Can cloud services providers be asked to turn over data from foreign countries? Can cloud providers be asked to provide data from other countries to the government/law enforcement for security purposes? Can Amazon be asked to provide data from non-US countries for any security reason, substantiated or not?
Generally speaking a business can be subpoenaed to provide any records, electronic or otherwise, by any court with jurisdiction over that business. Most subpoenas are issued in the context of pending lawsuits or criminal cases, some can be issues by certain regulatory or criminal law enforcement agencies. There are defenses to a subpoena which can be asserted to quash the subpoena before the information is provided by the business. The main defense is that the information is privileged, for example, because it contains attorney-client confidences, or it is protected as a trade secret which could be disclosed to a competitor or lose its trade secret status if access to the information is not controlled. But, generally speaking, ordinary business records of dealings that a company like Amazon has with its customers are not privileged or otherwise exempt from disclosure pursuant to a subpoena. Another process which is available but less common when dealing with a third-party is a search warrant. In general, a business is not exempt from disclosing records pursuant to a criminal search warrant simply because the records involve non-U.S. persons. There are also special procedures similar to, but not identical to, subpoenas under the Patriot Act such as &quot;national security letters&quot; that can be issued when national security is at issue. Unlike a typical subpoena, the process involved in a national security letter information request must generally be kept secret from the public and from the target of the investigation. National security information requests are overseen the the FISA (Foreign Intelligence Surveillance Act) Court which is a non-adversarial court that operates much like a judge or magistrate to whom a criminal search warrant application is made, except that attorneys that practice before it must have security clearances and its proceedings operate with a much higher level of secrecy. National security inquiries are still subject to legal limitations which the FISA court evaluates, although the FISA court has a reputation for being something of a rubber stamp (there is debate over whether this reputation is well earned). There is a detailed body of law describing what justifications are necessary for various types of record requests and what exceptions to the duty to disclose exist, but without more specifics in the question, an answer in this forum is not a place for a comprehensive treatise reviewing all of them which could fill several law review articles.
No, you're not required to sign any contracts. But since you're offering a service, you do have to manage some compliance tasks. You are a data controller under the UK GDPR, regardless of whether you have a company. This brings with it various compliance requirements. For example, you MUST post a privacy notice in accordance with Art 13 GDPR that explains how you process user's information. You must sign data processing agreements with your data processors, such as your server providers. And you should reconsider transfers of data to the US, since such transfers are illegal or at least quite questionable in the wake of the 2020 Schrems II ruling. You now have prospective users that are asking you for an Art 28 data processing agreement (DPA). These are likely other organizations that are data controllers of their own. For them to use your browser extension, they either need to find a legal basis that allows them to share their user's/employee's data with you (controller to controller transfer), or they need you to act as their data processor (controller to processor transfer). The third alternative is not to use your plugin at all. Of these, a C2P arrangement is most convenient for these other orgs, but involves a bit of paperwork to set up first. If you want to act as their processor, this doesn't mean you'd have to create a company (though a corporation might be very desirable as a liability shield). Being a processor means that you're contractually bound to only use the personal data as instructed by the controller, and not for your own purposes. This restricts what you can do, and has some special compliance requirements. For example, you cannot engage new subprocessors without your controller's approval. However, processor status can also be convenient for you because you're not responsible for interacting with the controller's data subjects, e.g. you're not responsible for handling their data subject access requests. Note that it's possible to simultaneously be a controller for some users, and a processor for others. E.g. Google Docs is offered directly to users as a B2C product so that Google is a controller, but also as a B2B product as Google Workspace, where Google acts as a data processor. Personally, I'd rather not sign any contracts unless I'm doing it as a business, and adequately compensated for providing this service. GDPR is only one compliance aspect out of many, making it unwise to offer a SaaS product as a hobby. For example, copying other people's web content has copyright implications… A potential alternative for some of the organizations asking you might be to make it possible for them to self-host your backend, so that they are not required to rely on you as a data processor. If you have no plans to commercialize your software, making it Open Source could be a solution. But you're in no way required to do that if you don't want to.
