Can Paypal withold funds for 180 days? Paypal, as part of their banking license, perform random checks on accounts where they ask for Photo ID, Proof of Address and Proof of Age. However, if one is unable to provide this information, for whatever reason, they prevent you withdrawing your funds for 180 days. Is this legal? (Specifically in the UK if that's relevant)
Probably Terms and Conditions extract: 7.2 Limitations on Closing Your Account. You may not close your Account to evade an investigation. If you attempt to close your Account while we are conducting an investigation, we may hold your funds for up to 180 Days to protect PayPal or a third party against the risk of Reversals, Chargebacks, Claims, fees, fines, penalties and other liabilities of whatever nature. You will remain liable for all obligations related to your Account even after the Account is closed. 10.6 Information about you a. PayPal reserves the right to request additional information from you, other than what is referred to in this Agreement, to allow it to comply with its anti-money laundering obligations. You agree to comply with any request for further information as we reasonably require to enable us to comply with our anti-money laundering obligations. This may include, without limitation, requiring you to fax, email or otherwise provide to us certain identification documents. You also agree to provide us, upon our reasonable request and at your own expense, information about your finance and operations, including, without limitation, your most recent financial statements (certified or otherwise) and merchant processing statements (if applicable). This is the contract that you agreed to be bound by.
Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. That's easy - this is exactly how all StackExchange sites (including this one) work :-). See for example: How does deleting work? on meta.SE. Is it against the right to erasure mentioned here as a part of GDPR? No, it is not (otherwise StackExchange would be in rather big trouble). The "right to be forgotten" is subject to limitations. Most importantly, it only applies to personal data. Personal data is defined as (GDPR, art.4): any information relating to an identified or identifiable natural person (‘data subject’) If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. The GDPR: What exactly is personal data?), but "personal data" is things about you (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data. In addition to that, even personal data may be retained if the data controller has a need to retain that information. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment. So, in summary: A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized. The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit. The StackExchange network, for example, covers this by allowing users to: disassociate posts from their account delete their account entirely (thus effectively disassociating all posts from personal information) asking a moderator for redaction of personal data
Name and date of birth are not sufficiently unique to identify a person. While name, date of birth, and place of birth do not have to be unique, either, it reduces the number of false positives. Also, date of birth is somewhat better known than place of birth for most people. Motorist: &quot;Sorry, officer, I seem to have lost my wallet. Everything was in there, ID, license, ...&quot; Cop: &quot;Tell me your name, date and place of birth, and I'll run a query if you do have a license.&quot;
When you make a request based on the GDPR, Art. 12(6) GDPR applies. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. As you can see, this only applies when the data controller (Blizzard) has reasonable doubts about your identity. If I understand it correctly, Blizzard provides services (games) which requires you to login with a username and password. So they have no doubts about your identity when you use their (paid) services with just a username and password. So there should also be no reasonable doubts when you make other requests when you are able to login to their website. A copy of your government ID seems unnecessary. Recital 57 also confirms that identification does not require a government ID: Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. A copy of your id, includes a photograph. The photograph could show health, religious, racial or ethnic information. That kind of personal data has much stricter rules defined in Art.9 . Most governmental IDs contain a national identification number. EU Member States can limit processing of those identification numbers even further. For example in the Netherlands processing of the identification number is only allowed when a specific law exists. So Blizzard is not allowed to process a Dutch national identification number. There are also ID convers] which hide sensitive information like document numbers and photographs in case you do need a copy of an ID. Also note that identification is only possible by comparing existing personal data with the provided personal data. I assume you did not provide a copy of your ID when registering. So many things which are shown on the ID do not make sense to sent to Blizzard. It does not know your place of birth, so it cannot verify it. Art. 5 requires 'data minimisation' for personal data. So they are not allowed to process more data than required. So you also do not need to send you more data than required. You should get an answer on your request within 30 days. However, since you ask to delete your account, the answer also might be that they will deny your request. They have to explain why they will not delete your account.
