What jurisdiction does an IP address fall under? What is an IP Address? An Internet Protocol address (IP address) is a numerical label assigned to each device (e.g., computer, printer) participating in a computer network that uses the Internet Protocol for communication. An IP address serves two principal functions: host or network interface identification and location addressing. Who manages IP Addresses? The Internet Assigned Numbers Authority (IANA) is a department of ICANN, a nonprofit private American corporation that oversees global IP address allocation, autonomous system number allocation, root zone management in the Domain Name System (DNS), media types, and other Internet Protocol-related symbols and numbers. What is a Regional Internet Registries? Regional Internet Registries are components of the Internet Number Registry System, which is described in IETF RFC 7020. The Internet Assigned Numbers Authority (IANA) delegates Internet resources to the RIRs who, in turn, follow their regional policies to delegate resources to their customers, which include Internet service providers and end-user organizations. Collectively, the RIRs participate in the Number Resource Organization (NRO), formed as a body to represent their collective interests, undertake joint activities, and coordinate their activities globally. The NRO has entered into an agreement with ICANN for the establishment of the Address Supporting Organisation (ASO), which undertakes coordination of global IP addressing policies within the ICANN framework. So IANA is a department of ICANN. On October 1, 2009 the U.S. Department of Commerce gave up its control of ICANN. In 2013, the NSA spying scandal has led to ICANN endorsing the Montevideo Statement. The Montevideo Statement on the Future of Internet Cooperation was released on 7 October 2013 by the leaders of a number of organizations involved in coordinating the Internet's global technical infrastructure. The statement was signed by the heads of the Internet Corporation for Assigned Names and Numbers (ICANN), the Internet Engineering Task Force, the Internet Architecture Board, the World Wide Web Consortium, the Internet Society, and the five regional Internet address registries (African Network Information Center, American Registry for Internet Numbers, Asia-Pacific Network Information Centre, Latin America and Caribbean Internet Addresses Registry, and Réseaux IP Européens Network Coordination Centre). In large part, the statement is seen as a response to the ongoing NSA surveillance scandal. The leaders made four main points: They reinforced the importance of globally coherent Internet operations, and warned against Internet fragmentation at a national level. They expressed strong concern over the undermining of the trust and confidence of Internet users globally due to recent revelations of pervasive monitoring and surveillance. They identified the need for ongoing effort to address Internet Governance challenges, and agreed to catalyze community-wide efforts towards the evolution of global multistakeholder Internet cooperation. They called for accelerating the globalization of ICANN and IANA functions, towards an environment in which all stakeholders, including all governments, participate on an equal footing. They also called for the transition to IPv6 to remain a top priority globally. In particular Internet content providers must serve content with both IPv4 and IPv6 services, in order to be fully reachable on the global Internet. What jurisdiction does an IP Address fall under if a crime is committed using it? EXAMPLE: Lets say that someone hosts a website similar to The Silk Road in the Principality of Sealand. They use TOR so they have obfuscated their location online and do not use any common TLD. What country would have jurisdiction to try and shut down the site? What if the location of the server hosting the website is in the cloud, similar to The Pirate Bay?
I'm not sure it makes sense to talk about having "jurisdiction" over an IP address, for the purposes you're discussing. If you wanted to sue the IP address itself--something that is possible under limited circumstances--then you might need to locate it for jurisdictional purposes. But I don't think that's what you're talking about. You're talking about taking civil or criminal action against the people who are using the IP address to commit crimes. What matters, in that case, is not a theoretical legal question about the location of an IP address. It's questions like: where do these people live? Where do the people downloading the illegal content live? Where are the physical servers located? ("In the cloud" is not an answer--there are physical servers somewhere making up that cloud). For jurisdictional purposes, the chair they're sitting in when they upload the illegal data, and the location of the AC power outlet the physical server is plugged into, are as important as, if not more important than, the metaphysical "location" of the IP address of the server.
