Is the character of a “request” legally defined? In general English usage the notion of a request seems to connote that compliance with it is discretionary and not required. But in legal usage and correspondence it seems to perhaps assume a different character. For example, consider the idea of a subject access request. In fact compliance with such requests is generally compulsory. What is the basis for the divergence of usage?
To request means simply to ask politely or formally - there is no implication that an answer is optional or required Some requests will be backed by law or custom such that they require a response, others do not. The former is more likely to be the case in a legal setting than in a casual setting which might be why you are finding an implication that doesn’t exist.
At what point is unsolicited explicit material considered harassment? How do the advertisers have the right to broadcast something that I would definitely bring up to HR if I heard a coworker say? The contexts are too different. One cannot expect much similarity on how the unsolicited explicit communications are addressed. On platforms such as Youtube the unsolicited explicit material is not sent specifically to you, but to a set of users who at best have some characteristics in common. By contrast, akin communications in a work environment are much likelier to constitute harassment insofar as they usually are intended for a specific person. Your own use of the term &quot;broadcast&quot; reflects your acknowledgment of that difference. Another difference relates to the recipient's dependency on the environment where the unpleasant communications occur. Implicit in the anti-harassment protections in a work environment is the acknowledgment that the recipient's livelihood depends on that person's continued employment. That dependency renders such communications a form of coercion. By contrast, dependency is much lower or non-existent when it comes to entertainment platforms: the recipient can leave the platform without any consequences that might threaten that person's livelihood. Have I entered into an agreement with the service provider than I consent to receiving these advertisements by using their services? That is hard to tell. You will need to read the terms of service of these platforms and post another question if some clause(s) is(are) unclear.
"Reasonableness" is meant to be vague, because what is reasonable in one case or contract or industry is not always reasonable in another. Generally, though, you'll probably find courts interpreting it to take into account normal practices in your geographic area, in your industry, and between you and the other party. If one party looks like they're trying to unjustly enrich themselves or is asking for something that people just don't agree to in the real world, it's probably going to be unreasonable. If people are asking for the fair value of their work on terms that are normally agreed to when they're the subject of negotiations, it's probably reasonable. Dropping the reasonableness language would probably leave the assigning party in a bad position, as they're not required to make the assignment, with no qualifications as to the terms. The assignee could argue that they're free to take the IP on any terms whatsoever, though courts often read in a reasonableness requirement anyway. This answer is based on U.S. law, but there will be probably be pretty strong parallels if you're in a common law jurisdiction.
It's hard to prove a negative, and I'm not sure which specific part of the quoted Terms you object, to, but it specifically states that content access may be done to: Comply with the law Protect its customers; and Protect the security of its business; and Protect its business interests. It's unlikely that access of information to comply with the law is illegal. At least one EU directive, Directive 95/46/EC, sets limits on the collection and use of personal information. We're concerned with the first condition for lawful data processing, and the second principle of data quality. Data processing is only lawful if the data subject has unambiguously given his consent; or processing is necessary for the performance of a contract to which the data subject is party; or processing is necessary for compliance with a legal obligation to which the controller is subject; or processing is necessary to protect the vital interests of the data subject; or processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party; or processing is necessary for the purposes of the legitimate interest pursued by the controller or by the third party, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection. The principles of data quality, which must be implemented for all lawful data processing activities, are the following: personal data must be processed fairly and lawfully, and collected for specified, explicit and legitimate purposes. They must also be adequate, relevant and not excessive, accurate and, where necessary, kept up to date, must not be stored for longer than necessary and solely for the purposes for which they were collected; special categories of processing: it is forbidden to process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. This provision comes with certain qualifications concerning, for example, cases where processing is necessary to protect the vital interests of the data subject or for the purposes of preventive medicine and medical diagnosis. So, let's say that someone has given their consent. It'd be at least a little questionable whether the inspection of private information could mean that they access personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. I'm a bit less clear on US laws, but you'd probably look for laws around Personal Identifying Information, as that's where a lot of focus has been.
There are no specific criteria for deciding whether a request is manifestly unfounded or excessive, because this depends very much on context. The ICO has given some clarifications, but they still won't tell you an allowed frequency of requests. We (as data subjects) should not invent particular criteria because they would be only our opinion. In any case, the data controller would have burden of proof to show that a request was indeed manifestly unfounded or excessive. That means that a data controller will generally err on the side of caution and allow repeated requests. But that doesn't mean you won't get pushback on your proposed frequency. I think your proposed approach is likely to be both unfounded and excessive. A controller has one month to respond to your request. Sending off a request while a previous request is still pending would likely demonstrate an excessive frequency of requests. Even if the data controller responds more quickly, it is doubtful whether that would entitle you to more frequent updates. Since the data controller will inform you about important events with a letter, this weakens your need to make frequent requests. Your “Bayesian model” is also flawed, both in content and application. As your prior, you expect a very high rate of events. However, a normal citizen would expect to receive a parking fine approximately never. Your model should more correctly be based around the probability of missing an event, while also accounting for letters (which generally do arrive in time). It might also be incorrect to use your circumstances as the basis for determining a reasonable frequency. The ICO suggests multiple factors (nature of the data, purposes of processing, how often the data is altered, relationship with other GDPR rights). These factor's generally relate to the controller's processing, but not to your individual circumstances. Next, your requests seem unfounded: the purpose of your requests is not aligned with the GDPR, and automated requests raise doubt about whether the request is valid. Your motivation to make the requests is “to know about claims such as parking fines […] when something goes wrong with the letters sent”. This is a fairly speculative reason since letters generally do arrive well. In contrast, the GDPR provides for the right to access “in order to be aware of, and verify, the lawfulness of the processing” (Recital 63). You are not claiming the right to access for the purpose of verification and to obtain information about the processing, instead you're abusing the GDPR rights to create a kind of API that auto-updates. So, is three months a hard and fast rule? Definitely not, but it seems like an unobjectionable, reasonable frequency. If a data controller thinks a request every three months is excessive, you'll likely be able to push back successfully. But with more frequent requests, you're entering a grey area. Here, it becomes increasingly likely that the controller is able to demonstrate that your requests are invalid.
Arbitrary doesn't mean what you think it means The term arbitrary describes a course of action or a decision that is not based on reason or judgment but on personal will or discretion without regard to rules or standards. A clear rule that a license fee is required to be paid by a certain date that is the same for everyone is pretty much the opposite of arbitrary.
It doesn't matter. When a contract is left ambiguous the interpretation that is used is the one that is the most favorable to the party that did not draft the contract, under the logic that if the party that did draft the contract chose all the wording and thus, they could have stated their interpretation in the contract just avoided this whole mess in the first place. A similar rule exists in criminal law, where if the law is ambiguous, the interpretation used is the one most favorable to the defendant, since the state could have drafted it in a way that made their interpretation clear.
Your analysis so far seems correct. You must comply with all applicable laws. The GDPR's Art 6(1)(c) legal basis clarifies that having to provide personal data is no excuse: that legal obligation is all the legal basis you need for sharing the personal data in accordance with your obligations. However, that legal basis doesn't generally excuse you from your other data controller obligations. For example, you should still inform the data subjects about the processing as per Art 13(3).