A scholarship organization is publishing my personal information on their website In February 2018, I received a one-time scholarship (1000 €) from a private association in the EU. A few months ago, I noticed the organization published on their website private information of the scholarship recipients: name, town and photography of each person. This is a problem for me, because this appears on the first page of results when I search my name on Google. This means, everyone who looks up my name on Google will be able to know where I live. This is even more a problem, because I live in a small town, so it is very easy to deduce my house address. I had emailed the association, and I was told they were &quot;not even sure they could technically remove the information&quot; because &quot;this is the first time we received such a request&quot; and &quot;no scholarship recipient ever had a problem with this&quot;. This was a few months ago, and my personal information is still published on their website. I would still prefer to have this information removed. How should I politely approach this situation?
This is clearly personal information (PI) , and indeed personally identifiable information (PII). and so is Personal Data under the GDPR. Under Article 6 of the GDPR any processing must have a lawful basis. There are 6 possible bases. The most likely ones here would be (a) consent, or (f) legitimate interst, but the private association may claim some other basis as well. They should tell you what basis or bases justify their processing of this information, which includes storing it and publishing it. Under Article 13, Paragraph 1(c) the association should have informed you of the purposes for which information was collected when it was first collected. Under Article 15 paragraph 1 you are entitled to request and obtain from the association (or any other Data Controller) a statement of what PI about you they hold. along with this they must supply various other information including; (a) the purposes of the processing; (b)the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; and other specified information. Article 17 paragraph 1 provides that: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay ... if one the the specified conditions applies, particularly: 1(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; 1(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) Article 21 paragraph 1 provides that: The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Thus I would suggest that you send a written communication to the association, stating that you: Request access to all PI which they have about you, as permitted by GDPR article 15 paragraph 1; Request that they delete any such information from the public website and any other publications, as permitted by GDPR article 17 paragraph 1; State that you object to further processing of this information under GDPR article 21 paragraph 1; Request information on the name and contact info of the relevant supervisory authority under GDPR article 15 paragraph 1; State that you expect these requests to be complied with promptly, in no event later than 30 days. Mention your prior request for the public info to be deleted, and that several months have already elapsed. Give the exact date of the prior request. I would suggest sending these requests, together in a single email, specifically mentioning the relevant GDPR provisions. I would suggest sending a copy of this by registered mail, and retaining a copy, along with the identifying number of the registered letter. In the letter, mention the email. If the association does not promptly respond in a way you consider satisfactory, you may wish to file a complaint with the relevant data protection supervisory authority. You may also wish to consult a lawyer with experience in this area to determine if you have any legal recourse if the association does not comply.
There are not enough facts to draw a conclusion First, it’s not clear that the document you signed amounts to a contract. For example, what consideration did the school give you in return for the permission you gave them? Providing you with an education doesn’t count - they were legally obliged to do that already. If it is a contract then whether and how it can be revoked would depend on the terms of that contract witch I’m guessing you don’t have a copy of. Notwithstanding, as a minor, you have the right to void the contract until a reasonable time after you turn 18. Even if it is now many years since that happened, it might be reasonable since you only just discovered the website. If it isn’t a contract, then it would be revocable at any time. Practicalities Make a fuss and they may take the photos down even if they are not obliged to. They presumably have plenty of photos of kids who aren’t you and aren’t complaining and if you make it so it’s easier to change the website than to deal with you, thy’ll change the website. I suspect their inertia is because they once paid a web developer to create the site, it has never since been updated, they don’t know how to do it, and they don’t want to have to pay someone to find out. Otherwise, why would they have photos of ex-students rather than current students? If so, an offer by you to cover the costs, might solve your problem.
From a German perspective, it would be absolutely normal and expected that you're providing identity &amp; contact information publicly. Per §5 TMG (Impressumspflicht / Anbieterkennzeichnung) this is required for German tele-media offerings, such as websites or email providers, even if non-commercial. Whereas for you as an upstanding and diligent email provider an abuse@... address should be enough, the German context expects a street address where you could be served with a lawsuit… There absolutely are privacy and free speech issues with this compelled self-doxxing. But by running an email service, you're not just acting as a private person. Your privacy interests and the transparency and security interests of other people have to be balanced. Now since you are not in Germany, the TMG does not apply to you. You have no legal obligation to provide this information. However, the ISP also has no legal obligation to to deliver your email. The ISP does have an obligation to apply appropriate organizational and technical safety measures. It seems that one organizational measure they have found appropriate is that they will only deliver emails from providers that provide public contact information, as would be the norm in Germany. I am not entirely sure how the GDPR applies here. The GDPR doesn't really allow or prohibit disclosures of personal data, it just requires that every purpose of processing for personal data has a legal bases per GDPR Art 6. One such legal basis is a legitimate interest, which boils down to a balancing test between your rights and freedoms and other people's interests. I'm also not sure if the contact information should be classified as personal data in this context, because the contact info primarily relates to your role as an email provider. I'm also not sure if the ISP is processing your personal data in the sense of the GDPR when they merely require you to publish it on your own site. They would be processing it as soon as they scrape, store, or otherwise use this info.