It is not an either–or. You may have certain rights under both CCPA and GDPR, but they have rather different mechanisms for determining their scope. When does the CCPA apply? CCPA applies to certain businesses and consumers. It covers any business (regardless of legal structure) that that does business in the State of California and has a certain scale. A consumer means a natural person who is a California resident. These aspects are not influenced by your current location. When you as a California resident travel to the EU, you still have all your CCPA rights against businesses that do business in California. You do not have any CCPA rights against businesses that don't do business in California, for example a national rail company in the EU you've bought a train ticket for. When does the GDPR apply? Whereas the location of the user/data subject can be a factor in the GDPR context, their residency or nationality does not. The GDPR applies to all processing activities by data controllers who are established in the EU, including any businesses, non-profits, and individuals. This includes processing activities in the context of an EU establishment of a non-EU company. For example, GDPR would apply with respect to processing of personal data by a hotel you're staying at in the EU. The GDPR also applies to non-EU data controllers in the context of (a) offering goods or services to people who are in the EU, or (b) monitoring behaviour of people who are in the EU. Here, “offering” does not mean “doing business”, but “targeting or marketing”. For example, you might have installed a smartphone app that assists with sightseeing while in Paris. If this app monitors your behaviour while you are in the EU (such as by tracking your GPS position to alert you to nearby points of interest), that would fall under the GDPR while you are in the EU. The app may also fall under the GDPR per case (a) if it is marketed to / targeted at people who are currently in Paris. That the GDPR applies in such cases comes from the offering/monitoring while you are in the EU, not from your continued presence in the EU. You would be able to exercise your GDPR rights relating to this processing even after leaving the EU. Note that some service or processing activity can fall under CCPA and GDPR simultaneously. For example, this app would also fall under CCPA if the company also does business in California, e.g. if it also provides sightseeing information for Los Angeles or San Francisco. And both CCPA and GDPR could apply when an EU company does business in California. Under which privacy law would a deletion request be dealt with? In practice, most companies don't have this sorted out properly and results are unpredictable. Ideally, a company would just comply with both laws simultaneously, thus making it unnecessary to determine which law applies. Information that is only required under on law can be provided with conditional statements, e.g. “If this processing activity is covered by GDPR, you have the right to lodge a complaint with the supervisory authority in your country”. As mentioned above, both laws can apply simultaneously. Whether GDPR applies and whether CCPA applies are independent questions. However, the answer to neither of these depends on your current location at the time of making the request. In this answer, any statement about the EU applies equivalently to the UK.
It is legal for a manufacturer to sell a device which is capable of being misused. For example, a wifi-capable router can be sold even if it is &quot;open&quot; by default. A Bluetooth device has a shorter range than wifi, but in principle can connect to any other device. An owner's legal liability is not different given wifi vs. Bluetooth. Whether or not there is criminal liability for a third person who connects to the device also does not specifically depend on whether the device uses Bluetooth technology, as opposed to some other technology. 18 USC 1030 is the general federal law prohibiting &quot;unauthorized access&quot;. In the case of a bed, two legal question arise: is it a &quot;computer&quot;, and is it &quot;protected&quot;? It is an electronic high speed data processing device which performs logical, arithmetic, storage and communications facilities, i.e. it is a computer (in the legal sense). It probably is not protected, because it is not &quot;used in or affecting interstate or foreign commerce or communication&quot;, that is, it is not connected to the internet (unless it is). State laws tend to be broader, not having the &quot;interstate commerce&quot; limitation, so accessing the bed would violate Washington's analog of the federal law. However, under Washington law, the access is probably not &quot;without authorization&quot;. That term is defined as knowingly circumvent technological access barriers to a data system in order to obtain information without the express or implied permission of the owner, where such technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include white hat security research or circumventing a technological measure that does not effectively control access to a computer. The term &quot;without the express or implied permission&quot; does not include access in violation of a duty, agreement, or contractual obligation, such as an acceptable use policy or terms of service agreement, with an internet service provider, internet website, or employer. The term &quot;circumvent technological access barriers&quot; may include unauthorized elevation of privileges, such as allowing a normal user to execute code as administrator, or allowing a remote person without any privileges to run code. One question is whether there is any technological access barrier that the user circumvents (I don't know if it is possible to circumvent &quot;hidden mode&quot;). Since the term &quot;may include ... allowing a remote person without any privileges to run code&quot;, and since playing music on speakers involves running code, then the remote user may be criminally liable. On the third hand, the language of that paragraph (&quot;technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include ... circumventing a technological measure that does not effectively control access to a computer&quot;) clearly indicates a legislative intent to address deliberately overcoming active access barriers and not accidentally connecting to an unprotected, open system. Plus, the law also says that you are accessing the computer &quot;in order to obtain information&quot;, but that is not the purpose of transmitting sound to speakers.
