Google Photos Takeout - machine learning classification missing I did a Google takeout of Google Photos and was able to download all stored images including some meta data, but not the classification data Google is most likely doing, because I can search for persons and objects in the Photos app. So my question is: When a company is requested to provide the personal data to the user, does this also include the derived data?
This issue touches upon two distinct GDPR rights: Art 15 right to access: you have a right to receive a copy of all personal data concerning you that are undergoing processing (including storage). Access may only be denied where this would “adversely affect the rights and freedoms of others.” Art 20 right to data portability: if processing is being carried out by automated means, and processing is based on certain legal bases (consent or contract, but not legitimate interest), then you have a right to receive a copy of your personal data in a machine-readable format, for personal data that you have provided to the data controller. Whereas the right to access is fairly straightforward, the right to data portability applies under much more narrow conditions. Basically, it's a right that you can download any data that you've uploaded so that you can move to a different service. Google Takeout is primarily concerned with your right to data portability, and provides your data in a machine-readable format. Any photos that you've uploaded to Google Photos, you'll be able to download. Thus, it could be technically compliant to exclude information that they've inferred about your personal data, such as image-recognition results. Such results would still be personal data under the GDPR definition of the consent, and would be covered by your right to access. Google might argue that you already have access to this data through the web interface. In my opinion the GDPR clearly requires the data controller to provide a “copy”, i.e. the data in some durable form – not merely access through a web interface. Whereas your question is specifically about Google, the same issue applies to other services as well. E.g. Ruben Verborgh has an interesting blog series on trying to get access to all their data from Facebook, though unsuccessful so far. Similar to your scenario, Facebook offers a download for personal data but does not include all personal data in this download. In one of the documents provided by Facebook in the course of the exchange, they note that they allow access to photo tags through the web interface, but do not include this in downloaded data – without providing further justification.
The line they'll rely on for GDPR compliance is the first part of that sentence - "If you agree to this during the order process", which suggests that there will be a separate request to opt in to marketing communications at some other time in the process. Check any order documents. There's likely to be a tick box or similar on at least one. If that implies opting out rather than opting in there may be grounds to argue with that under GDPR, but there's nothing in the quoted text that suggests a problem.
You are only responsible for the data that you collect or process, or data that you direct others to collect or process on your behalf. You are not responsible for the actions of third parties that may carry out incidental collection or processing that you have no control over - this includes such things as your ISP, backbone providers etc, but if you direct a service provider (eg Cloudflare, Amazon AWS etc) to cache your content and process it on your behalf then you need to include that fact in your data processing policy and link to the providers own data processing policy.
You are framing it wrong. It is not that "they have put a barrier" to public domain information, it is that they have added an additional source of that information. The new source has a barrier, yes, but that does not prevent you from accessing the same information elsewhere. If you own a copy of some public domain data, you are not allowed to prevent other users from accessing other copies (by claiming copyright infringement or the like); you cannot even prevent people from doing copies from the copies you did provide them. But you are not forced to allow other users to access your copy. Consider the logical conclusion if that were the law. The moment that you downloaded some public domain file into your computer, you would be forced to give access to your hard disk from the internet, isn't it? Would you need to leave your home door open if you happened to have a printed copy of the text there? Of course, there is a need to discriminate between "public domain" (without licence) and "not public domain but open licence" (BSD, CC, GPL, etc.). In the later case the licence could be tailored so that the work could appear in archive.org but that it would be illegal to provide it with the business model of Academia.edu1. But that would be possible only for works not in the public domain. 1 To be decided by a judge on the basis of the wording of the licence and jurisdiction.
Per a decision of the US Copyright Office last month, AI generated images are not subject to copyright. That means you can use the generated images for any purpose you want1, but so can anyone else. However, the specific usage of a given image might be protected - so if you put a caption on the image and arrange it in the form of a comic (as the artist in that example did), that specific text and arrangement can be protected, but the underlying image can't be. Laws may differ elsewhere in the world, but that's the current stance in the US. 1 Subject to any appropriate laws, including any copyright laws which the new image itself may violate. Just because the image isn't protected itself doesn't mean that it can't infringe on someone else's copyrights. See the other answer for more details.
The judgment (Google Spain and Google (Judgment of the Court) [2014] EUECJ C-131/12) is definitive on this point at paragraph 41: ...the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference... In your example, the blogger would be unaffected by the decision as his links are presumably collected and sorted by hand. However, the blog itself may be removed from Google et al at the request of John Doe.
You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine. It is also curious that you are using consent as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that legitimate interest would be a much more straightforward approach in your case.
If there's a reason to believe that your machine has data that would be relevant to a lawsuit, then yes, it is subject to inspection under Fed. R. Civ. P. 34: A party may serve on any other party a request ... to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party's possession, custody, or control: ... any designated documents or electronically stored information—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form. So if there's a lawsuit where there becomes a question about what you downloaded from the network, then it's quite plausible that your device could be demanded or subpoenaed. But that's not the same thing as &quot;forfeiting&quot; your device. The normal procedure in such a case would be that the agency's lawyers would notify you of the demand, and you would take your device to an ESI expert, who would make a digital image of the device's hard drive. The parties would then fight about what portions of that image they are allowed to access, but you would have your device again while that was going on.