Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it? On day one of my first year in high school me and basically every other students were given a few documents to sign. One of them included a clause that allowed the school to publish pictures of us doing activities on the school website. Back then I was not that privacy-conscious and my homeroom teacher pressured us to quickly sign all of them so I did. I don't remember anyone questioning the reasoning behind the clause. After more than a decade past graduation, the school website appeared in my search results so I took a look. I found some pictures of me and some of them were embarrassing and/or really cringe. I would rather have them removed so I contacted the school and politely asked for the removal of about a dozen photos. They declined, citing the document that everyone signs. Does the school really have rights to the photos for eternity? Does the CCPA or COPPA provide any protection for me in this case? Had I been an EU resident, could I have invoked GDPR and have the photos removed without hassle?
There are not enough facts to draw a conclusion First, it’s not clear that the document you signed amounts to a contract. For example, what consideration did the school give you in return for the permission you gave them? Providing you with an education doesn’t count - they were legally obliged to do that already. If it is a contract then whether and how it can be revoked would depend on the terms of that contract witch I’m guessing you don’t have a copy of. Notwithstanding, as a minor, you have the right to void the contract until a reasonable time after you turn 18. Even if it is now many years since that happened, it might be reasonable since you only just discovered the website. If it isn’t a contract, then it would be revocable at any time. Practicalities Make a fuss and they may take the photos down even if they are not obliged to. They presumably have plenty of photos of kids who aren’t you and aren’t complaining and if you make it so it’s easier to change the website than to deal with you, thy’ll change the website. I suspect their inertia is because they once paid a web developer to create the site, it has never since been updated, they don’t know how to do it, and they don’t want to have to pay someone to find out. Otherwise, why would they have photos of ex-students rather than current students? If so, an offer by you to cover the costs, might solve your problem.
School districts / states do generally have the power to set the curriculum including the viewpoint that will be officially conveyed. One well-known major restriction on such viewpoint restrictions is that the schools cannot restrict the free exercise of a religion, and cannot take a position on a religion. Apart from the religion third-rail, schools have pretty free reign in setting the curriculum, see Evans-Marshall v. Tipp City for one instantiation. In this case, the teacher assigned various books, including Heather Has Two Mommies, one of the books that prompted an outcry. The upshot of that case is that a teacher cannot invoke the First Amendment to override policy. This article (draft version, easier to handle) (published version, annoying footnote structure) reviews the topic, and section III covers prior cases. It notes that the cases of Lawrence, Windsor, Obergefell do not address the constitutionality of these education laws, though the reasoning in the prior cases might be applicable if there were a suit over curriculum. There is an implication that some of these rules have been enforced in the past, but most of the evidence is in the form of news stories (Beall v. London City School BOE is not available in the open). The article does engage in a somewhat deeper study of enforcement in Utah, where it was enforced (until it was repealed). Enforcement is necessarily indirect. The law require school districts to have a particular curriculum; violation would come when an individual teacher taught contrary to the prescribed curriculum. Those laws do not contain any provision like "a teacher who violates these rules gets fired", instead, punishment is via the general rule that you have to teach what is in the state-mandated curriculum. Rather than officially terminating a teacher for violating this curricular guideline, districts use vague reasons for non-renewal such as "due to problems with communication and teamwork" (from Evans-Marshall).
This is more than a comment (too long), but not a definitive answer (since I am unfamiliar with the laws regarding this kind of thing). Please forgive me. First, there are some technical misunderstandings. They are not disabling SSL/TLS. Instead, they are inserting themselves in between these connections so they can make sure you aren't accessing material you are not allowed to access. They may actually be required to do this by law. Here is how it works. Typically when you connect to, say Google.com, you are given a certificate from Google.com that has a trusted chain all the way up to some trusted root. That trusted root is explicitly trusted by your web browser manufacturer. In order to be able to inspect these sorts of connections, security appliances will actually replace the certificate provided by Google.com with one that the appliance provides. It has to pretend to be Google.com so your browser doesn't freak out. The problem is, this certificate is no longer has a trusted chain to something that the browser manufacturer trusts. It is provided by the security appliance. So often, the appliance will have a root certificate that the administrators of the system must install on every machine they control. Then the browsers on these machines will not complain that the certificate is invalid. Obviously, you are getting the error on your own machine because you have not allowed the administrator to install these certificates on your machine. Nor should you. You should definitely not allow your school's network administrator to install these certificates on your personal computer. You say that "leaves people's private data being transferred over the school network (such as private e-mail, logins) unsecured and open to packet sniffing". This is not true. Any HTTPS website you visit is encrypted between your computer and the security monitoring appliance using the pretend certificate I mentioned above. Typically then, the traffic is decrypted and inspected by the appliance. Then it is re-encrypted using the real certificate, before being pushed out onto the internet. So, only at the security appliance is data turned back into the clear, only to be protected again before going out to the internet. So, is this illegal? Well, I think you would agree that definitely on the computers that your school owns, they can do anything they want with them. The computers belong to them. Furthermore, the network belongs to them. Likely you signed an agreement (or agree to it each time you connect) that they are allowed to monitor your usage of their computers and their network. This includes when connecting your personal machine to their network.