It is in this context important to recall what a data controller and a data processor is. The data controller is the person or entity responsible for the data processing. They determine the purposes and means of this processing. A data processor merely performs data processing on the controller's behalf. The processor must not process data for their own purposes, but can make low-level decisions about the means of processing. For example, a controller may specify the purpose of ensuring the security and integrity of the services, or the purpose of creating basic statistics. The processor might implement this in part through the means of keeping a logfile. Often, such purposes are agreed upon via a data processing agreement or the terms of service, leading to the legal fiction that the processor was instructed by the controller. In your scenario, the controller is presumably not subject to the GDPR1, and therefore does not need a clear purpose or a legal basis for their processing activities. However, the EU-based data processor is bound by the GDPR, and can only process data as instructed by the controller. The processor has to comply with the GDPR with respect to how they carry out the processing activities, but the processing activities themselves don't have to be GDPR-compliant. Thus, it might be perfectly fine for an EU-based hosting provider to keep logfiles with IP addresses, even if those logfiles wouldn't be GDPR-compliant. 1: Whether GDPR applies to a non-EU data controller depends not on whether processing occurs in the EU, but on whether the controller is offering goods or services to people in the EU, or observing behaviour of people in the EU – see Art 3(2) GDPR. The cited guidelines continue to enumerate which provisions of the GDPR would still apply to EU processors working on behalf of non-EU data controllers (pages 12–13). These requirements are about how the controller and processor work together and relate to internal compliance of the data processor, but they do not affect the processing activities themselves. You mention that you would link to the hosting provider's privacy policy and direct data subject requests to the hoster. This misunderstands the role of the data processor. The data controller is the single point of contact for data subjects. The data processor is not a data controller in this scenario. They cannot issue a privacy policy for the controller's processing activities, and cannot respond to data subject requests. Their only relationship is with the data controller. If the hosting provider were to post a privacy policy for these processing activities, they would act like a controller (possibly a joint controller) and could bring the processing activities within scope of the GDPR – not what you are intending. However, since GDPR does not apply to the processing activities in this scenario, the data subject rights in the GDPR do not apply. As far as GDPR is concerned, no privacy policy is needed and no data subject requests have to be answered. If the data processor receives such requests, their only obligation is to forward them to the controller, who can then handle them (possibly ignoring them).
The question says: But by hashing a IP address you process the personal information and that you can't do without the user's permission! But processing personal data (PI) is covered not by the e-Privacy Directive (ePD) but by the GDPR. Under the GDPR processing may be lawful if it is done under any of the six lawful bases specified by Article 6. Consent is one of these. But paragraph (f) permits processing when: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject ... This is generally known as the &quot;legitimate interest&quot; basis for processing. It normally requires a balancing against the privacy interests of the data subject. Where, as here, the processing is specifically to remove any traceability of the subject, and hence to protect the privacy of the subject, there doesn't seem to be much conflict, so I suspect such processing would be lawful. I have not found, after a brief search, an actual case where this has been tested, so my conclusion might be mistaken. Personal Data under the GDPR and hashing GDPR Quotes Article 4 of the GDPR defines &quot;Personal data&quot; (in paragraph (1) as follows: personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; The term &quot;pseudonymisation&quot; is defined in paragraph 5 of article 4 as follows: ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person; GDPR recital 26 reads: The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. Hashing If a cryptographically secure hash function is used to convert an identifier, such as an IP address, into a replacement hash, there is no practical way from the hash value alone to recover the identifier. However, if a particular identifier value is compared with a stored hash value, it is easy to tell if there is a match. Finding a match does not prove that the identifier is the same -- depending on the length of the hash value being used and of the identifier, there may be many values that would give the same hash. But the chance of two random IDs having matching hashes is very small. Thus, if a controller were to store hashed versions of the IP addresses, no one could convert that back to a list of visiting IP addresses. But if soemoen had the IP address of a suspected visitor, and access to the hash function, it would be easy to check if that IP was on the list. If a keyed hash function were used, only someone with access to the key could perform this check. It is not feasible to hash all possible IP addresses as there are over 4 billion possible IPv4 addresses, and over 10^38 IPv6 addresses (over one thousand decillion). Thus creating a table to reverse the hashing in general is not feasible. Whether the possibility of checking for a match makes a hashed IP &quot;reasonably identifiable&quot; as representing a specific natural person under the GDPR and related laws has not, as far as I know, been authoritatively decided. Note that at most it would reveal that a person using a certain internet connection had (probably) visited a particular site.