The "Contribution activity" is extracted from repositories hosted on Github. Looking at the privacy statement, Github considers itself as a hosting service for those repositories. See EU Directive 2000/31/EC Article 14 for the exact definition and conditions: Article 14 Hosting Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that: (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information. Article 2(4) GDPR defines that the GDPR does not apply (to Github) in this case This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive. Extracting data from the repositories to create a nicely formatted contribution activity list, would still be considered hosting as defined at Directive 2000/31/EC, because Github does not (manually) redact or modify commits. So if you want to hide your contribution activity, you must delete the contributions. And you should not ask Github to do that, but ask the owners of the repositories. And they might have good reasons to deny your request. If an owner of a repository denies your request without a good reason, you can ask Github to do so. But Github would then probably deny that request, because they explain in their privacy statement that modifying the history is not possible: The email address you have supplied via your Git commit settings will always be associated with your commits in the Git system. If you chose to make your email address private, you should also update your Git commit settings. We are unable to change or delete data in the Git commit history — the Git software is designed to maintain a record — but we do enable you to control what information you put in that record. edit To further clarify why Article 14 of Directive 2000/31/EC applies, see case C-236/08 (Google v. Louis Vuitton) where the European Court of Justice clarifies the meaning of that article (ECLI:EU:C:2010:159): In that regard, it follows from recital 42 in the preamble to Directive 2000/31 that the exemptions from liability established in that directive cover only cases in which the activity of the information society service provider is ‘of a mere technical, automatic and passive nature’, which implies that that service provider ‘has neither knowledge of nor control over the information which is transmitted or stored’. Accordingly, in order to establish whether the liability of a referencing service provider may be limited under Article 14 of Directive 2000/31, it is necessary to examine whether the role played by that service provider is neutral, in the sense that its conduct is merely technical, automatic and passive, pointing to a lack of knowledge or control of the data which it stores. The way Github creates/shows the contribution activity is in my opinion technical, automatic and passive. That means it is not liable, and that implies that the GDPR does not directly apply, unless data is unlawful, and someone notifies Github of that: The restriction on liability set out in Article 14(1) of Directive 2000/31 applies to cases ‘[w]here an information society service is provided that consists of the storage of information provided by a recipient of the service’ and means that the provider of such a service cannot be held liable for the data which it has stored at the request of a recipient of that service unless that service provider, after having become aware, because of information supplied by an injured party or otherwise, of the unlawful nature of those data or of activities of that recipient, fails to act expeditiously to remove or to disable access to those data. Surely the GDPR might be the reason data is unlawful. But you need a reason, in particular based on Article 17 ("right to be forgotten"). For example if personal data of a 12 year old child is processed without permission of it's parent. Without such a reason the legitimate interest of the repository owner will probably prevail (who wants to keep the git history complete).
