Does Elon Musk have any grounds for legal action against people who track his plane? Most airplanes, including Elon Musk's private jet, are required by law to broadcast their location throughout a flight in a well-documented, unencrypted digital format called ADS-B. This system is a critical part of aviation safety infrastructure. Several services, such as FlightAware, FlightRadar24, and ADS-B Exchange, collect this information with ground-based radio receivers and publish it on the Internet. FlightAware and FlightRadar24 will hide aircraft on request from the owner, but ADS-B Exchange does not, and provides unfiltered data. Elon Musk has threatened to take legal action against people who share tracking data from his jet online, referring to it as &quot;doxxing&quot; and claiming it's a threat to his safety. He also bans Twitter users who post any plane-tracking information. I don't see how he could have any claim for legal action against people who track his jet. As I have mentioned, ADS-B data is by no means private. When you are on an airplane, there is no reasonable expectation of privacy for your location. Collecting public information about a controversial public figure seems like a very clear case for First Amendment protection. This wouldn't affect his ability to ban Twitter users; he can (within reason) ban anyone for anything on Twitter because he owns it. (It's quite odd that he claims to be a free-speech absolutist but censors the reposting of public information, but that's beside the point.) It would, however, seem to preclude any involvement of the government. What possible legal action could Elon Musk take against people who post ADS-B data from his private jet?
Specifically, the threatened action is about stalking and implicit threats to his family. I'm not suggesting that there is a lot of merit to the claim, but that is how he is presenting the argument. The question would be where there is an intentional, repeated following of a person for the purpose of harassing the person with express or implied threats of violence or death. The jury would have to decide whether the implicit threat is credible (somebody plans to blow him or his family out of the sky), a decision would probably turn on the number of death threats he receives.
I think this shows a misunderstanding of the meaning of the GDPR. A data subject has the right to demand information, correction, deletion etc. about some of their data held by some institutions, depending on the legal basis for the data processing. One John Smith does not have the right to see the data of any other data subject named John Smith, and he cannot even demand to know if there are other John Smiths in the database. The data controller has to make reasonable steps to ensure that an individual who seeks account information is in fact the individual who is the data subject. In the case of an email, that's usually easy -- if John Smith can access the mail account jsmith@sample.org, one can assume that he is the John Smith who opened the account. If not, then not. If the data controller has the birthplace and birthdate in their records, they can possibly match that against some government-issue identity document, too, but why would they have that data?
It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR: The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. If the website terms which you agreed to don't include this data matching, then that processing is not lawful. The rest of Recital 50 is relevant and worth quoting in full: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations. It seems to me that an anonymous account could reasonably expect that the &quot;further processing&quot; of data matching is not in the public interest, an exercise of official authority, scientific or historical research or statistical. There is no link between the data matching exercise and the purpose for which IP addresses are normally collected: the operation and physical security of the website. Now, it may well be that the website terms do allow this data matching to discover links between accounts, or in any case prohibit having two accounts and allow reasonable methods to discover such links. It's also possible that a court has ordered the processing (as Iñaki Viggers has mentioned. We don't have that information; but ostensibly one wouldn't normally expect a personal account to be examined in this way, and certainly wouldn't expect any link discovered to be relayed to a third party.
No, you have not misunderstood what "Uber" is. Uber allows private individuals to function as a private car service (much like a Taxi but not as regulated). Individuals must provide their own vehicles, or Uber partners with certain car rental companies to offer discounts to Uber drivers for using rented cars. The video you posted, the individual was told that the officers wanted to run a dog around the car because the driver was refusing a voluntary search. The driver's concern was that if they found something, that they would arrest the driver saying that whatever they found was his. He was trying to say "if you find something, you'll say I'm driving, it's my car, it's my contraband". This is a legitimate concern because police often hold the driver responsible for what they find on the passenger, or if the passenger were to stuff drugs (or whatever) in a place accessible to the driver, the driver could be charged. He is not implying that it isn't "his car", he's trying to reason with the officers saying that if they do find something, they shouldn't attribute that to him automatically.
