the security council (the USA, the UK, Russia, China, and France). It's happened a total of 3 times, in each case, for completely non-controversial reasons.