Is a UDP/IP network exempt from COPPA? COPPA 312.2 defines "Internet" as collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire, radio, or other methods of transmission. A literal reading of this means that if you use UDP instead of TCP, you would be exempt from COPPA. Have there been any rulings on this?
As far as I can tell, no appeals court has had to decide whether "the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol" includes UDP for the purposes of 16 CFR §312. I will argue that UDP is included. From King v. Burwell (internal citations removed): when deciding whether the language is plain, we must read the words in their context and with a view to their place in the overall statutory scheme. 16 CFR §312, in conjunction with 15 USC §6501-6505, implements the Children's Online Privacy Protection Act of 1998. The FTC is directed in 15 USC §6502(b) to promulgate regulations that (emphasis mine): require the operator of any website or online service directed to children [...] to provide notice of what information is collected [...] and to obtain verifiable parental consent The FTC drafted 16 CFR §312 to that end. To treat UDP as exempt would mean that the FTC has not fulfilled their duty under 15 USC §6502(b). So, given the context of the overall statutory scheme, it is reasonable to conclude that the FTC intended 16 CFR §312 to include UDP. However, even without the above line of reasoning, if the FTC were to attempt enforcement of 16 CFR §312 as if it included UDP, that interpretation would be controlling. The FTC would be afforded Auer deference by the court. They wrote the regulation; they know what it means. From Auer v. Robbins 519 U.S. 452 (1997): Because the salary basis test is a creature of the Secretary's own regulations, his interpretation of it is, under our jurisprudence, controlling unless plainly erroneous or inconsistent with the regulation. And from Bowles v. Seminole Rock &amp; Sand Co. 325 U.S. 410 (1945): Since this involves an interpretation of an administrative regulation, a court must necessarily look to the administrative construction of the regulation if the meaning of the words used is in doubt. The intention of Congress or the principles of the Constitution in some situations may be relevant in the first instance in choosing between various constructions. But the ultimate criterion is the administrative interpretation, which becomes of controlling weight unless it is plainly erroneous or inconsistent with the regulation. Again, given the context of the overall statutory scheme, such an interpretation of the regulation by the FTC wouldn't be plainly erroneous.
OK, so you understand that clickwraps do create enforceable contracts. the person "agreeing" to the dialog can arbitrarily manipulate the contents of the agreement terms So what? I can do a similar thing with a pen and paper agreement. You send me an agreement, I tell you I accept but secretly I have changed it. Well, guess what, when this ends up in court the judge won't care if I wiped my ass with it - I communicated my acceptance of your terms; therefore that is what I accepted. Under the hood, Google can show what the HTML was that their server sent to you and the http response that you sent back. They said "Do you accept?" you sent back "yes", deal done. What you did with the html in your computer does not matter one iota; just like what you did with pen and ink terms would.
No. This is governed by the HIPAA Security Rule which was a regulation that the HIPAA statute required the Department of Health and Human Services to adopt. The Rule does require someone covered by HIPAA to have a "Business Associate Agreement" (BAA) and a Service Level Agreement (SLA) with any cloud storage provider (which would be the usual way that a U.S. health care provider subject to HIPAA would have a foreign server), but the Rule does not require that a server be physically located in the United States. The lack of this requirement is a good one, because when you are transmitting data (which the Security Rule requires be done in a secure fashion), you can't know which servers the information will end up on in a trip from source to destination. Email and all other Internet content travels through what amounts to a pony express. It goes through a variety in intermediate server nodes which can change during the course of a session, and generally speaking, you never know which intermediate nodes are used. You could be seeing this answer via a server in China, for example, and you would never know it.
Mongolia apparently has a list of banned words (list is NSFW) that websites can't use. And according to this State Department report: Additionally, the regulation requires Web sites with heavy traffic to use filtering software that makes the user Internet Protocol addresses of those commenting or sharing content publicly visible. The report also says: The law places the burden of proof on the defendant in libel and slander cases, and both defamation and insult are criminal charges. NGOs reported that these laws were used more frequently than in previous years to control the press. Canada is probably a better choice, even if it isn't perfect.
If you mean the Regulation of Investigatory Powers Act 2000 (aka RIPA), it doesn't provide for mandatory retention of communications data. Broadly speaking, RIPA is about interception as opposed to mass surveillance or retention just in case. The Data Retention (EC Directive) Regulations 2009 obliged &quot;public communications providers&quot; to retain what is commonly known as 'metadata', i.e. information about the communication - the originating phone number, the receiving phone number, the date, time and duration (if relevant), the type of call or message - not the content of the communication. See Schedule 1. In April 2014, in the case known as Digital Rights Ireland the Court of Justice of the European Union declared the EC Directive invalid. In response, the UK made the Data Retention and Investigatory Powers Act 2014 (DRIPA) - sunsetted on 31 December 2016. This provided for the Secretary of State to issue a data retention notice to a communications services provider (CSP), requiring it to retain the data types set out in the Schedule to the 2009 Regulations. DRIPA's Explanatory Notes support my claims above with a summary of the history. This was replaced by the Investigatory Powers Act 2016 (IPA), Part 4 of which deals with the retention of communications data. Here too the retention is of the metadata not the content (see s11(87) and the Explanatory Notes).