That GDPR Disclaimer is no protection in some jurisdictions: the applicable laws to that situation in germany for example don't care about the GDPR: Cold calling, mailing, or e-mailing private people to advertise services all is handled by the same law: Without the consent it is expressly illegal under §7 of the law against unfair competition (Gesetz gegen unlauteren Wettbewerb UWG) and such cases are rather Slam-Dunk if the origin can be made out. The punishment can be a 300.000 € fine. The fact that to email someone you need their e-mail address and that e-mail addresses and private addresses are by default considered personally identifiable information is making it worse for the advertizer: Without either an exception (there is none available to cold-emailing) or special allowance of the person the data belongs to, you violate §4 of the federal data protection law (Bundesdatenschutzgesetzes BDSG) just by handling their e-mail address. That's a separate crime from the UWG one, adding up to another 300.000 € fine under §43 BDSG - or even up to 2 years in prison under §44 BDSG! Oh, and if the email does not contain a proper sender's address, that's another chance for a huge fine under the UWG... So, GDPR is your least trouble, if you violate the marketing laws of a country, or their own data privacy laws. A disclaimer means nothing as the act of sending the mail, even to an unintended addressee, is what is illegal and the law as written does not give a damn about 'I didn't want to advertise to that person' when in fact you sent them unwanted advertisements. Oh, and the very repository you suggest? It would violate the very same §4 BDSG and be illegal for processing private data if it was not actively asked to do that by the end user. As a result, that database is useless: It does kick back all people not in its database. Its database is incomplete because only few people give their address to that database as people not aware of the database never add their data on their own. So it regularly violates §4 BDSG with every German citizen's e-mail address it gets and kicks back, and claiming those addresses would be OK, it throws the company trying to check the database under the bus because they rely on data that is impossible to be reliable. tl;dr Don't do cold-(e)-mail marketing. You throw yourself into boiling oil with a lit torch in hand. further reading Other laws banning such behavior I had listed here, and I quote myself: The US has the CAN-SPAM-Act, which illegalizes sending unsocialised advertisements. You may NOT send a mail if any of the following is true: it has no opt-out the email was gained by 'harvesting' contains a header not matching the text contains less than one sentence the adressee does not have any relation to you In fact, you are liable for a 5-digit fine per infringing e-mail in the US. The FTC itself suggests to never buy e-mail lists - as E-mail harvesting or generating any possible e-mail adress itself is illegal.
A litigant could issue a subpoena to you demanding the information on your phone relevant to their case. If your employer or you are parties to a lawsuit, you can also be required to provide information through what is a called a &quot;request to produce&quot; issued by one party to another party without a subpoena, and under general information disclosure requirements in some lawsuits that apply to parties and people affiliated with them. For purposes of this answer, a subpoena, a request to produce, and a disclosure obligation of some other kind are all basically equivalent in the ways that matter. The search warrant process in criminal investigations, however, is quite different, but this is rarely used in the contexts that you are concerned about in your question. Usually, the obligation would be to provide a copy of the relevant data (e.g. emails and text messages and phone call history and metadata related to the case), rather than to turn over the phone itself, and this would usually involve a couple of weeks notice or more. Absent extreme circumstances (e.g. you are a flight risk defendant, or only technical means can get access to secret malware not accessible to an ordinary user on it), you are usually allowed to participate in sorting out what is and is not responsive to the request and they cannot just demand &quot;everything on your phone.&quot; If the subpoena demand is overbroad, you (or perhaps your employer's attorney), can move to quash the subpoena or limit its scope before you have to comply in the court that issued the subpoena. You could also make objections based on, for example, attorney-client privilege or the 5th Amendment right against self-incrimination, in an effort to object to the subpoena's demands for information. Absent a criminal case where you are a suspect, it would be very rare to actually seize the entire phone itself or to search all of its contents without your involvement. Note that this is a risk that almost everyone who communicates about business by phone faces. For that matter, even people who don't communicate about business by phone face this risk. For example, suppose you see a plane crash into a house while you are on the phone with your brother talking about last night's baseball game, and then mention that fact when interviewed by police investigating the crash that you witnessed. You and your brother's metadata from your calls with each other from that afternoon could be subpoenaed, in connection with a wrongful death or property damage lawsuit arising out of the crash, to help determine precisely when the plane crashed. It doesn't matter who owns the phone. Usually the subpoena will apply to all accounts and devices within your possession, custody and control. So, even if you don't have the phone in your possession when you are served with the subpoena (e.g. your son borrowed it for the week), and even if you made a call on your spouse's phone, if you have the legal right or practical ability to get the information, you must provide it. The apps installed on the phone don't matter. What matters is whether there is information relevant to the case (or potentially relevant to the case) that can be accessed with your phone, and whether the subpoena has asked for it.