The Right to Access is pretty absolute. However, there are some limitations: Is the service even the Data Controller for the data in question? Here, you're talking about notes of one user about another. Is the platform the controller for the notes, or would the note-taker be the controller? Or both, jointly? If the platform weren't a controller but merely a data processor for these notes, it would be illegal for them to disclose the information. Trish also correctly points out that the GDPR does not apply to processing for purely personal or household purposes, e.g. personal social media use. So GDPR would not provide a basis to compel a user to disclose their notes to the data subject, assuming that the note-taker is covered by this exception. Of course, this exception wouldn't apply if the notes are taken for other purposes, e.g. professional networking. Also, this exception doesn't affect the platform. There is an explicit limitation to the right of access in Art 15(4): The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Disclosing user A's notes about user B to user B would likely violate the privacy rights of A. The notes are both A's and B's personal data. However, the correct balance depends on context. E.g. an employer probably can't refuse to provide access to a performance assessment merely because it was written by an identifiable manager. The UK ICO has provided detailed guidance on this aspect to the right of access. They propose a three-step test: Step one – Does the request require disclosing information that identifies another individual? For example, it might be possible to redact other people's information (but not in your Mastodon notes example). Step two – Has the other individual provided consent? Step three – Is it reasonable to disclose without consent? What is reasonable is highly context-dependent, but UK data protection law gives some concrete criteria to consider. The EU EDPB has draft guidance on the Right to Access. They note that the Art 15(4) can cover a wide range of rights, not just other people's privacy rights. But as in all things, the data controller is required to strike an appropriate balance between user A and B's conflicting rights. In the Mastodon user notes scenario, I think that the note author's rights to privacy should be considered more important than the data subject's right to access those notes, thus making it possible to reject that part of a DSAR under Art 15(4) GDPR. If we assume that the note-taker A is a (joint) controller for these notes, then it would also be necessary to consult them before making a decision about the access request.
how could these ordinary people sue somebody for taking their pictures without permission, when there are tabloid journalists who do this every day to celebrities ? (And obviously they get away with it.) Tabloid journalists only get away with it when the pictures are taken in public, where there is no expectation of privacy. No permission is required in this case. Conversely, the IT guy apparently took photos of the laptop users when they were at home etc. where privacy is pretty much expected and therefore permission is required.
How can I truly say that I 'consent' to data collection and processing when I am coerced, so to speak, by the threat of failing my courses if I do not use this novel software? There is no need for you to "consent". Consent is just one of the reasons that allows a data processor to collect your data. There are other reasons that allows the data processor to capture your data. In this case, it seems of application the "legitimate interest clause", as it is in your university's legitimate interest to capture your activity in order to evaluate you. Of course, that covers only the data collected that is relevant to that interest. They will certainly capture your identity and your answers, they may log your sessions and may try to gather some data to detect if you are somehow cheating, but they would not be allowed to check which are your favorite pornhub videos because that is not relevant for the university's legitimate interest. Art. 6 of the GDPR states: Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This page also provides some in-depth analysis
I'm pretty sure in France you have moral rights and copyrights. I am writing from New Zealand, but we have some similar intellectual property laws due to being member countries of the World Intellectual Property Organisation. We are also both member countries of the World Trade Organisation (WTO has the TRIPS agreement which relates to IP). So my answer may or may not be right &ndash; check what it says in France's copyright acts: you should be able to search for terms like first owner, and moral rights, films/videos, etc. The school isn't your employer, and so the basic rule is that you as the author are automatically the first owner. Since you're not really at school to create anything or research for the school, I don't think the court would enforce a blanket term that you had to agree to that the school owns intellectual property in what you create. You probably own the copyright. You also have moral rights in what you have created, which means even if the school does own the copyright in your work, you can request they attribute it to you if they show it in public (online). Not all works have moral rights. However, in NZ if you create a film/video you do have moral rights in it.
Generally, it's illegal. You are creating a derivative work and you are not allowed to do that without the permission of the copyright holder. Some jurisdictions may have exceptions, such as fair use under US law. However, this generally protects uses that are intended to comment on or parody the work. It doesn't sound like that is the purpose of your image modification. NOT including: faceswaps, modifications that would shame or affect negatively the reputation of the actors on the image. That doesn't make it legal. I share it in a way that I don't make any economic profit out of it, and clearly stating that it is a modified image (not sure if inside the image, or in the caption under it) and state who is the legal owner of the original image. That doesn't make it legal, either.