Legal protections for an expired email domain Recently, there was a question on Information Security which asked what could be done to protect the confidentiality of his contacts in the case that his custom email domain expires and someone else registers it. If this happens, the new registrant will be able to receive these emails. Because this was asked on the Information Security Stack Exchange, I was only able to provide a technical answer which boiled down to &quot;there's nothing you can do short of not letting the domain expire&quot;, but I now wonder if there isn't a legal option that could be pursued as a last resort. Is there any potential legal remedy which OP could use in the case that someone registers his domain, sets up an MX record, and begins receiving confidential emails intended for OP?
Not that I am aware of. A person who 'owns' a domain is entitled to utilize that domain including for the purposes of receiving emails. With physical mail, it is a crime in most countries to intentionally interfere with mail that is not addressed to you. For example - Australia. However, this is statute law and as such does not extend to emails - even if it did, if you own the domain then you are the person to whom it was addressed. I note that you seem to misunderstand "confidential" - this only arises in the context of a special relationship between the person transmitting the information and the person receiving it. Usually this is a contractual obligation between A and B but it can be imposed by law (e.g. doctor-patient, banker-client, lawyer-client, GDPR etc.). If A sends confidential (as between A &amp; B) information to C, C is under no general obligation to keep it confidential if C has no relationship of confidentiality with A or B. If C discloses it and B suffers damage, B sues A for breach of confidence (or the government prosecutes A for breaking the law); B has no case against C. For your situation, where B has allowed A to send the information to an obsolete address then B has contributed to the breach to an extent that B would be extremely unlikely to succeed in a suit against A.
Treat all email addresses as if they are personal data. All email addresses that belong to a specific person are personal data of that person, regardless of the specific form of the address. If your list contains the email addresses of data protection officers then all of them are personal data. The only exception I could see would be email addresses that clearly belong to a corporation that is they are addresses of a legal person which is not a natural person.
I think that one cannot answer a question such as "Will the personal use exception in the GDPR apply to personal blogs?", because it is unclear if you refer to: personal information published on the blog pages personal information collected from the Website, by way of forms, cookies, server logs, strictly collected and processed for the purpose of operating the Website for your own personal purposes as a blogger (by yourself of through a subcontractor in the sense of GDPR) and not personal information collected from the Website's operation, transferred or provided to third parties for their own purposes (this would include cookies used to identify and track users across multiple domains) Regarding 1., a personal blog wanting to benefit from the exemption should not publish third party's personal information without their consent or another legal basis, and C-101/01 certainly applies here. About 2., if the information is strictly collected and used for the own personal purpose of the operation of the blog, I would tend to agree that it should benefit from the exemption. I feel that C-212/13 would not necessarily be an indication that because the blog is publicly accessible it is then "directed outwards from the private setting" in the sense of this ruling, and should not be considered as "purely ‘personal or household’ activity". C-212/13 case was relating to a camera installed by an individual on his family home for its own security purposes which was also monitoring a public space. The persons filmed on this public space had absolutely no direct connexion with the person collecting their images. In case of a blog, the visitors of the blog interact with the blog for fulfilling the own personal purpose of the operation of the blog of the publisher of the blog. Another argument is given by the Recital 18 which you quote: a personal blog can be viewed as a type of social networking or related online activity. Finally, about 3., there is no doubt for me that, in this case, the publisher of the blog is engaged in an activity which is not personal, since it willingly provides personal information to third parties which they use for their own purposes (and not as subcontractors in the sense of GDPR). There may be other approaches apart from these 3, but that's a start for your considerations.
I can't find any law that would prevent an employer from requiring this. Under current Florida law, an employer can even demand passwords and access to an employee's social media accounts. A bill was proposed to prohibit this, but it hasn't passed. Generally, an employer can require anything they want as a condition of employment, as long as it is not illegal. Florida has at-will employment so the employer could certainly fire the employee if they don't comply.