For land ownership records and other similar scenarios such as business directors, the requirement for these to be public will be in legislation rather than a contract - this provides the legal basis, see GDPR Article 6(1c). Additionally when government departments are doing it they also have 6(1e) as lawful basis: "1. Processing shall be lawful only if and to the extent that at least one of the following applies: ... (c) processing is necessary for compliance with a legal obligation to which the controller is subject; ... (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;" -- GDPR, Article 6(1c,e). I'm not familiar enough with the specific legislation that will apply here but pretty sure this will be the case, and having said this you may well find public registries also become less public going forward. The reason ICANN has come under fire, is partly because under GDPR privacy is a protected fundamental right and therefore to comply personal data should be kept private by default and privacy never something you would be required to pay extra for. Any contract ICANN have in place with their registrars will not override legislation, it is in fact the other way around. "2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons." -- GDPR, Article 25(2). This doesn't stop ICANN from maintaining a register of domain name owners (registrants), but it does mean they can't just publish all records upon request to anyone anymore - whether people will be granted access to personal data will now depend on if they have a lawful basis for this, and in these cases their processing of the personal data will be limited to those purposes. Being nosey doesn't count! "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of the contract." -- GDPR, Article 7 (4) - Conditions for consent. What this means essentially, is that if the consent is conditional for the contract it will not be treated as freely given, and therefore not valid - it will no longer be acceptable to contractually bind the provision of a product or service with consent to publish personal data or any other form of processing such as marketing mailing lists. Looking now at the specific points you have raised: "GDPR article 6 allows for processing of personal data on a contractual basis (section 1b)" Whilst this is true, this is only part of it - it doesn't allow for unlimited processing for any purpose and sharing it with any people, if you look at Article 5(b) it states that the information is collected for specific explicit legitimate purposes. Each purpose requires its own legal basis and needs to be compatible with the principles of GDPR. Without consent, ICANN currently does not have a legal basis to make the WHOIS records public for EU citizens and should have adopted some technical controls to require them to opt-in if they wish to be included in the public register. They're coming under fire for non-compliance having been given 2 years to prepare and change their systems/processes. "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;" Again whilst this is true, not all processing is necessary for the performance of a contract. In the same way people must give consent to receive marketing communications, they must freely give consent for their information to be shared/published (separate to the contract for provision of service) in the absence of other lawful basis for this processing. "Also section 1c, processing is necessary for compliance with a legal obligation to which the controller is subject;" There is no legislation which requires them to publish the personal data of domain name registrants. In this paragraph 'legal obligations' refers to those required by legislation (i.e. statutory obligations), not contracts (or non-statutory obligations) which are covered under Article 6(1b). "And finally section 1e, processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;" ICANN has no official government-assigned authority, and publishing the personal data globally is not in the interests of the data subject's or others' welfare or well-being - this is what is meant by 'public interest'. As far as I can see what ICANN are actually doing to comply seems to be accepted by the European Data Protection Board, they are only 'under fire' as you say because they are late in doing so. The deadline was 25th May 2018 and they had 2 years to prepare like all other organisations.
You are right that a visitor of a website does not expect to be tracked upon opening the website. But when using Google Analytics configured in the way explained in my other post, the visitor is not tracked. At least not in a way which violates the GDPR. You worry about the cookies. I also found this article which also does and suggests to either: change the _ga cookie to a session cookie, so it will be removed when the browser is closed. To do this, set the Cookie Expiration variable in your Google Analytics Settings to 0. completely disable cookies. (GA does not require cookies). To do this, set the storage field to none: ga('create', 'UA-XXXXX-Y', { 'storage': 'none' }); If you do not disable cookies, cookies can be used for tracking, which is more general defined in the GDPR as profiling. Profiling is defined in Art. 4 GDPR as: ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; Art. 22(1) GDPR disallows profiling. Therefore in the settings menu from Google Analytics you have to disable data sharing and data collection. So data will only be used for the analytics function. But because you have configured to Anonymize your visitors IP Address, the part of the IP address used for this, is no longer considered personal data. This is because approx. 250 other users share the same part of the ip address which is stored, so data is not distinguishable between those 250 users. The anonymisation used by google is currently considered good enough. At least by the Dutch DPA. This might change if someone proves it is not good enough anonymized. Note that I am not a lawyer either, but I have read from multiple experts that analytics can be a "legitimate interest", the same way marketing can be a legitimate interest. This way configured the privacy impact is considered very low. It is also very important to note that a DPA consideres GA Google Analytics compliant. Even if a court would not agree in the future, you are acting in good faith if you follow those instructions, so you will probably not be fined. The DPA does currently not suggest to change the _ga cookie to a session cookie, or disable cookies completely. Note that the GDPR does not require doing anything to make it technical impossible to track someone. If a website has access to the data to track someone, but "promises" not to do that, that is fine. And rules regarding the usage of cookies in general, is not part of the GDPR, but (currently) part of the ePrivacy Directive. Only the way to ask for consent for storing cookies is defined in the GDPR.