Yes More exactly, nations will not regard places outside of their physical limits as outside of their jurisdictions. Overview Traditionally, a nation has regarded any ship flying its flag as under its jurisdiction, and a place where it may enforce its laws. More recently, many nations will undertake to enforce laws in cases where their citizens are the victims, or in some cases the perpetrators of crimes even within other nations, and more freely on the high seas outside the physical limits or territorial waters of any country. Historically, all nations undertook to enforce laws against piracy wherever they might be committed. Several countries, including the UK and the US, now treat the UN Law of the Sea convention as part of their national law, which defines as piracy: &quot;illegal acts of violence or detention ... against persons or property on board such ship or aircraft&quot; This would include the situation described in the question. Therefore such actions could and quite likely would be prosecuted by any of several countries, depending on the registry of the vessel and the nationalities of those involved. Sources 18 U.S. Code § 7 provides that: The term “special maritime and territorial jurisdiction of the United States”, as used in this title, includes: (1) The high seas, any other waters within the admiralty and maritime jurisdiction of the United States and out of the jurisdiction of any particular State, and any vessel belonging in whole or in part to the United States or any citizen thereof, or to any corporation created by or under the laws of the United States, or of any State, Territory, District, or possession thereof, when such vessel is within the admiralty and maritime jurisdiction of the United States and out of the jurisdiction of any particular State. ... (7) Any place outside the jurisdiction of any nation with respect to an offense by or against a national of the United States. (8) To the extent permitted by international law, any foreign vessel during a voyage having a scheduled departure from or arrival in the United States with respect to an offense committed by or against a national of the United States. This US DOJ page says: Among the offenses within the special maritime and territorial jurisdiction of the United States are the crimes of murder, manslaughter, maiming, kidnapping, rape, assault, and robbery. Pursuant to 18 U.S.C. § 7(1) there is also jurisdiction over such offenses when they are committed on the high seas or any other waters within the admiralty and maritime jurisdiction of the United States that is out of the jurisdiction of any particular state. See JM 9-20.000 et seq. The page &quot;Maritime Offenses&quot; from the law offices of Trombley and Hanes says: The Federal government also exercises jurisdiction over certain maritime offenses. There is Federal jurisdiction for offenses committed on American vessels in the territorial waters, harbors and inland waterways of foreign nations. See United States v. Flores, 289 U.S. 137 (1933). ... A number of Title 18 sections specifically declare certain conduct to be a Federal crime if committed “within the special maritime and territorial jurisdiction of the United States.” See, e.g., murder, 18 U.S.C. § 1111. In some instances, the Assimilative Crimes Act, 18 U.S.C. § 13, is also applicable. See also, 15 U.S.C. § 1175; 15 U.S.C. § 1243; 16 U.S.C. § 3372. 18 U.S. Code § 1111 (b) provides that: (b) Within the special maritime and territorial jurisdiction of the United States, Whoever is guilty of murder in the first degree shall be punished by death or by imprisonment for life; Whoever is guilty of murder in the second degree, shall be imprisoned for any term of years or for life. The Britannica Article on &quot;Piracy&quot; says: Because piracy has been regarded as an offense against the law of nations, the public vessels of any state have been permitted to seize a pirate ship, to bring it into port, to try the crew (regardless of their nationality or domicile), and, if they are found guilty, to punish them and to confiscate the ship. The UN page on Piracy says: The 1982 United Nations Convention on the Law of the Sea (UNCLOS) provides the framework for the repression of piracy under international law, in particular in its articles 100 to 107 and 110. The Security Council has repeatedly reaffirmed “that international law, as reflected in the United Nations Convention on the Law of the Sea of 10 December 1982 (‘The Convention’), sets out the legal framework applicable to combating piracy and armed robbery at sea, as well as other ocean activities” (Security Council resolution 1897 (2009), adopted on 30 November 2009). Article 100 of UNCLOS provides that “[a]ll States shall cooperate to the fullest possible extent in the repression of piracy on the high seas or in any other place outside the jurisdiction of any State.” The General Assembly has also repeatedly encouraged States to cooperate to address piracy and armed robbery at sea in its resolutions on oceans and the law of the sea. For example, in its resolution 64/71 of 4 December 2009, the General Assembly recognized “the crucial