Can an API forbid caching of the data it provides? Not sure whether this is the best place for this kind of question, happy to move it if needed. I'm designing a web application that will make use of a (non-free) third-party API. Paying a monthly subscription fee would give me access to a certain amount of API requests per month, after which I'd have to pay a flat fee per individual request above the threshold. However, one thing that confuses me is that the company providing the service states in their terms and conditions that it's forbidden to cache user-requested data for longer than an hour, after which (and I'm quoting) I must delete my cache and refreshed the data via the API. Is this limitation enforceable? What if the end-user is the one caching the data on their end? I'd have no control over this at all... If it makes any difference, the information provided by the API is not proprietary, the only service they offer is an easy-to-use API and some extra functionality on how to query the underlying information.
Is this limitation enforceable? Sure it is; you agree to a TOS or EULA with the company to use the API, and that's a legally binding contract. If the contract stipulates limits to caching, that's enforceable in civil court by lawsuit (possibly criminal court, which will depend on jurisdiction). What if the end-user is the one caching the data on their end? If your end users might be caching, that's something you may need to outline in your own TOS/EULA to adhere to the API's stipulations. And, the API may not allow you to serve API data to your own users; read it and see. the information provided by the API is not proprietary,... That doesn't matter; you're using their API and service. If you don't like that, you need to write your own API or develop your own queries for the information. I'm designing a web application that will make use of a (non-free) third-party API. If that App is going to be distributed and used by others, talk to a lawyer about the API and have them write a TOS/EULA for your App; you run the risk of significant legal liability with a publicly distributed App that uses someone else's API, paid or free.
This is possibly but not necessarily fine. The data controller (the garage) is responsible for safeguarding your personal data. They must take appropriate safety measures, but this depends a lot on their own risk assessment. For example, to protect the data from being used by employees for their personal purposes, the controller might use organizational measures like a policy “you're not allowed to do that.” Many companies allow employees to use their personal devices for work purposes (BYOD). When the data controller allows this and takes appropriate safety measures, everything is perfectly fine. The company still has to make sure that the data is only processed for legal purses and deleted afterwards. Implementing a BYOD policy in a GDPR compliant manner is difficult but not impossible. A data breach has occurred when the security measures were insufficient and your data was deleted or disclosed without authorization. Your scenario would only be a breach if the company did not have a BYOD policy and the salesman used their personal phone, and arguably then only if that device is also breached. However, do not discount the alternatives: they do have a BYOD policy and the salesman is acting within their instructions the salesman was using a company-controlled device, not their personal phone If you have good reason to believe that your data was mishandled (and these alternatives do not apply), then the GDPR offers you the following remedies: You can of course complain to the data controller, especially if they have a dedicated data protection officer. You can lodge a complaint with a supervision authority, which is the ICO in the UK. They expect you to attempt to resolve your issue with the controller first. The ICO can then decide if they want to investigate the issue. You can sue them for compliance and for actual damages suffered (you have none, though). Note that all of these alternatives are more effort than they are likely worth. In particular, the garage can always correct the problem, e.g. by getting your contact info deleted from the personal device or by creating a retroactive BYOD policy.
No You are limited to “your ... use only”. You are not given permission to make this available for 3rd parties either commercially or for free.
Pragmatically, on your server side, there is nothing about an http request from a computer program that is any different than one typed manually, so if the "robot" doesn't intend to honor your demand, there's little or nothing you can do. Most sites implement a "robots.txt" file in their root directory that defines the site's policy, and many/most of the web crawlers and spiders respect that policy...but it's an honor system. You can use sophisticated metadata methods to block programmatic access to your site...refuse new connections less than five seconds apart, for example. Edit: There's no law that says you have to honor an http GET request. You can allow or refuse them at your most capricious whim.
