How can I request an ISP to disclose their customer&#39;s identity? As far as I know, breaking the law online in Germany (such as sharing copyrighted content) often results in a fine from a private law firm which gets your personal data from your provider by sending them some sort of &quot;cease and desist&quot; letter mentioning the violation. I understand that this process doesn't involve an actual lawsuit. I wonder what kind of proof of the client's wrong-doing is actually required for the ISP to disclose their personal data. For instance, I have an open SSH port in my home network, and there are regular attempts to login using default usernames/passwords, which AFAIK is just as illegal as sharing copyrighted files. If I see a German IP in the logs, what kind of proof do I have to send to the ISP in order to get the offender's identity from them?
Hacking into a computer owned by someone else and accessing the data stored on it without permission is a misdemeanor according to StGB 202a (de|en). But only if it's successful. So a failed attempt isn't a misdemeanor yet. When you notice that someone might have committed a criminal offence (regardless of whether you are a victim or just a witness), then the usual procedure is to report it to the police. If they consider the crime serious enough to investigate, then they will request the identity from the ISP. But the copyright lawsuits which are filed in bulk by law firms working with media companies are not crime reports. They are civil lawsuits. A civil lawsuit is when someone had a tangible damage because of something someone else did, and now they want money in compensation. When there is no damage, then there is nothing to sue for. So when you want a judge to file an injunction to force an ISP to give them the identity of one of their users, then you would first have to explain to them how much financial damage you had because of that person and that this is enough damage to make it worth everyone's time. That might be quite challenging for nothing but a failed SSH login attempt. But it might be possible if a single person made so many login attempts that it incurred you non-negligible bandwidth cost or even caused a denial-of-service.
This question needs more detail. As a cybersecurity professional I can provide some technical context around what I believe to be the situation. While I do not know the legal precedence, technically, IP addresses cannot typically be attributed to an individual person. There are a number of reasons for this. In a local network, IP addresses are not unique. Rather, they are distributed by the DHCP server, and are reassigned at intervals. Forensic attribution to an individual in most environments would require a DHCP log linking the IP to the machine’s MAC address, with time stamps that correlate to the individual’s logon to that machine at the same time. If the IP correlation involves a VPN, it gets more difficult. I would need to know where the log/evidence was obtained to determine what the IPs in question actually correlate to. If the evidence was obtained in local area network of the suspect, the IP addresses are likely assigned by the DHCP server (see previous). If they are obtained after encryption in transit to decryption, then very little can be determined. If they were obtained at the VPN server log, these IPs likely belong to an ISP which in turn may or may not be able to show what machine initiated the conversation. Digital photos often contain EXIF data, which is metadata about the photo. This data can contain details like, device make and model, sometimes location, time and date... If the defendant owns a Nikon such and such and the photo was taken with a Nikon such and such, and was uploaded using a VPN the defendant has an account with, and the defendant was in that location at the time and place of the photo... there may be enough there... but I’m not a lawyer. I believe the discovery should include any EXIF metadata and logs to be used as evidence. You may need a special technical whiteness to educate the court on what can and cannot be determined (technically) given the evidence. Things to consider for such a witness could include: EXIF, forensic certification, network administration experience, VPN, TCPIP, OSI Model, Network Address Translation (NAT). Again, nothing here should be considered legal advise. Seek professional legal counsel.
Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions. Personal data from users/customer is carried for lots of reasons, not just marketing. What if you're asked to delete data that is needed to bill customers, information that may be relevant to a legal case or information that needs by law to be retained for the purposes of audit? GDPR does not make it illegal to carry personal information, it simply needs you to justify why you are keeping the information - inform the named person about this and provide them with a timescale for deletion. For example if you are required by law to store a record of emails to document the work done, but the user asks you to delete that information. You would be entitled to keep that information but only for the purposes of maintaining that audit trail. You would delete all associated customer data that was unnecessary such as CRM info, payment details etc.. but could keep the audit trail. The proper way to respond to the user's deletion request would be "your data will be kept in a secure server for the purposes of maintaining an audit trail for x amount of time. Once this time has elapsed it will be deleted. If you are unhappy with our use of this data please contact our data officer". GDPR isn't designed to catch you out - if you have a legitimate reason to keep that information then you are entitled to. The law was designed to stop marketers and advertisers hoarding huge amounts of information, as well as undermine Google/Facebook's duopoly on our personal information.
The conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. As for it being legal for website operators to log the IP-addresses of visitors, this is covered by the following paragraph (also pointed out by phoog in a comment). The paragraph says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) You are not the only web site that logs IP addresses for the purpose of security. Every web site I've ever worked on - from those controlled by large corporations to tiny NGOs - do this. This security practice will not be impacted by the GDPR (if it were, I am sure we would have heard about it by now). there is the EU cookie law too If your website are going to be accessible to European citizens and not only accessible by your friends and familiy, you have to comply with the EU cookie directive of 2002 (a exemption for "personal websites" does not exist).