role of international cooperation at the global, regional, subregional and bilateral levels in combating, in accordance with international law, threats to maritime security, including piracy”. The UK Piracy Act of 1837 defined as a crime: Whosoever, with intent to commit or at the time of or immediately before or immediately after committing the crime of piracy in respect of any ship or vessel, shall assault, with intent to murder, any person being on board of or belonging to such ship or vessel, or shall stab, cut, or wound any such person, or unlawfully do any act by which the life of such person may be endangered, shall be guilty of felony... The more modern UK law, the Merchant Shipping and Maritime Security Act of 1997 embodies the UN law of the Sea convention, including its article 101, which says: Piracy consists of any of the following acts: (a) any illegal acts of violence or detention, or any act of depredation, committed for private ends by the crew or the passengers of a private ship or a private aircraft, and directed— (a) (i) on the high seas, against another ship or aircraft, or against persons or property on board such ship or aircraft; (a) (ii) against a ship, aircraft, persons or property in a place outside the jurisdiction of any State;
Nothing in 17 USC 512, which includes the DMCA Safe Harbor and Takedown procedures requires an online service provider to notify others who may have made copies of content (including archive sites) claimed to be infringing that a takedown notice has been received or that access to the content has been blocked or removed. A separate DMCA takedown could be sent to the archive site. The internet archive honors robots.txt files set to deny access to a particular site, page, or section of a site by removing from public view all archived versions of that content. This is often done when a new owner acquires a domain and it is repurposed or put up for sale. To the best of my understanding there is no legal requirement that an archive act in this way, but the IA at least does so.
Yes, but it doesn't matter. This answer discusses gdpr implications. Personal data is any information that relates to an identifiable person. The GDPR has an extremely broad concept of identifiability, also covering indirect identification using additional information and with the help of third parties. Even just being able to single out one data subject, i.e. being able to distinguish different users from another, counts as identification. If you already have a concept of user accounts, any information that is linked with the user accounts and somehow relates to those users would also be personal data. Since you have distinct push tokens per user, it seems like this criterion would be met. Additionally, those unique tokens might be directly identifying by themselves. The GDPR does not allow for semantic games like “it only identifies the device, not the user”. The key here is that the definition of identifiability does not hinge on your intentions, but on objective capabilities: if you or someone else who can come into possession of this data were to attempt to identify the user (such as singling out users from another), would they be reasonably likely able to do that? Since most devices are single-user, being able to identify a device would imply that you're reasonably likely to also identify users. Just because something is personal data doesn't mean you're forbidden from using that data. It means that you'd have to comply with GDPR rules, if you're otherwise within scope of that regulation (e.g. if you're EU/UK-based, or are targeting your services to people who are in UK/EU). For example, basic GDPR compliance steps include having a clear legal basis for your processing of personal data (such as necessity for performing a contract to which the data subject is party, or necessity for a legitimate interest, or consent), providing a privacy notice, and taking appropriate technical and organizational measures (TOMs) to ensure the compliance and security of processing. For example, TOMs regarding these push tokens could involve encryption, access controls, and a plan for installing security patches in order to prevent data breaches. Using push tokens is already a good measure in this context, since they are effectively pseudonymous and prevent linking additional information via that token (two sites/apps pushing notifications to the same person will have entirely different tokens). However, the push notification provider (e.g. Google, Apple, Mozilla) can resolve the pseudonymous tokens and link them to a person, indicating that these tokens are ultimately identifying (even if you can't perform that linking yourself). Note that if GDPR applies, then other EU/UK rules might apply as well. For example, sending electronic messages (such as emails) is subject to anti-spam rules (EU: ePrivacy, UK: PECR). These rules apply regardless of whether personal data is involved. Since the rules are not technology-specific, it is likely that regulators would consider user-visible push notifications to be equivalent to more well understood technologies like email and SMS.