Are encryption apps (iOS) exempt from US Export Regulations if released to the US App Store only? Note: The original question in iTunes Connect regarding exemptions has since been changed to reflect recent changes made to their FAQ as follows: Does your app meet any of the following: (a) Qualifies for one or more exemptions provided under category 5 part 2, (b) Use of encryption is limited to encryption within the operating system (iOS or macOS), (c) Only makes call(s) over HTTPS, (d) App is made available only in the U.S. and/or Canada. TL;DR - In short, the answer to my original question per Apple Export Compliance is yes, "(under option d), encryption apps are now exempt from Export Regulations if sold in the U.S. and Canada app stores exclusively." I have an iOS app built and ready to ship which allows the user to perform symmetric encryption using arbitrary length keys (i.e. > 56 bits). I've been reading up on US export regulations and am looking to extend my research here as well. Question: If I have an iOS app that performs "strong" encryption but I only make it available to select territories (i.e. US), can I answer "Yes" to the following question? Does your app qualify for any of the exemptions provided in Category 5, Part 2 of the U.S. Export Administration Regulations? Make sure that your app meets the criteria of the exemption listed here. You are responsible for the proper classification of your product. Incorrectly classifying your app may lead to you being in violation of U.S. export laws and could make you subject to penalties, including your app being removed from the App Store. Read the FAQ thoroughly before answering the questions. You can select Yes for question #2 if the encryption of your app is: (a) Specially designed for medical end-use (b) Limited to intellectual property and copyright protection (c) Limited to authentication, digital signature, or the decryption of data or files (d) Specially designed and limited for banking use or "money transactions"; or (e) Limited to "fixed" data compression or coding techniques You can also select Yes if your app meets the descriptions provided in Note 4 for Category 5, Part 2 of the U.S. Export Administration Regulations. I should also point out that it's quite possible (and perhaps easy) to VPN into the US to download an app only being sold within the US and I guess this is where my main question lies - is this considered "exporting" and thus subject to US Export regulations as well?
Update (12/2/16) - Just received the following confirmation from Apple Export Compliance: The [redacted] app presently uploaded into your account CAN BE legally released to US and Canada only, it will not be necessary to go through Export Regulations. They have also rephrased the question "Does your app qualify for any of the exemptions...?" to the following: Does your app meet any of the following: (a) Qualifies for one or more exemptions provided under category 5 part 2, (b) Use of encryption is limited to encryption within the operating system (iOS or macOS), (c) Only makes call(s) over HTTPS, (d) App is made available only in the U.S. and/or Canada. Update (12/1/16) - In addition to the research below, a list of "Sample Scenarios" are given in iTunes Connect Resources and Help, one of which states: A developer chooses to release his app in the U.S. and Canada only. -- No U.S. CCATS or ERN is required. No France Import Declaration is required. The following statement (mentioned earlier in the same page) should also be taken into consideration regarding exemptions: All liabilities associated with misinterpretation of the export regulations or claiming exemption inaccurately are borne by owners and developers of the apps. So it appears the correct answer is likely not: N.B. to Note 3 (Cryptography Note): You must submit a classification request or self classification report to BIS for mass market encryption commodities and software eligible for the Cryptography Note employing a key length greater than 64 bits for the symmetric algorithm ... in accordance with the requirements of § 740.17(b) of the EAR in order to be released from the “EI” and “NS” controls of ECCN 5A002 or 5D002. Furthermore, under Note 4: Category 5 - Part 2 does not apply to items incorporating or using "cryptography" and meeting all of the following: a. The primary function or set of functions is not any of the following: “Information security”; A computer, including operating systems, parts and components therefor; Sending, receiving or storing information (except in support of entertainment, mass commercial broadcasts, digital rights management or medical records management); or Networking (includes operation, administration, management and provisioning); b. The cryptographic functionality is limited to supporting their primary function or set of functions; and c. When necessary, details of the items are accessible and will be provided, upon request, to the appropriate authority in the exporter's country in order to ascertain compliance with conditions described in paragraphs a. and b. above. I suppose there could be clarification under this note, but if I understand it correctly, an iOS app having the sole purpose of performing symmetric encryption with keys greater than 56 bits would have the primary function of: "Information security" Being "a computer" Barring clarification on these points