Is it legal to publish email that someone sent to me? I'm not asking whether it is ethical - that would be a totally different question. I'm asking whether it is legal? In my book - in my way how I interpret consensual reality - once I press SEND button it is transmitted via email client, via email server, via internet, to a destination email server.... On the way there are so many entities that can intercept the traffic that I effectively consider all my communication public. Event when using GPG / PGP: I don't trust myself (I'm yet to learn reliable way of generating private key) I don't trust my device (see what they did to Snowden's laptop) I don't trust the recipient (they can publish it online) I'm thinking about implementing a buffer system: email is received automated reply: "we consider your email public, 7 days to opt-out" sender has an option to opt-out, ignore, or edit the email (to remove non-public bits of information) after 7 days with no action it defaults to be public Would that system make it any more legal? UPDATE: I'm still thinking about designing email system. Maybe best of two worlds: one public that goes directly to email group one private, that strongly suggest all messages to be encrypted (general philosophy - full transparency, everything in public - without infringing anyone's right and playing by the cultural norms accepted by society) THINK: email password resets are not compatible with public email inbox?
Generally speaking, if a person sends you an email you can publish it. Like if they call you a bunch of nasty names, or threaten you in some way, that information is yours and you can publish it. However, I'll give you three scenarios where you should not publish an email sent to you (and I'll edit to add more if they come up). Private facts. There is a tort called publication of private facts. A plaintiff must establish four elements to hold someone liable for publication of private facts: Public Disclosure: The disclosure of facts must be public. Another way of saying this is that the defendant must "give publicity" to the fact or facts in question. Private Fact: The fact or facts disclosed must be private, and not generally known. Offensive to a Reasonable Person: Publication of the private facts in question must be offensive to a reasonable person of ordinary sensibilities. Not Newsworthy: The facts disclosed must not be newsworthy. Stated differently, the facts disclosed must not be a matter of legitimate public concern. From Digital Media Law Project Note one thing - the offensive fact does not need to have been completely private for you to be liable, it must not have been generally known. In other words, someone like you who has a really low "public" bar needs to be careful. Also note that your buffer system might not help if the facts you publish are about someone other than the email sender; you are the one who published them. Stolen Information If someone sends you some intellectual property of a third party it is not yours to publish. Trade secrets, copyrighted works, prototype photos, etc. The sender might be breaking the law by sending the stuff to you but you're the one who published it so you can join as co-defendants. Barrett Brown was indicted for sharing a link to some stolen information. A link! He's in prison on other charges. Copyright held by the original sender (ht to @Dave_D) If the sender is the original author of the email, then the sender holds the copyright to the body of the email. Publishing the email violates the copyright. However, you could account for this in your buffer. Maybe. I am not sure is that is explicit enough.
No, it's not legal. The General Data Protection Regulations (GDPR) apply given that you are in the UK (regardless of where the Data Processor is based). The UK GDPR is slightly modified due to Brexit, but the same principles apply. The only plausible legal basis for this actions would be that you consent to it, and you're entitled to withdraw that consent at any time. Some may claim that Article 6.1(b) applies, i.e. that it's necessary to send marketing email in order to fulfil the contract, but GDPR is clear that bundling such consent into a contract for service simply to permit the data processor additional actions isn't allowed, as I'll demonstrate. UK GDPR requires that consent to use your personal information (in this case, your email address) for the stated purpose be freely given. Consent to use your information for direct marketing is not freely given if it's inseparable from the consent to use it for some other service, as per para 43: Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. And Article 7.4 backs this up with When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. The intent of Article 6.1(b) is that only the processing required for the service you have bought is allowed (e.g. if you supply your address for delivery of stuff you've bought, the data processor can use that address to send you the stuff, but is not allowed to add a contract term that allows them to send you unwanted stuff). Examples of emails that Article 6.1(b) would allow (in my assessment) include things such as notification of upcoming downtime, or a reminder that subscriptions are due, but not unsolicited advertisements for other products. There's a grey area that's open to interpretation, where adverts are piggybacked onto actual service messages.