The basic authority of university staff is summarized here. What seems to be at issue here is whether you have a property right to "access" to the university, as an alumnus. Legal protection of alumnus rights is pretty minimal, contrasted with student or employee rights. There could be a line in the sand pertaining to whether you've paid for something, or are the privileges that you've enjoyed simple part of a PR stunt? If you pay the university for access to university facilities (borrower privileges, for example) then it would be harder to revoke that privilege. Most universities grant a certain level of added privilege, such as an alumnus email account, without any requirement to pay. (They hope to create some good will which translates into donations). So it would really depend on what the basis is for claiming access to university resources, as an alumnus. There is no general obligation of a university to grant alumni various privileges, but they may have created a reasonable expectation and legal right to such privileges, as part of their advertising: that can only be judged by looking at all of the facts. There might be rules within the university which address alumni, so obviously reading the university rules is important. That is really how you would determine whether the coordinator is overstepping her authority. If the university admits that it no longer has jurisdiction over you, then that might be the end of the case, unless that was an error based on less than the totality of the facts. If an accused completely and irrevocably severs relations with a university, the university would have no power over the accused. If there is still a relationship, or if the severance is revocable (i.e. you can become a student again), the university retains some power over an accused. If a student violates the federal regulations pertaining to sex discrimination, the university could be in trouble if they do not address the situation. If the accused leaves the university for a quarter, that does not erase past acts, so the university could be in trouble if they don't address the situation in case of an intervening term off. Thus a legally-viable option would be for a university to permanently remove (unprotected) relations with an accused – not access to transcripts, because of FERPA, but certainly the right to re-enroll or the right to use the library as an alumnus. Again, though, it would depend on what the university rules say. It is highly unlikely that the coordinator has the authority to find facts and mete out punishment (determine that an accused did the act), and this is usually determined by a committee, subject to approval by higher administration. However, an administrator does have the right to limit an individual's relationship to the university in a manner that protects the university's interest. For example, in the event that a person is accused of sexual harassment, the university can temporarily relieve a person of teaching and advising duties, until the case is resolved and there has been a final finding of fact. In general, universities are very protective of their interests and will absolutely squash anything that they think will get them into legal trouble. All that is necessary is that there be a credible basis for the claim – often, that means simply "an accusation". If a complainant vigorously pursues a case, the university could be in trouble because the law allows punishment (loss of funds) in case of a single past violation of the regulations. Their interest therefore is being sure that they have remediated the situation (the stronger course of action), or the complainant has given up (risky since the complainant can change their mind).
IP addresses are personal data. That means you need a legal basis to process them, but not necessarily consent from the user. That IP addresses should be treated as personal data in most contexts is clear, regardless of whether you can associate the IP address with a user ID. That you make such an association affirms that both the IP address and user ID are personal data in your context though. As the answers in the questions you linked indicate, there are alternative legal bases to consent. The GDPR offers a choice of six legal bases (Art 6(1) lit a–f). In most cases, you would instead rely on a “legitimate interest” for logging. But it's not enough to claim that you have a legitimate interest. You must have a clear purpose for which such logs would be necessary, and you would then have to weigh this legitimate interest against the interests, rights, and freedoms of the affected data subjects. If such logs are necessary for security and anti-abuse purposes, your legitimate interest test is likely to prevail. However, you must limit retention of the logged data and the included information to what is actually necessary. For example, keeping user IDs in there might not be necessary. If the association of IP addresses and user IDs is not necessary for a legitimate interest, then you would indeed need consent. Discussion on why IP addresses are personal data. You see many answers and opinions that IP addresses might not be personal data. Some of these are technically correct, but most are misinformed or outdated. I know only a single well-informed person that still disagrees. For everyone else such as the EU Commission, IP addresses are clearly personal data. Under the GDPR, personal data is any information that relates to an (indirectly) identifiable natural person. In the context of log files we can assume that the entries usually “relate” to a person, namely the person making the request. The exception would be requests triggered by automated systems. The more interesting question is whether the person to which the log entry relates is identifiable. While the GDPR does provide further guidance on the concept of identification in Recital 26, it does not provide clear unambiguous criteria. Thus, there is lots of debate about what that precisely means. One approach is to sidestep that debate and and notice that the GDPR's definition of personal data explicitly notes that a person might be identified “in particular by reference to an identifier such as a name, an identification number, location data, an online identifier” (Art 4(1)). Another but otherwise unrelated part of the GDPR mentions “internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags” as examples of online identifiers (Recital 30). We can also look more deeply into Recital 26 and see that “singling out” already counts as identification. We can use the IP address to single out one person's log entries from the set of log entries, so this could be interpreted as meaning that any stable user ID renders the data personal