that would qualify for exemption, NLR, etc. self-classification would likely be [any of the following]: 5D002.a.1.a (software) - Designed or modified to use "cryptography" employing digital techniques performing any cryptographic function other than authentication, digital signature, or execution of copy-protected "software," and having ... A "symmetric algorithm" employing a key length in excess of 56-bits Encryption registration may have also been required prior to September 20, 2016 (see linked reference). "Companies no longer are required to submit an encryption registration to BIS before self-classifying and exporting certain encryption items..." (Wiley Rein LLP) References: Commerce Control List: Category 5 Part 2 (Cryptographic "Information Security") - BIS Export Compliance - f5 License Exception ENC (740.17) - BIS Information Security Updates (September 20, 2016) BIS Publishes New Encryption Rule - Wiley Rein LLP
I'd rather not, but this might be compliant if you make sure that the personal data under your responsibility remains secure and protected even if it is processed abroad. Since the UK has left the EU, it is sometimes necessary to distinguish between implications of the EU GDPR and the UK GDPR. These are functionally equivalent, but in the matter of international data transfers the practical details have diverged. In my answer that you cited, I argued that any website processes personal data, and is thus potentially in-scope for the GDPR. If you cause another organization to process this personal data outside of the UK, you are performing an international data transfer (called “restricted transfer” in UK guidance). For example, such non-UK processing occurs if you use cloud services that run outside of the UK. The UK ICO has guidance on international data transfers. As in an EU GDPR context, you can only perform the transfer if the data remains suitably protected, or one of the exceptions applies. The data remains suitably protected if the target country was attested and “adequate” level of data protection, or if you have implemented appropriate safeguards. As of 2022, the list of countries considered adequate is generally equivalent to the EU list of adequacy decisions. Notably, the US is no longer on that list after the Schrems II decision that invalidated the Privacy Shield Agreement. Since this decision was made before Exit Day, it also applies in the UK. This leaves “appropriate safeguards” for UK→US restricted transfers. In the linked ICO page, read the section Is the restricted transfer covered by appropriate safeguards?. In brief, you will need to perform a Transfer Impact Assessment, and sign Standard Contractual Clauses with the US data importer. In a Transfer Impact Assessment (TIA), you check that the data remains protected despite the transfer into a country without an adequate level of data protection. There is no official guidance on conducting a TIA, but the IAPP has a template and the EU EDPB has recommendations on supplemental measures to protect data transfers, which might reduce the risk and affect a TIA in your favor. It's worth noting that the EDPB recommendations were written in the wake of the Schrems II ruling, and can be summarized as “compliance is impossible when using US-based cloud services”. But this is your assessment, and TBH it seems the UK is a bit more relaxed than the EU in this regard. The Standard Contractual Clauses (SCCs) are a pre-formulated contract that binds the foreign data importer to handle the data properly. In essence, this translates relevant aspects of the UK GDPR into contract law. Many service providers already provide a Data Processing Agreement that includes SCCs by reference, but you'll have to make sure that these contracts have been entered in a legally binding manner. Sometimes these apply automatically as part of the terms of service, sometimes you need to explicitly sign these documents. But SCCs are one detail where UK GDPR compliance and EU GDPR compliance diverges a bit. The old EU SCC templates from 2004/2010 can no longer be used and have been replaced. For compliance with the EU GDPR, the new 2021 SCCs must be used. For compliance with the UK GDPR, you have two options. You can either use the 2022 International Data Transfer Agreement (IDTA), or you can use the 2021 EU SCCs along with the 2022 UK International Data Transfer Addendum which modifies the EU SCCs in some details. Don't want to deal with TIAs and SCCs? Switch to a hosting provider that only processes the personal data under your control in the UK, or in a country with an adequacy decision (e.g. EU, Canada, Israel).
The US CFAA is by no means limited to &quot;the US government and its financial interests &quot;. It currently applies to any computer which is &quot;protected&quot;. 18 USC § 1030(e)(2) defines a &quot;protected computer&quot; as (in part): a computer ... (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States This covers any computer connected to the internet. 18 USC § 1030 (a)(2) (C) applies to anyone who obtains without authorization : information from any protected computer; Of course, nothing requires federal prosecutors to bring charges for all acts which technically violate this sub-section. If someone hacks another person's holiday card address list, I doubt if a CFAA prosecution would be brought, but it could be if the US Attorney thought fit.