Of course it is illegal. You are attempting to access somebody's data without their knowledge and certainly without their consent. In the U.K. it is a crime under the Computer Misuse Act 1990, the Police and Justice Act 2006 and the Serious Crimes Act 2015. The clue here should be in the term Serious Crimes. The Human Rights Act, and indeed the ECHR, should never come into it unless it was state sponsored or corporate spying. And even then certain states have given themselves Orwellian totalitarian authority to do as they please.
Yes, there would still be an obligation to comply with erasure requests – if the data subject can be identified, and if the GDPR applies. This is a case for Art 11 GDPR: processing which does not require identification. The pastebin site is not required to collect identifying info just in order to facilitate later deletion. If the site is unable to identify the data subjects, then the data subject rights (like access, rectification, erasure, restriction, or data portability) do not apply. Other rights like the right to be informed and the right to object do remain, though. But if the data subject provides sufficient additional information that makes it possible to identify their records, then the data subject rights apply again. In practice, this is likely going to mean that anyone with access to a paste will be able to request deletion, since the site would have no ability to verify the identity of the data subject beyond the information in the paste. None of this absolves the site from implementing appropriate technical and organizational measures to ensure the security of this data. Even though the pastes might not be directly identifying, they are personal data and are far from anonymous. Common practices like numbering pastes with a sequential ID or showing recent pastes on a homepage have to be viewed critically. My go-to recommendation is to assign a cryptographically random UUIDv4 ID to the post, so that it is practically impossible for anyone to find the paste unless they were given a link by the uploader. Your idea to delete pastes after a fairly short retention period is also good. This helps with security, and it is in line with the GDPR's data minimization and storage limitation principles: data may only be kept as long as necessary for its purpose. On the other hand, quick deletion might not be in line with the purpose of these pastes – it all depends on context. You mention that this is an US-based site. If so, there's a question whether GDPR would even apply. GDPR will apply per Art 3(2) if the data controller is offering its services to people who are in Europe. Here, “offering” does not mean mere availability of the website, but that the data controller intends the service to be used by such people, in particular if the service is somehow targeted or marketed to such people.
Yes If you are in the EU, or your players are in the EU and your service is targeted at some part of (or all of) the EU, then this pretty clearly falls within the scope of the GDPR. Such a service would be collecting data associated with natural persons. At least some of it would be made public along with an online identifier, and other parts would be processed and stored, even if disclosed only in anonymized form. (By the way it is a non-trivial task to anonymize data well enough that it is no longer persona data under the GDPR. But let's suppose yoru methods are good enough.) Under GDPR Article 6 the DC must have a lawful basis for such processing. If the basis is &quot;consent&quot; then the consent must be freely given, whch means giving consent may not be a condition of using the service. Under GDPR Article 13 a notice must be sent to the Data Subject (DS) when the data is collected from the subject, including some 11 items or categories of information about the collection process, the Data Controller (DC), the purposes of processing, the legal basis of processing (which the DC must define), who will receive the data, the data retention period, and various rights of the DS. Such a service must be prepared to respond to data access and data erasure requests, under articles 15-17, and data restriction requests under article 18. It must provide a method for a DS to easily make such requests. Other GDPR provisions may well apply in addition to these, but that is enough to show that such service is very likely to be within the scope of the GDPR, unless none of the DSs are present in the EU or the related market area.
DMCA applies as long as the the website is being hosted inside the U.S. The location of the copyright holder is irrelevant. For step-by-step help drafting a valid DMCA notice, see Step 2 of https://nppa.org/page/5617. If the site fails to comply with a valid notice, they lose the benefit of DMCA's safe harbor provisions and become themselves liable for continuing to host the infringing work, and you can sue them. (Prior filing suit, though, I imagine a letter from a lawyer that says, "Hey, my client sent you a valid DMCA notice a while ago; kindly comply at once, or we will actually sue you," should be sufficient.) The requirement to submit a photo appears to be totally unnecessary. A valid DMCA notice includes a signature (electronically including your name in an email is sufficient) and an assertion, under penalty of perjury, that the writer is authorized to control the copyright work and that the work is being used illegally. Beyond a signature and contact information, no further identity verification is necessary. The DMCA handles this by opening the submitter to perjury charges if the takedown was submitted illegally. Of course, any site might choose to ignore your DMCA takedown, at their own peril. They might bet that you won't actually hire a lawyer and follow through on your legal right to file suit, or they might not understand that identity verification is not a legal requirement listed in 17 U.S.C. § 512(c)(3). Your options are either: follow the law as written and file a valid takedown notice, and then hire a lawyer when they don't don't comply with the rules written in 17 U.S.C. § 512 follow their additional rules to get them to comply, which may be more difficult but might not require hiring a lawyer