All the CC licenses permit anyone to use the licensed content, and to make copies of it for others. Some of them permit using it for commercial purposes, others (the ones including the -NC- clause) do not. Some CC licenses permit creating modified versions of the original work (derivative works), others (the ones including the -ND- clause) do not. I do not know of any standard license which allows users to create and distribute derivative works, but not to distribute the original. The license used by Project Gutenberg permits re-use and re-distribution, but if a fee is charged beyond recouping expenses requires the removal of the PG name and logo. One problem is that if derivative works are allowed, this would include works which are only trivial modifications to the original, which would have the effect of allowing distribution of the original. If the main concern is about commercial sales, possibly a CC-NC-SA license would effectively serve the purpose? That allows redistribution, including of derivative works, but forbids commercial reuse or distribution without separate permission, and requires all redistribution to be under the same license. Otherwise a new license for this situation might have to be created. It is often a good idea to have the assistance of a lawyer with IP expertise in creating a new license, or the wording chosen may have unexpected effects or include unintended contradictions. Or one could simply place a basic copyright notice along with text such as "Modified versions may be created only with permission from the author. Request permission at work-permisisons@example.com". However, if the work proves popular, there might be a large volume of requests.
Yes Best is to call them and let them guide you to the right department. https://www.microsoft.com/en-gb/contact.aspx In reality you can give up. They will never ever give you the permission to use the icon, even if you'd pay for it. Why? Because as soon they give the permission to someone others will try to use it too and their legal stand would be more difficult since they softenend the use rights of that icon/intellectual property, opening doors for people who copy without thinking of the legal implications and scammers. EDIT: To add; As far I know you're not allowed to take stuff from wikipedia without noticing them/linking to them. That your app is free also doesn't matters. Maybe you're even showing ads in your app giving it a commercial goal.
I'm pretty sure that under GDPR, you can indeed request them to send all data they have on you. If it's a complex request, they may charge you something like £10. If they have a lot of data on you, they may list the categories of data they have and ask you to pick one, rather than them having to collect and send everything. They should respond within one month, but iirc in the UK implementation, they can inform you (within that month) that they will respond within three months instead. For the rest, I only know current Dutch law. GDPR is not that different from what we already had (in general terms) and in many cases it even extends it. Under our law (WBP), you can also request a correction of the data in case it is incorrect, or deletion if they no longer need it for the purpose for which it was collected and stored. I don't really know how that works out in practice though, as Facebook can of course claim that "being able to connect you to your friends when you sign up for WhatsApp or Facebook with that number" is a legitimate purpose (in their eyes). They might also not have your full name and therefore not be able to connect your data to your request. Or, perhaps, they have only your full name (and there are probably more people with your name), so they'll have a hard time verifying that it's really your data which they would be handing over or deleting. The company is required to verify your identity before acting on your request. How they implement that is up to them. Under Dutch law, if I remember correctly, any data that can be connected to your person by any party is personally identifiable information (PII). While Facebook might not be able to find who's behind a phone number, your carrier most certainly can. Therefore, the data falls under PII protection laws and they will have to implement a way to verify you and get you your data. Finally, whether your local laws apply to Facebook, I don't know exactly. There's lots of information on this though, so you should be able to find it. Generally, countries say that if something happened within their territory (e.g. you signed up for WhatsApp while in the UK), their law applies. Companies, I've read, will instead try to claim that their main office is in SomeCountry and therefore SomeCountry's laws apply. But I'm pretty sure you'll be able to find a Facebook office somewhere where GDPR applies, so that's probably fine. While not an exact answer and while I am not sure about everything, I hope this gave you some pointers to go on!
Any processing of personal data needs a legal basis, for example necessity for some contract or legitimate interest. If no other legal basis allows the processing, you need to acquire consent. Consent must be freely given. If something is gated behind consent without that consent being really necessary, this might coerce users and they would not be able to consent freely. The GDPR does not have a hard ban on this, but it explicitly calls out that this case must be considered when determining whether consent is valid. So what your company is trying to do is in a dark grey area. Not necessarily wrong, but likely so. Consent could be made free if users have an actual choice. For example, some online newspaper sites had success with a “pay or consent” wall. (Success in the sense that some data protection authorities allowed this). In your case, this could mean that users either consent to extra data collection, or that they buy some reasonably priced premium mode. But none of this is for you to decide. You can voice your doubts that the software would be compliant. You could also ask if the Data Protection Impact Assessment document for this proposed processing is available (creating such an assessment is likely mandatory in this case). But in the end, it is the company's obligation to be compliant, and this responsibility is largely shouldered by the company's data protection officer (to whom you can turn with further questions).