Question 1. Are technical identifiers personal data? Yes. If they identify a person. For example an IP Address is considered personal data, because a person or household can be identified by an IP. Yes, I know that technically there are a lot of exceptions. But in general, if you have an IP, you can identify the subscriber given the right databases. So if your identifier, lets say a generated GUID, identifies a customer or something the customer can be linked to, it is personal data. Question 2. Can technical identifiers be stored in measurement devices? Just because something is personal data, does not mean you are forbidden from using it. As long as you need it to do your job, you can store it. The internet would not work, if everybody was forbidden from storing any IP address. So to summarize it: yes, it is personal data since it identifies a subscriber. However, it is needed for the job your subscriber asked you to do. So for as long as the job takes, it is legal to store it. Once your job is done, you would be required to delete it. But consent trumps everything. If your subscriber consents to you keeping all data of such incidents to improve your network and handle future incidents better, then it's legal. Just let them sign it with your other legal paperwork. Done. No problem. You could just periodically delete all records that have no consent for long term storage beyond the current incident. Lets say every 24h or 48h. You should get the details on the wording of the paperwork and the period that it is legal to keep the data as &quot;current incedent related&quot; from your data protection officer or legal department.
Would any offence be committed for: Having this on your person? Buying or selling this? Leaving it around for people to plug in to a computer? In the abstract, I don't think that this conduct would violate either Section 36 of the U.K. law or U.S. law, although, obviously, purposefully destroying a computer itself (i.e. actually using the device without the consent of the owner of the computer) would violate many U.K. laws and would also violate many U.S. laws at both the state and federal level. I also don't think that possession or buying or selling this product would be a crime absent some intent that it be used illegally, in which case there might be an "attempt" to commit a crime offense, or an offense that would make one part of a conspiracy to commit a crime. In the "leaving it around" example, there is arguably an intent to use it to harm another improperly, although the phrasing is ambivalent. While many statutes in the U.S. criminalize possession of burglary tools, or drug paraphernalia, sometimes with an associated intent element (although even these crimes often have an express or judicially implied intent to use element), I'm not aware of any statute that criminalize possession of tools for malicious destruction of property. So, if the tools aren't possessed or used in a manner intended as a step in the facilitation of a crime, I don't think that any law is violated. So far as I know, the U.S. does not have a counterpart to Section 37 of the British statute cited above (it isn't a terribly easy thing to search for to definitively rule out the existence of such a law because federal law has many uncodified crimes in unexpected statutes and there are many sets of state criminal statutes, not all of which are codified either). The example giving in the comments by @gnasher729 of possession of a hammer which could be used to do the same things that this object could be used to do is instructive. Arguably, this USB-like tool is more specifically targeted at malicious conduct. But, for example, when I used to work as a radio news reporter, we had a machine that was basically a high powered magnet that was specifically designed to destroy all information on magnetic media. This was, in part, so that it could be reused, but it was also so that confidential interviews wouldn't fall into the wrong hands once they were no longer needed, in much the way that one might shred paper documents. It isn't so implausible to think that a device like this one might be necessary for individuals or firms with national defense secrets embedded in their hardware and software to have on hand in order to destroy a sensitive computer in order to prevent a security breach, if necessary. In a case like that, leaving one of these devices around the office unlabeled might be negligent, but wouldn't have the intent necessary to be an intended crime. And, it is hard to imagine that the device itself, which seems pretty simple, would itself involve any technology that is a national security secret, so it probably wouldn't violate export control laws. Of course, possession, purchase or sale of such a specialized device, or leaving it around unlabeled would certainly be powerful evidence of an intent to use the device in a wrongful manner, and hence, of an attempt to commit a crime. Indeed, possession of such a device or purchase of one might very well be sufficient to establish probable cause to seize the device and arrest the person holding it on charges of an attempt to destroy a computer. But, this device would be merely powerful evidence of an intent to commit a crime, rather than something that is a crime to commit in and of itself. There are no international laws that govern this kind of thing. The only international laws applicable to individuals pertain to war crimes and nuclear and chemical weapons. Even then, most international laws direct member nations to adopt domestic laws on the subject rather than being self-executing.
Import laws apply to the one who imports. In your scenario that is the person in country A only. The server owner does not cause the digital content to be transmitted to A. The one who downloads does.