Is it possible to forbid linking to a site? I have seen on several sites notes similar to The creation of hypertext links pointing to the ... site is subject to the prior written approval ... Is this notice legally enforceable? (or legally makes sense at all) A hyperlink is an address, so it would be similar, I believe, to disallowing someone to list an address (on a map for instance). Since Internet is (usually) not limited by country boundaries I will not tag it with a specific country, but if there must be one I would mostly be interested by EU.
Is it possible to forbid linking to a site? No. It would be quite childish and out of touch to aspire to that level of control. Publishing a website/page for permanent, wide open access is inconsistent with prohibiting accessing it from certain venues, such as hypertext links. The prohibition of linking to a site is an attempt to enforce a certain degree of selective privacy. As such, it would not be enforced by U.S. courts, and it would be laughable if other jurisdictions proceeded differently. In United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008), the court wrote that e-mail and Internet users have no expectation of privacy in the to/from addresses of their messages or the IP addresses of the websites they visit because they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information. That rationale is equally --or perhaps even more-- applicable to a publisher, since in this case browsers and/or the publisher himself post(s) his URL (the equivalent of a "from" address of emails) "for the specific purpose of directing the routing of information". A hyperlink is an address, so it would be similar, I believe, to disallowing someone to list an address (on a map for instance). That analogy is inadequate because it overlooks essential differences between a web address and a physical (be it home, office, etc.) address. A web address is used for obtaining information which the initial publisher deliberately makes available to the public. By contrast, the act of having one's physical address registered somewhere else serves no such purpose whatsoever. Another important difference between a hyperlink and a physical address is that "consuming" a hyperlink simply cannot annoy or harm the initial publisher (except in the extreme scenario of Denial-of-Service attacks), whereas a common knowledge of a person's address may make that person vulnerable to harassment, trespassing, larceny, and other unlawful acts. A better analogy with hypertext links would be bibliographical references, since both are types of text strings for directing the consumer to a (or "the") source of information. Neither text string causes detriment to the author/source of that information. Can you imagine if bibliographical references were forbidden by statute or by the author of that information? The mere difference that a bibliographical reference needs to be copied/pasted, whereas it suffices to click on a hypertext link, cannot permit treating the permissibility of hypertext links any differently than the permissibility of bibliographical references.
I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password. It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier. If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
Maybe, but probably not The geographic location of the organisation is immaterial: under Article 3.2: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: ... (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. Posts anyone (not just EU citizens) make to Reddit (or anywhere else) while they are physically located in the EU or UK engage the GDPR. Pushift.io is therefore captured by the GDPR and any denial of that is just plain wrong. Given the denial, it is likely right out of the gate that they are non-complient. For example, they are unlikely to provided the required information under Article 14. More importantly, it seems that they have not determined the lawful basis for processing the data under Article 6 - they can possibly rely on the public interest basis (preserving deleted publication is arguably a public interest) or a legitimate interest but that requires a balancing of their interest against the data subject's. That said, the right to be forgotten is not absolute, the reasons that might be applicable here are: The data is being used to exercise the right of freedom of expression and information. The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority. The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.
In German Law you need to give your agreement ("Willenserklärung") to a contract or in this case terms of service. This is done by telling the other part. In some cases this can also be implied by an action (example: putting your bottle of beer onto the cashiers table is an offer to buy this bottle). As a second criteria a "Willenserklärung" needs to be the exact will of the part that declares its will (the website user in this case) §§ 133, 157 BGB or that the other side (you) could only see so (not the case here as this mainly speaks of content). If you visit a website and there are terms of services, the "Willenserklärung" is only given when the user read and agreed to the terms. If he did not, the terms of service are not applied until the user agrees to them. So I would recommend to block the website until the user agreed (overlay) as you need to proof he did when in court. Additionally there are so called AGB's in Germany. Those are contracts that are used or planed for many (more than 3) uses and set by one side (you). This may apply here, so you need to follow a lot of other rules like making sure the user had access and agreed, then there are many content restrictions and so on... I recommend consulting a German Lawyer specialized on this topic as this is very complex and includes other German laws for Media too, depending on the content of your site and terms. Also note that everything said is only based on my own knowledge and can not be used as safe legal source.
There is language, but not a mechanism, covering this. Section 3(a)(3) of version 4 licenses says If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable. If you become aware of a person using your material and attributing you, and you want the attribution removed, you would accordingly notify them (somehow), and they are required to remove the offending material. The removable informations includes: i. identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated); ii. a copyright notice; iii. a notice that refers to this Public License; iv. a notice that refers to the disclaimer of warranties; v. a URI or hyperlink to the Licensed Material to the extent reasonably practicable;
The conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. As for it being legal for website operators to log the IP-addresses of visitors, this is covered by the following paragraph (also pointed out by phoog in a comment). The paragraph says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) You are not the only web site that logs IP addresses for the purpose of security. Every web site I've ever worked on - from those controlled by large corporations to tiny NGOs - do this. This security practice will not be impacted by the GDPR (if it were, I am sure we would have heard about it by now). there is the EU cookie law too If your website are going to be accessible to European citizens and not only accessible by your friends and familiy, you have to comply with the EU cookie directive of 2002 (a exemption for "personal websites" does not exist).
A disclaimer claiming to disclaim authors of content on the website can/cannot protect those authors depending upon: Visibility of the Disclaimer on the website On whether it can be proved that the disclaimer was included intentionally to be brought into the user's notice. Location of the dispute. In United States many courts have ruled in favor of the disclaimers if the were strategically placed not to be missed by the user. In European Union on the other hand there is a directive which strikes down legal obligations which have been imposed and this would make disclaimers unenforceable. For more information, please refer This Link