Creative commons attribution and GDPR When using content released under an open licence such as creative commons, it might be required to provide attribution to the author. For instance, if I were to use this image from Wikimedia Commons released under CC 4.0 BY-SA, I would be required to specify the username for the creator, as part of the attribution. However, according to GDPR, usernames are identifiable information. Does that mean that there are privacy implications in attributing the content? Or is the dealing of the information for the purpose of attribution fair and proper because the creator set a specifically open licence with attribution?
Under GDPR article 6 paragraph 1 item (c) one lawful basis for processing personal information (PI) is: processing is necessary for compliance with a legal obligation to which the controller is subject; The obligation to attribute a reused work under a CC license is such an obligation. Moreover, the licensor has the option under any CC license to specify a pseudonym for attribution of that work, or to waive attribution totally. Not doing that while releasing content under a CC license that requires attribution could reasonably be considered consent to publish that name along with each re-released copy of the work, so there are at least two lawful bases for processing that name and making it public. In some jurisdictions the license has the status of a contract, which imposes an obligation to attribute the author properly under GDPR Article 6 paragraph 3, as described in more detail in the answer by amon. Also, usernames are PI if and only if it is reasonably possible to associate them with a specific natural person. If a person chose a user name for a single site, not used for any other, and did not post any info that allows the person's identity to be determined, it is not PI. Often, of course, the person can be determined.
Yes If you are in the EU, or your players are in the EU and your service is targeted at some part of (or all of) the EU, then this pretty clearly falls within the scope of the GDPR. Such a service would be collecting data associated with natural persons. At least some of it would be made public along with an online identifier, and other parts would be processed and stored, even if disclosed only in anonymized form. (By the way it is a non-trivial task to anonymize data well enough that it is no longer persona data under the GDPR. But let's suppose yoru methods are good enough.) Under GDPR Article 6 the DC must have a lawful basis for such processing. If the basis is &quot;consent&quot; then the consent must be freely given, whch means giving consent may not be a condition of using the service. Under GDPR Article 13 a notice must be sent to the Data Subject (DS) when the data is collected from the subject, including some 11 items or categories of information about the collection process, the Data Controller (DC), the purposes of processing, the legal basis of processing (which the DC must define), who will receive the data, the data retention period, and various rights of the DS. Such a service must be prepared to respond to data access and data erasure requests, under articles 15-17, and data restriction requests under article 18. It must provide a method for a DS to easily make such requests. Other GDPR provisions may well apply in addition to these, but that is enough to show that such service is very likely to be within the scope of the GDPR, unless none of the DSs are present in the EU or the related market area.
It does not matter whether the document is authentic, because it is true, by law. Under copyright law, you must have permission of the copyright holder to copy any protected work (original creative work not created as a work of the US, as an example under US law). This is true whether or not the copyright holder tells you that copying requires permission. A matter for more concern is &quot;false permission&quot;, where a person without the right to grant permission utters something that the courts would usually interpret as being &quot;permission&quot;, for example releasing a Harry Potter book under CC-0. The legal requirement is that you have actual permission, not that a prohibition was not communicated to you. It is in your interest to know whether the actual person making available a work under some license actually has the right to grant a license. But there is no way to know for certain who holds copyright. You can, however, attempt to determine that a work has been registered with the US copyright office, looking here. Works are still protected when not registered, so failing to find a copyright registration does not guarantee that the work is &quot;open access&quot;. It would tell you who the registered copyright holder is. There is no &quot;innocent infringement&quot; defense, but under §504(c)(2), your liability for statutory damages can be reduced to as little as $200, if you can prove that there were no indications that the work is protected.
The relevant concept is dedicating a work to the public domain, that is, saying in the work something like "This work is dedicated to the public domain". I understand that this isn't entirely reliable in European civil law. The preferred alternative is to license it to the public. However, you have to decide how "free" you want the work to be made. The normal state of affairs, where you do nothing and just rely on copyright law, is that you have the sole right to allow copies to be made and derivative works to be created. Thus if someone were to make a derivative work based on your composition, they would need your permission: but then they would have the right what they created (such as a translation). If you just abandon your property right to the work, you impose no obligation on others, and a person can freely create a translation (which is now their property). If you execute the right public license, you can allow people to use your work as long as they include that license in their versions. A fairly common public licensing scheme is the Creative Commons licenses. That article gives a decent summary of relevant rights and how particular licenses correspond to configurations of permissions. I would say that the most difficult thing to do is to figure out what you don't want to happen, and pick a license that matches that interest.