There is no US law licensing journalists or people who report the news, or requiring such people to identify themselves by legal name. Nor can there be under the US First Amendment. There is also no law requiring a person to identify himself or herself by legal name online. Some sites, including Wikipedia, have policies against having multiple undisclosed user IDs for the same person, but that is a matter of the site's own rules, not a matter of law. Any US law mandating this would again run afoul of the First Amendment to the US Federal Constitution. This article on Anonymous Speech reviews and cites a number of US Supreme court cases on the subject of anonymity, mostly in political contexts. This article from the Electronic Frontier Foundation (EFF) discusses the same general subject. Both articles mention that The Federalist (analyzing and advocating for the then-unratified US Constitution) was originally published under the pseudonym "Publis". The EFF Article "Court Recognizes First Amendment Right to Anonymity Even After Speakers Lose Lawsuits" discusses the 6th Circuit case of Signature Management Team, LLC v. John Doe in which it was held that an anonymous blogger who lost a copyright infringement suit could nonetheless remain anonymous. This page apparently from a Harvard course, lists and briefly describes several cases on the same subject. In Doe v. Cahill, 884 A.2d 451 (Del. 2005) an elected official sued an online poster for defamation, and sought to force the ISP involved to disclose the poster's identity. The Delaware Supreme Court ruled against this, setting a standard offering greater protection for such anonymous online speech than previous cases had. This answer is very US-centric. Laws in other countries are different. The OP has not specified a country or jurisdiction.
If you aren’t the intended recipient of the password-protected file: StGB § 202a makes it illegal to access this file StGB § 202c makes it illegal to obtain (e.g., by brute forcing) the password for this file, if you intend to access the file that way (in the sense of § 202a) (this is the so-called hacker paragraph) If you are the intended recipient, this law doesn’t seem to apply, and it shouldn’t be illegal to brute-force the password.
Nobody know what constitutes "scamming", because it's not a legal concept. There is no sense in which receiving a gift itself constitutes "scamming". Since scamming is vaguely about dishonesty, there is an imaginable scenario where you could be liable for a false representation, for example if you impersonated someone else in order to receive something of value, you could be prosecuted in California. You should not assume that a police officer saying "That's not our problem" is proof that you committed no crime or civil tort. Your lawyer can give you advice as to whether you have anything to worry about, legally. The other stuff about being called a scammer or having pictures posted might be a violation of Facebook's TOS, and you can always complain to Facebook central authorities. Technically, uploading a picture that someone took is a violation of copyright law, if you didn't give permission to do so. It might run afoul of some state~provincial or national privacy law, depending on where this takes place.
As stated in the answer to What is considered &quot;public&quot; in the context of taking videos or audio recordings?; if either of the participants is in Australia than unless all parties have given consent then the recording is illegal. Notwithstanding its legality, property in the recording vests in the person who made it. There is no law against him keeping it. There is no law against him publishing it unless the material contained is offensive, hate speech or defamatory (see Customer feedback gathering in Australia).
No Voluntary disclosure, even accidental, by the client ends privilege. The information may still be confidential (inadmissible) if it happened in the appropriate circumstances, for example, as part of a mediation. Edit A recent decision of the High Court of Australia has determined that a litigant can use material that comes into its possession that would have attracted privilege irrespective of how this happens. In that case, the law firm was hacked by an unknown party, the information was given to a journalist and published and the litigant wanted to use it in their case - they were allowed to do so. The court decided that privilege is not a legal right that could found a course of action. Basically, it only prevents the compulsory production of such information - it doesn't protect the information itself.
IANAL, and as @GeorgeBailey suggests, you should ask one. That said, some aspects of your question are directly addressable with what we know. Does US law states anything about this? Yes. Federally this falls under the Wiretap Act, 18 U.S.C. §2511. Workplace monitoring generally falls under either the "System Administrator Exception" or under Consent. In general, continuing past a banner constitutes consent. Does company policy enforcement with such a warning over ride the right to not be subject to surveillance? In general, yes. You don't need to use the companies network if you don't want to consent - and they don't need to hire you if you don't want to use their network. But it's their network, and their rules apply. There are some nuances, and courts have found that the wording of the notice has made a difference in some cases, but overall, if the systems are properly posted with banners, then the employer may capture communications. See the "Bannering and Consent" section of this article from cybertelecom.org, e.g.: Even if no clicking is required, a user who sees the banner before logging on to the network has received notice of the monitoring. By using the network in light of the notice, the user impliedly consents to monitoring pursuant to 18 U.S.C. § 2511(2)(c)-(d). Note that stored data is covered by different laws than communications. It's a nuance. Is it ethical to sniff all the data without giving any other warning than the logon banner? "Ethical" is a very different question than "Legal", and largely more subjective. Most employers require signed consent for monitoring as a condition of employment, and use banners thereafter. That is ethical by my definition, in that it meets or exceeds the requirements of the law, and does not mislead or use subterfuge. The tone of your question suggests you find it distasteful, and therefore probably it violates your personal code of ethics.