Both. The user made an infringing copy with the upload, the developer did with the download. Further the ToS between the app owner and the user will not protect them from being sued by the owner of the copyright. They don't have any ToS with them.
Are there such restriction for F-1 students who have been in the US for less than 5 years, who are non-resident aliens for tax purposes and are actually not citizens of the US but are citizens of another country? Short Answer For the most part, citizenship and immigration status are legally irrelevant to your eligibility to participate in an ICO (there are isolated exceptions related to international trade sanctions, and there are certain "sensitive" industries that usually wouldn't apply to an ICO). This said, no issuer of coins is required to make the offering available to everyone who is not prohibited by the applicable laws from participating. For example, if someone wants to make an ICO available to anyone but Canadians, that is their prerogative. But, in practice, most private ICOs require investors to be accredited investors, and few students on F-1 visas have the wealth, income or professional qualifications necessary to be accredited investors. Long Answer In an ICO made in the United States, the issuer (i.e. the person creating the coins) and the underwriter (i.e. the professionals retained to handle the ICO for the issuer, which will sometimes be the same person as the issuer) are electing to treat the coins as "securities" for the purposes of U.S. law which means that they can be issued only as a "public offering" upon registration with the SEC under the '33 Act or the '34 Act, or under an exception to those acts. While the statutes enumerate exceptions to the Acts, almost everyone sticks to trying to comply with one of the safe harbor exceptions created by SEC Regulation D. This protects the issuer and underwriter from legal liability for making an unregistered offering of a security that does not fall within an exception to the registration requirement, even though it is not unambiguously clear that cyptocurrency coins are "securities." They do this because the consequence for being wrong on this legal question of first impression are very severe and could lead to civil liability for all losses that coin holders experience, large civil penalties that cannot be discharged in bankruptcy, and criminal convictions. Eligibility to participate in a private offering made pursuant to the Regulation D exceptions to U.S. Securities laws (mostly the '33 Act and '34 Act) governing public offerings of securities that often require someone to be an "accredited investor" does not depend upon the immigration status or citizenship of the investor. A private ICO would ordinarily be made under a Regulation D exception. There are two Regulation D exceptions (one for offerings of less than $1,000,000 in the aggregate by an issuer, and another for intrastate offerings) which do not require you to be an accredited investor and there are other exceptions with allow a small number of non-accredited investors to participate if they are provided a professional advisor to counsel them in evaluating the offer. The most popular Regulation D exceptions for private offerings, however, are limited to accredited investors, which are available without regard to citizenship. A non-citizen could probably not participate in an offering made pursuant to the intrastate exemption, but this exception is quite unpopular for issuers and underwriters because very few offerings qualify under it and the boundaries for qualification are not well defined. I could imagine an ICO being made under this exception but I am not aware of any that actually are be made in that manner. Generally, to be an accredited investor you must be a certain kind of business entity (e.g. a bank), or a member of a certain set of professions (e.g. lawyers and brokers), or have a certain net worth and/or income. To be an accredited investor, a person must demonstrate an annual income of $200,000, or $300,000 for joint income, for the last two years with expectation of earning the same or higher income. An individual must have earned income above the thresholds either alone or with a spouse over the last three years. The income test cannot be satisfied by showing one year of an individual's income and the next two years of joint income with a spouse. The exception to this rule is when a person is married within the period of conducting a test. A person is also considered an accredited investor if he has a net worth exceeding $1 million, either individually or jointly with his spouse. The SEC also considers a person to be an accredited investor if he is a general partner, executive officer, director or a related combination thereof for the issuer of unregistered securities. An entity is an accredited investor if it is a private business development company or an organization with assets exceeding $5 million. An organization cannot be formed with a sole purpose of purchasing specific securities. Also, if an entity consists of equity owners who are accredited investors, the entity itself is an accredited investor. In 2016, the U.S. Congress modified the definition of an accredited investor to include registered brokers and investment advisors. Also, if a person can demonstrate sufficient education or job experience showing his professional knowledge of unregistered securities, he is also considered an accredited investor. In contrast, in the case of a public offering, which must be registered with the SEC under the '33 Act or '34 Act, any adult of any nationality (except as noted below) can participate without being an accredited investor. Still, in general, a U.S. securities law perspective, an investor from the U.K. or France or South Africa is the same as a U.S. citizen, even though the tax treatment of the investment for a non-citizen is very different from the tax treatment of the investment for a U.S. citizen or permanent resident. The primary exception to this general rule is that there are some people in some countries who are prohibited from investing in U.S. securities as a consequence of international trade sanctions. These would include members of the families of certain government officials in Russia, Syria and Venezuela, for example. Usually, a private offering packet provided to potential investors (such as one I wrote a couple of months ago involving international investors as well as U.S. investors) will include a separate form in which potential investors certify to the issuer and underwriter of the offering that they are not prohibited from investing under these laws which are enumerated in the form. Non-citizens who are not resident aliens (i.e. who are not green card holders), are also usually required to make a disclosure related to income tax compliance that is different than the Form W-9 that has to be provided by U.S. citizens and green card holders. There are also certain industries (e.g. equity investments in Colorado legal marijuana dispensaries, or farms in some Great Plains states) in which non-resident non-citizens are simply prohibited from making investments entirely although there are no ICOs of which I am aware that would fit in that category.