As far as copyright goes... Pixabay: Yes (with minor exceptions) Pixabay's license is quite broad, and allows for unattributed commercial use with a small number of exceptions. You can't &quot;use images with identifiable brands to create a misleading association with a product or service&quot; or &quot;portray identifiable people in a bad light or in a way that is offensive,&quot; but otherwise it would allow for use in a video (there are other exceptions, but they wouldn't really apply to such use). Flickr: It depends on the license By default, images are not licensed for additional use other than viewing on Flickr. However, users are free to license their images as they wish, and Flickr explicitly supports various Creative Commons Licenses, many (but not all—particularly the NC licenses) of which would support such commercial use. Depending on the license, additional requirements, such as providing attribution, may apply. Note that there are non-copyright concerns that might come up in specific situations, such as trademarks (I mentioned one potential issue in my explanation of the Pixabay license) or model releases. Another answer to this question has some good information on these concerns.
Is X considered personal data? Can you use X to directly or indirectly identify a natural person? In the data to which you have access can X be related to an identifiable natural person? If you answer yes to either of those questions then X is personal data. Article 4(1): ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Scenario 1: you want to count each user agent that comes to your site, that's the only data you have, then the user agent is not personal data (it cannot be used to identify someone - unless it has a name and address etc, which seems highly unlikely - and you cannot relate it to anyone). Scenario 2: you have customer records with names, addresses etc (clearly personal data) and want to record each customer's user agent then the user agent is personal data (it relates to the identifiable natural person). Scenario 3: in one dataset you record that a user agent was associated with order ID 123456 and in another dataset you record that order ID 123456 was for John Smith (plus address etc), then the user agent is personal data (it relates to the identifiable natural person). Is this considered storing personal data? If X is personal data. Do I need user's consent to record X? If you want to record X and X is personal data, then you must have an Article 6 lawful basis for recording X. Consent is one of the six lawful bases. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
Yes, but it doesn't matter. This answer discusses gdpr implications. Personal data is any information that relates to an identifiable person. The GDPR has an extremely broad concept of identifiability, also covering indirect identification using additional information and with the help of third parties. Even just being able to single out one data subject, i.e. being able to distinguish different users from another, counts as identification. If you already have a concept of user accounts, any information that is linked with the user accounts and somehow relates to those users would also be personal data. Since you have distinct push tokens per user, it seems like this criterion would be met. Additionally, those unique tokens might be directly identifying by themselves. The GDPR does not allow for semantic games like “it only identifies the device, not the user”. The key here is that the definition of identifiability does not hinge on your intentions, but on objective capabilities: if you or someone else who can come into possession of this data were to attempt to identify the user (such as singling out users from another), would they be reasonably likely able to do that? Since most devices are single-user, being able to identify a device would imply that you're reasonably likely to also identify users. Just because something is personal data doesn't mean you're forbidden from using that data. It means that you'd have to comply with GDPR rules, if you're otherwise within scope of that regulation (e.g. if you're EU/UK-based, or are targeting your services to people who are in UK/EU). For example, basic GDPR compliance steps include having a clear legal basis for your processing of personal data (such as necessity for performing a contract to which the data subject is party, or necessity for a legitimate interest, or consent), providing a privacy notice, and taking appropriate technical and organizational measures (TOMs) to ensure the compliance and security of processing. For example, TOMs regarding these push tokens could involve encryption, access controls, and a plan for installing security patches in order to prevent data breaches. Using push tokens is already a good measure in this context, since they are effectively pseudonymous and prevent linking additional information via that token (two sites/apps pushing notifications to the same person will have entirely different tokens). However, the push notification provider (e.g. Google, Apple, Mozilla) can resolve the pseudonymous tokens and link them to a person, indicating that these tokens are ultimately identifying (even if you can't perform that linking yourself). Note that if GDPR applies, then other EU/UK rules might apply as well. For example, sending electronic messages (such as emails) is subject to anti-spam rules (EU: ePrivacy, UK: PECR). These rules apply regardless of whether personal data is involved. Since the rules are not technology-specific, it is likely that regulators would consider user-visible push notifications to be equivalent to more well understood technologies like email and SMS.
Is there any sources of information where extraction of data from a closed source application and provided to a data subject is further defined? No, the GDPR is based on &quot;general principles&quot; and does not concern itself with implementation details for such matters. It's possible there's EU case law on this, but I can't find any. Am I within my rights to insist on this, even if to comply they would have to do some software development? Yes you can demand it, but they don't have to comply with your demand. The information only has to be provided in a &quot;concise, intelligible and easily accessible form, using clear and plain language.&quot; and they only have to provide the information electronically where &quot;reasonably practical&quot; to do so, and they only have to take &quot;reasonable steps&quot; to do all this per Section 52 of the Data Protection Act 2018 which implements GDPR into UK law. You can complain to the Information Commissioner's Office, and they will decide if Section 52 has been complied with or not. 52 Form of provision of information etc (1) The controller must take reasonable steps to ensure that any information that is required by this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language. (2) Subject to subsection (3), the information may be provided in any form, including electronic form. (3) Where information is provided in response to a request by the data subject under [the Right of access by the data subject], the controller must provide the information in the same form as the request where it is practicable to do so.