In the UK it is an offence to cause a computer to gain unauthorised access to any program or data held in any computer (s1 Computer Misuse Act 1990). It seems likely that other European jurisdictions have similar laws. Certainly Germany does: Penal Code 202a data espionage (German text - English translation). (I mention Germany because the linked thread does.) It might constitute theft in the jurisdiction if the finder did not take reasonable steps to find the owner - which may include informing the police of the find. Depending on the jurisdiction it might count as 'treasure' or abandoned property such that the finder is obliged to inform the authorities (the jurisdiction has the presumption of ownership of abandoned or lost property - e.g. Scotland), which then decide what to do with it. Legally speaking it seems to me that, to declare it legal, we have to get over such hurdles. [edit] There seems to be some dispute in the comments that cryptocurrency is subject to any regulation, counts as property, is something of value or is something that is owned and can be stolen, such that the person in the questioner's scenario could be held to account under the law for his behaviour. Aren't they merely numbers? No - plainly they do have value because people trade them with currency and goods and services. The UK's tax authority, HMRC, "does not consider cryptoassets to be currency or money" but sees them as having economic value because "they can be 'turned to account' - for example, exchanging them for goods, services, fiat currency (that is money declared by a government to be legal tender) or other tokens". They are "a new type of intangible asset". Individuals are liable "to pay UK tax if they are a UK resident and carry out a transaction with their tokens which is subject to UK tax". They are liable for "Income Tax and National Insurance contributions on cryptoassets which they receive from their employer as a form of non-cash payment [or from] mining, transaction confirmation or airdrops." (HMRC cryptoassets for individuals) Are they property? Something that can be owned, something that can be dishonestly appropriate (i.e. stolen)? That's the interesting dispute. Recently, the High Court of England and Wales ruled in a bitcoin ransomware-related case that "for the purpose of granting an interim injunction in the form of an interim proprietary injunction ... crypto currencies are a form of property capable of being the subject of a proprietary injunction". In that judgment there is some discussion of the authorities for considering or deciding they are property. ([2019] EWHC 3556 (Comm)) read from para 50 if not the whole judgment. In at least two other cryptocurrency-related cases the High Court treated the cryptocurrency as property. Vorotyntseva v Money-4 Limited, trading as Nebeus.com [2018] EWHC 2598 (Ch) and Liam David Robertson v Persons Unknown 2019. There was also a suggestion in the comments that the police would not understand and would not be interested. But there are several jurisdictions where people have been investigated, arrested, prosecuted and convicted of crimes relating to cryptocurrencies. A simple internet search for bitcoin theft, fraud or money laundering will result in some reports. In any case their interest or lack of it is irrelevant to what the law may say.
You can purchase any expensive item for cash, if the seller will accept it. In the US and many other jurisdictions, a seller is not required to accept cash, but many will. In the US and many other jurisdictions banks are required to report large cash deposits to government authorities, to help combat money-laundering, drug-dealing, and tax-evasion. Such a report may trigger an investigation, and during that investigation a person who bought an expensive item for cash may well be asked about the source of the cash. Whether an answer is legally required will depend on the law in the particular place. But even if it is not legally required, refusing to answer such questions may trigger additional investigation.
You have an agreement with the store that allows you to use scan and go technology. Part of that agreement a bit that says we may ask you to help us confirm that the service is working effectively by allowing us to check your goods against the scanner or to re-scan your shopping They also say that they are entitled to withdraw your right to use the Scan and Go service at any time if you do not comply with these Terms and Conditions. If we do that, the legal agreement created between ASDA and you under these Terms and Conditions will come to an end immediately, although any relevant statutory rights that you may have will not be affected. More generally, ASDA reserves the right to withdraw the Scan and Go Service at any time, at its sole discretion You have implicitly consented to a brief stop for a rescan. I don't see any implication that they assert a right to search your person. You can refuse a re-scan and they can process you like an ordinary customer. As for shoplifting, as this article summarizes, security can make a citizen's arrest if they suspect that you have committed a crime (theft). They have to have reasonable grounds for thinking that an arrest is necessary to prevent the loss. Hence they can detain you until the constable arrives.
My story: UK passport holder, resident in Switzerland, driving from Houston to San Antonio and stopped doing 105mph in a 60mph section of highway. I was given the citation and instructions, etc., but told the officer I was leaving in 2 days and may not be able to tend to it in time. On my return to Switzerland, I called the court and asked how I could pay. I was told I could get a money order from the post office, to which I replied, "Really, the Swiss Post office will issue U.S. money orders?" After a further 15 minutes of conversation about how I was willing but unable to pay, the officer said, "Well, I guess that we ain't commin' to Switzerland to get you so just ignore it!" I asked if I could have that in writing and he asked me to write to the court and explain my situation. 3 weeks later and I received a reply saying all was forgiven and I should have no problem re-entering the U.S. or the State of Texas. So my advice would be to call them, and act willing to pay. Things may have changed and you may be able to pay with a credit card, but if you act willing and they are unable to accept your payment, then as long as you have a paper trail, you should be fine. I have entered the U.S. dozens of times since and have even sponsored visas for others.