Expunction may be possible for instance if you are acquitted, later proven innocent, pardoned, and various other things that fall short of being convicted and doing the time. The entire law is here (Texas code of criminal procedure 55.01). There is also the option of an order of non-disclosure, overviewed here. A requirement for such an order is that you were placed on and completed deferred adjudication community supervision, which from what I can tell is not what happened. "Background check removal" may range between simply taking your money and doing nothing, to doing what you could do yourself to get free of traces via radaris, intelius, spokeo, and so on to "request removal" from that web site. This will not make your record unavailable, because these websites don't have any special powers to reach into and manipulate state records.
I do not have the phone number, email, or anything else associated with the account. Well, neither do I - so it must be my account. Unfortunately, the fact that you appear in most or all of the pictures on that account does not prove that you own it. It could be the photographer's account. Do I have ANY options here Can you reactivate the email account associated with the Twitter account? Or the phone number? Either would allow you to reset the password and access the account. You can go to court (in California) and seek an injunction ordering Twitter to delete the photos or give you access. Of course, you have the same issues proving ownership here as you did with Twitter but the court may have different priorities (justice) than Twitter does (corporate protection). I had an idea. If you (or your husband) own the copyright in the photos (i.e. one of you was the photographer) you could issue a DCMA take-down notice because the poster (who, according to Twitter, isn’t you) does not have permission (even if they did at the time: permission can be revoked). Twitter would be unable to contact the account holder and would be required to remove the images when they got no response.of course, if the photographer was someone else, they could do it. Or you could break the law and say it was you, although I would never recommend this even with a near zero chance of being caught.
Contacting a business email about a business matter is usually fine, but in this case we have an unsolicited marketing communication (spam), not really a business matter. The client's jurisdiction likely has more specific rules about spam. Also, it is unusual (read: presumably illegitimate) to contact individual employees rather than the company's official address with the offering. From the GDPR perspective, every processing of personal data (such as email addresses that might identify natural persons) needs a legal basis (Art 6). Let's go through them: consent? No. necessary for performance of a contract involving the data subject? No. legal obligation? No. vital interests? No. public interest? No. legitimate interest? Perhaps. The client has a legitimate interest to conduct their business. However, this legitimate interest must not be overridden by the data subject's interests, rights, and freedoms. Such as the interest in not being disturbed by spam mails. It is the Data Controller's (your client's) responsibility to balance the legitimate interest themselves to determine whether they have a legal basis, but I really don't think that they do. In conclusion, your client's idea is a bad idea: They likely do not have a legal basis for this under the GDPR. They are likely violating more specific anti-spam laws in their jurisdiction. They are working hard to get their domain put on spam filter lists. Note that already the step of collecting employee email addresses is personal data processing and needs a legal basis. Of course, the GDPR does not apply when the client is not established in the EU and only processes the addresses of persons that are not in the EU.
If the operators of a site post them in such a way that anyone with a browser can access them, with no login or other security precaution required, and not even any notice that the files are confidential, they are implicitly inviting anyone to view them, and thus it is legal to do so. There was a case where a site owner gave specific notice to a user not to access the site, and blocked the user's IP. When the user hired a proxy service to get around the blockage, this was held to be unauthorized access, a crime under the CFAA (Computer Fraud and Abuse act). But in that case the individual notice was considered essential to the applicability of the act. That case was Craigslist, Inc v. 3Taps, Inc et al, 942 F.Supp.2d 962 (N.D. Cal. 2015). See also This Wikipedia article and thisJaxEnter article. As the Wikipedia article put it: Craigslist Inc. v. 3Taps Inc., 942 F.Supp.2d 962 (N.D. Cal. 2013) was a Northern District of California Court case in which the court held that sending a cease-and-desist letter and enacting an IP address block is sufficient notice of online trespassing, which a plaintiff can use to claim a violation of the Computer Fraud and Abuse Act. Note that in this case web scraping was apparently impacting the craigslist site.