GDPR does not cease to apply because of the location of data storage. It applies based on the location of the data processor, data controller, and data subject. If you are in the EU, you are a data subject covered by GDPR. It does not matter where the data are stored. Note that you are asked to confirm that you're aware that US laws may be less protective, but you're not asked to acknowledge that anything about the arrangement causes the "laws of your country/region" not to apply. The company also does not seem to be claiming that they don't apply, although it seems that they want you to think so, and it's not clear whether they think so. You are correct that GDPR doesn't allow its protections to be waived. A data subject may always consent to certain processing, and some processing may be performed without consent, but it's not possible to waive the right to withhold consent for processing that does require it.
I'm pretty sure that under GDPR, you can indeed request them to send all data they have on you. If it's a complex request, they may charge you something like £10. If they have a lot of data on you, they may list the categories of data they have and ask you to pick one, rather than them having to collect and send everything. They should respond within one month, but iirc in the UK implementation, they can inform you (within that month) that they will respond within three months instead. For the rest, I only know current Dutch law. GDPR is not that different from what we already had (in general terms) and in many cases it even extends it. Under our law (WBP), you can also request a correction of the data in case it is incorrect, or deletion if they no longer need it for the purpose for which it was collected and stored. I don't really know how that works out in practice though, as Facebook can of course claim that "being able to connect you to your friends when you sign up for WhatsApp or Facebook with that number" is a legitimate purpose (in their eyes). They might also not have your full name and therefore not be able to connect your data to your request. Or, perhaps, they have only your full name (and there are probably more people with your name), so they'll have a hard time verifying that it's really your data which they would be handing over or deleting. The company is required to verify your identity before acting on your request. How they implement that is up to them. Under Dutch law, if I remember correctly, any data that can be connected to your person by any party is personally identifiable information (PII). While Facebook might not be able to find who's behind a phone number, your carrier most certainly can. Therefore, the data falls under PII protection laws and they will have to implement a way to verify you and get you your data. Finally, whether your local laws apply to Facebook, I don't know exactly. There's lots of information on this though, so you should be able to find it. Generally, countries say that if something happened within their territory (e.g. you signed up for WhatsApp while in the UK), their law applies. Companies, I've read, will instead try to claim that their main office is in SomeCountry and therefore SomeCountry's laws apply. But I'm pretty sure you'll be able to find a Facebook office somewhere where GDPR applies, so that's probably fine. While not an exact answer and while I am not sure about everything, I hope this gave you some pointers to go on!
GDPR gives you a lot of flexibility here to choose either DPA. From Art 77: Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. However, the DPA from the company's country would be designated the lead supervisory authority for this investigation. If multiple DPAs are involved, they would coordinate with each other. There is no EU body that you could contact directly. But if the different DPAs have a dispute regarding this investigation, the EDPB would provide a consistency mechanism. This mechanism has been used in the past e.g. to force the Irish DPA to correctly apply the GDPR against companies from the Meta group, like WhatsApp and Instagram. Though it might slow things down, it could be advantageous to have multiple DPAs involved, precisely so that the investigation is double-checked. If the lead supervisory authority declines the case, this would also enable the other DPA to do its own investigation. So, it would be a good idea to lodge a complaint with the DPA of your home country, and let it forward the issue to other DPAs as needed. However, contacting the DPA in the company's country would also be fine, especially if you are fluent in the relevant official language, and/or if you live in Ireland.