I&#39;m afraid I disclosed confidential information. What do you think? I'm a shareholder and developer at a startup. Last month the board announced me that they will fire me, due to a merge with a partner as I'm considered redundant and all development will be moved to the partner. Few weeks ago a professional "contact" asked me privately in FB how are we going during covid. I was still emotionally touched and I told him I was fired, and the cause was a new partnership, that the company decided to move dev to external partner, and that I thought with the saving they got from my dismissal they will be fine. I deleted the message, but I think he read it. I'm fucking scared now. did I disclose confidential information? the "contact" is also contact of my CEO, and his company is one of our customer. What could happen to me?
The fact that you have been laid off is both your company’s information, and your personal information. You are allowed to tell your own personal information. The move to a new partner however is not your information. As long as you are still employed your employment contract will probably say that you mustn’t do anything to damage the company. You’d need to read what the consequences would be. Maybe the contract says you can be fired... which doesn’t matter unless you would lose a redundancy payment. After leaving it would depend on whether you had a non-disclosure agreement. And last, does your company care? This merger can’t be kept a secret anyway.
As Putvi says, you are being extorted and this is a criminal matter and thus a matter for the authorities in your jurisdiction. However, you have a second problem entirely apart from that - you almost certainly broke academic ethical rules by submitting a piece of work that you did not write as your own (these things are pretty cut and dried in academic circles). This will not go away. Regardless of whether your extortionists are brought to justice, they can still release your details at any point in time and ruin your career, or it can come out in other ways. Own up to this with your university as soon as possible, and see if you can make it right. This will be hanging over you for the rest of your life, and can drop at any moment - these sorts of things have ruined people before.
The words "proprietary format" are important. Are you sure the format is proprietary? If it is, then it's likely protected in which case they might have grounds to sue (but that does not mean they would definetly win). If the format is not proprietary, and so long as you don't share data which is proprietary then I believe you fine. I'm not a lawyer - but I cite GIF files as an example. They were still protected by the US and some other countries until at least the late 90s and there were various threats to open source linux companies who shared code that used the file format. I'm not aware of anything other than threats and never heard of any company being sued, let alone winning or losing. Another example that comes to mind is the RedHat ISO format. My understanding is RedHat could not stop anyone from sharing open source, but they could prevent folks from sharing the format they assembled and shared the open source. Again, I am not sure if it was ever tested in any court of law anywhere.
without my permission ... is just not true - you granted permission for your posts to be forwarded, subject to the privacy settings you set, when you agreed to Facebook’s terms. Specifically 3.3.
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
I would probably have a legal disclaimer out of an abundance of caution. That being said, you have a right to free speech via First Amendment guarantees. While that right is not absolute and some words “by their very utterance” cause injury or incite an immediate breach of peace, and do not receive constitutional protection, (there is the old adage you do not have the right to shout fire in a crowded movie theater). This (your blog) is not that. To take it to its logical (or illogical) extreme, there are many things on the internet, in magazines, scholarly articles, etc. that could injure someone or cause damage in the event that one who was not qualified or competent to perform the action described undertook to do so. A child could burn themselves following the directions on a mac and cheese box but they shouldn't be cooking in the first place. The same rings true for high voltage electricity - a non-licensed electrician should probably not create a high voltage power supply. But, will some? Yes. But you are not liable for printing a blog about the practice. On another but related note, if you are a licensed electrician your licensing authority may require that you take precautions to ensure you do not inadvertantly direct others to engage in practices of licensed professionals that could cause harm by giving them information. I doubt this but I don't know because I am not an electrician. As far as could you be liable for writing it....under our legal system you can be sued under a theory of negligence for just about any action someone thinks was unsafe or causes injury. And you never know what a jury will do. But I think that to sue someone for simply writing something would be fairly easily dismissed through a motion for summary judgment by a competent attorney in the event you got sued. If everything a person wrote, that if followed by an unqualified person resulted in injury, resulted in liability for damages than it would have a chilling effect on their First Amendment right to free speech. That said, I go back to my original statement that it couldn't hurt to have a simple liability waiver for extra protection. It could be something as simple as: "The information contained herein is not mean to be comprehensive and is for informational purposes only. You should not undertake to perform anything described herein without adequate training and/or supervision. The Author disclaims any responsibility for any injury, damage, or loss as a result of reliance upon the information found on this site/blog." If you do use a liability waiver, make sure it is bold and obvious. Otherwise, it can backfire!
Yes. Art 13 requires you to provide “the identity and the contact details of the controller”. You are the data controller. Your name and address are necessary to establish your identity. Using AdSense means you're offering an internet society service commercially. In that case, there's also probably some EU fair competition directive that was implemented in your countries national law and will provide equivalent requirements. For example, my country Germany has a far-reaching Impressumspflicht. Not sure if this is the most relevant EU law, but Art 22 of Directive 2006/123 requires that your country passed laws to ensure that you make available “the name of the provider, his legal status and form, the geographic address at which he is established and details enabling him to be contacted rapidly and communicated with directly and, as the case may be, by electronic means”. I think you would be in scope of this directive since you're acting commercially. This legally mandated self-doxxing is unfortunate for private bloggers, but it's also essential for making it possible to enforce data subject rights: if you were to violate someone's privacy rights, how could they sue you if they don't know where to serve you with a lawsuit? However, all things are a balancing act. These requirements are not intended to limit freedom of expression. If you're just trying to communicate something to the public without jeopardizing your anonymity, then paradoxically social media services can be more attractive.
I believe in this case, your company (OrgX) is a data processor and your customer's organization (OrgY) is the data controller. OrgY is responsible for establishing a lawful basis for sending you (OrgX) the personal data for their employees. Note that consent is just one of six lawful bases outlined in article 6(1). I'm no expert, but I believe OrgY's admin can claim they have a legitimate interest in sending their employee's personal data for training sake. In either case, the data processor is not responsible for establishing the lawful basis for processing. Of course, data processors aren't completely off the hook. GDPR outlines specific requirements for data processors (see chapter 4, particularly article 28).