data – and an IP address is sufficiently stable in this context. Another part of Recital 26 says that we must consider “all the means reasonably likely to be used” for identification, even if this involves additional information from third parties. This phrasing is virtually identical to the GDPR's predecessor, the EU Data Protection Directive. On the basis of that DPD, the EU's top court (ECJ/CJEU) was asked to rule on the question whether dynamic IP addresses are personal data (the Breyer case, C‑582/14, judgement from 2016-10-19). It said yes. “It did not say yes”, some people will object. And they are technically correct. When someone rents an internet connection from an ISP, the ISP will have logs that connect the user's real-world identity to the IP address they were assigned at a time. You don't have access to the ISP's logs. But, if that user violated your rights (e.g. a cyberattack or copyright infringement), then you could (depending on civil vs criminal matters) report this to the appropriate authorities or to petition the court and they would have the right to order the ISP to disclose this information. The CJEU said that if this chain (you → authorities → ISP → user identity) is grounded in law, then the IP address would be identifiable. But whether there are suitable laws to compel the ISP to disclose this data would be up to national laws, and the CJEU doesn't concern itself with that. Spoiler: such laws are pretty common. To summarize typical objections: The IP address doesn't relate to a person: Can be a valid objection, but is not typically the case for user-facing web services. The Recital 30 argument is not valid because it's about profiling, not identification, and it only says that IP addresses may be used for profiling, not that they are always identifying: Technically correct, but I think that Recital 30 merely expresses the implied understanding that of course an IP address is an online identifier and permits identification by itself. “Singling out” does not apply because SOME_REASON: Indeed, this is an ill-defined term with no case law to guide us. However, regulators such as the EDPB and their predecessor WP29 routinely use “singling out” to mean being able to distinguish one person's data from other people's data. An IP address lets us do that. The Breyer judgement is not applicable because the defendant in that case was the German state, and the state has other legal means than ordinary website operators: Nothing in that case was specific to the website operator being a state or other authority. If the website operator can contact the appropriate authority and if they have the right to order the ISP to disclose the relevant data, then the IP address is identifiable. The CJEU didn't say “yes” in Breyer, it said “if”. So I'll take that as a “no”: The CJEU concerns itself with the interpretation of EU law, not with national laws. Specifically in the Breyer case, lower courts confirmed that German law has the necessary means. In other EU member states, further checks would be necessary but it would surprise me if there wouldn't be equivalent subpoena powers. If the ISP doesn't have the data, then the IP addresses are anonymous: Indeed, the CJEU scenario collapses if there is no additional data to be linked with the IP address. However: The CJEU used this scenario as an example to show that IP addresses can be identifiable. If that particular scenario fails, there could be other scenarios that still allow identification. The question of whether IP addresses are identifiable had of course been the subject of wider debate at the time. That the GDPR explicitly mentions IP addresses can be seen as a reaction to this debate. Thus, in a sense, the Breyer case is moot. It is still useful as an explanation of how broad “reasonably likely means” must be interpreted.
They'd have a big hurdle to clear. According to 17 U.S. Code § 512(c): (d)Information Location Tools.—A service provider shall not be liable for monetary relief, or, except as provided in subsection (j), for injunctive or other equitable relief, for infringement of copyright by reason of the provider referring or linking users to an online location containing infringing material or infringing activity, by using information location tools, including a directory, index, reference, pointer, or hypertext link, if the service provider— (1) (A) does not have actual knowledge that the material or activity is infringing; (B) in the absence of such actual knowledge, is not aware of facts or circumstances from which infringing activity is apparent; or (C) upon obtaining such knowledge or awareness, acts expeditiously to remove, or disable access to, the material; (2) does not receive a financial benefit directly attributable to the infringing activity, in a case in which the service provider has the right and ability to control such activity; and (3) upon notification of claimed infringement as described in subsection (c)(3), responds expeditiously to remove, or disable access to, the material that is claimed to be infringing or to be the subject of infringing activity, except that, for purposes of this paragraph, the information described in subsection (c)(3)(A)(iii) shall be identification of the reference or link, to material or activity claimed to be infringing, that is to be removed or access to which is to be disabled, and information reasonably sufficient to permit the service provider to locate that reference or link. So long as these conditions are met, Google is immune. So, what is ESPN going to argue? Are they going to argue that Google had actual knowledge of infringement? Are they going to argue that Google received a financial benefit directly attributable to the streaming? Are they going to argue that they sent a DMCA notice to Google and the links were not then expeditiously removed? Or are they going to argue something else entirely?
The issue is not exactly with minors, it is with FERPA and COPPA. This assumes that you have some indication of what students are connected to the web page. If you have students under 13 (surely you do), you need verifiable parental consent. The FTC approves or disapproves particular methods of verification, here is their page on that. One approved and patented method is ChildGuardOnline Technology (it;s a business, not a free service). The other concern is that you have to scrupulously protect "student records". You already know that you can't disseminate "student records" without parental consent, what this adds is possibly new concerns with online security. However, many schools are exempt from the COPPA requirements. Here are some "exceptions" to the rule, and nonprofit organizations are not subject to Section 5 of the FTC Act.