What are our possibilities here? You could be sued for damages in Mexico, the country of origin of the copyright or any of the other signatories of the Berne Convention. You could also be charged with a criminal offence but that is less likely. how much can we get away with? Not a legal question. What you are proposing is illegal - how likely your getaway plan is to work is not for me to say. Is there any advantage on us being on México? No Is there any advantage on picking any either Dragon Ball or League of legends because of the country they are in? No Can they stop us from doing it? Yes
This is less of a compliance question, and more of an infosec question. On one hand, you want to be able to restore access to an account to users who have lost their access. On the other hand, you must prevent unauthorized access e.g. from hackers. These factors must be balanced. Whether you'll fulfil a data subject access request will generally follow the same criteria as deciding whether you'll reset someone's access credentials, so I'll mostly discuss identity verification in general. Trying to validate names is generally pointless from a security perspective, since the name on the account might not be real, or because validation documents like scans from a passport can be easily forged. When a service has identity validation measures like requesting a copy of photo ID, or requesting a photo of you holding up a validation code written on paper, that doesn't actually help validating that the person requesting access is the account owner, but that the person requesting access appears to be a natural person, and now documents about their identity are on file. A lot of information like names, birthdates, or addresses is also not at all secret and could be easily guessed by a malicious actor. Most websites work by equating access with control over an email account. If you can receive a password reset code over email, you have access. In effect, this delegates the responsibility of account recovery to the email or OAuth provider. So the issue is what happens when someone loses their email account, which is not entirely uncommon for accounts that are multiple years old. One reasonable (and likely GDPR-compliant solution) is to deny access when someone loses their account. Quite a lot of services operate this way. A milder form of this is to email the old address that someone is trying to take over the account, and turn over the account only if you have other evidence of ownership and there has been no reply over multiple weeks. Since this is part of an identity verification measure, I don't think the GDPR's normal 1 month deadline would apply. However, this approach is very risky: an attack can succeed through the mere inaction of the true account holder, and it would arguably be a data breach if you give access to the wrong person – safer for erasure requests only. Also, emails like “click here or we'll delete your account” look a lot like spam (I get a lot of those about alleged problems with my Paypal account). A potentially more reasonable approach is to use questions about the account to verify ownership. When did they create the account? When did they last use it? Can they answer questions about non-public content of the account? (But don't let an attacker choose the questions!) You see some older sites that ask the user to select a “security question” for recovery purposes. But this isn't a best practice – they are frequently the weakest link in an authentication system. If the user answers truthfully, the answer may be easy to guess or discover for an attacker. E.g. the infamous “what is your mother's maiden name” question is horrendously insecure in the age of Facebook. If the user provides a more secure answer, that is essentially just another password that's even easier to lose than an email account. High-value accounts typically offer a secondary authentication method as a fallback. E.g. my bank can send me new access codes via physical mail. GitHub can optionally link a Facebook account for recovery purposes. But these measures would be overkill for most cases. Especially collecting a physical address for the sole purpose of offering account recovery would likely violate the GDPR's data minimization principle, though it may be fine when the user opts in with freely given consent. To summarize: what you're trying to do is extremely difficult, because you've need to balance different security aspects: keeping malicious actors out, and letting legitimate account owners in. Whereas I'd resolve that by denying any account recovery or subject access requests, other approaches exists with other risk profiles. The GDPR requires you to perform reasonable identity verification measures, but what is reasonable depends on the business context and is ultimately an infosec question.
Among other things, GDPR regulates what you may do with the data within your systems. You can use it for the contracted purpose, or in accordance to law, or with informed and revokable consent, or for some other enumerated purposes. Even with consent, you have to take security measures to avoid the misuse of the data. Remember the software shrink-wrap licenses? &quot;By opening the package, you agree to the terms inside.&quot; GDPR makes the equivalent in the cloud world impossible. You have to document exactly what you do with the data, and for any use that is not necessary to perform the service the customer can opt out. In the scenario you describe, it is possible that you are not the data controller under GDPR but the data processor, and that you have a duty to keep the data from separate controllers apart. And delete any batch at the end of contract. If you want to do this professionally, you need to consult a lawyer for your specific plans.
The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in which member state data is stored or processed. Member states cannot generally limit this single market via national laws. Furthermore, secure processing may be possible outside of the EU/EEA as discussed in Chapter 5 of the GDPR. Some countries such as Japan have been asserted an adequate level of data protection so that no special safety measures are necessary. For other countries, a transfer of personal data may be possible under so-called Standard Contractual Clauses which detail the responsibilities of the data exporter/importer. However, the recent Schrems II ruling has invalidated the (partial) adequacy decision for the United States, and has strongly hinted that SCCs only work if the parties are actually able to honor their responsibilities under the SCC (which is not the case with some surveillance laws). Data protection is likely not ensured for processing in the US or by US-controlled companies (even if the processing usually takes place within the EU). Given the sensitivity of health data, this means you should likely avoid using the typical public cloud providers (regardless of availability region). Depending on where your company is based, you might also be disqualified as a data processor by EU data controllers. So the GDPR has no data residency requirements that limit the processing/storage to Germany, but some data residency requirements to keep the data in the EU. However, there may be non-GDPR obligations that mandate how the data can be processed, but I'm not familiar with those (the German regulatory landscape for tele-health is very uneven, differs between German states, but is also improving a lot recently). Since you're processing health data, you should pay special attention to Art 9(3) GDPR which is expanded in German law by §22 BDSG to list a catalogue of possible safety measures you should consider, but none of them are related to data residency. §78 BDSG has further details on transfers into non-EU countries, such as emphasizing that human rights must be guaranteed in the target country.
No AFAIK there is no such legal requirement. Why this company told you there was I can’t speculate. But I will. There may be under contract with MicroSoft to put their OS on every box they sell - that would be a legal requirement. Or the just don’t sell boxes without this and they employee told you it was a legal obligation to get out of the conversation.
I'll ignore whether a recipe is actually a good example, but I assume you're asking how a person who owns the exclusive rights to copy a thing (copyright) or to use a thing (patent) can allow multiple other entities to copy or use the thing. This is possible by granting each a non-exclusive licence. In the case that the piece of knowledge is not protected by any intellectual property regime, the holder of the information could just treat it as a secret. The information holder could enter into contracts to sell that information to various entities, each promising in return not to further disclose that information. This is the case for lots of sports data.