What is considered personal information according to the US law? As a follow up question from this question a person's name, age, address, parties affiliation are considered public data. I'd like to ask then what is considered personal information? So if there is a website breach of data i.e. on Facebook and the hackers get the information mentioned above, Facebook doesn't need to worry because this data is not considered personal information? Note: Since this is state specific then what most of states agree on what is personal information.
Federal and state laws do protect a variety of different types of personal information in particular contexts, but there isn't really any information that is necessarily personal and protected from disclosure in all contexts. For instance, the Health Insurance Portability and Accountability Act generally protects a person's health records from unnecessary disclosure, and the Federal Education Rights and Privacy Act generally protects a student's educational records from unneccessary disclosure. But that doesn't mean that all of an American's health information is protected, or that all of the information that a hospital holds about an American is protected. The hospital can typically disclose the fact that it is treating a specific person, and if that person provides his health records to a government employer, that employer may be required to produce them in response to a request under the Ohio Public Records Act. But Facebook isn't a health-care provider, so it isn't required to protect medical records, and it isn't a school, so it isn't required to protect educational records. At the federal level, I don't know of any privacy laws that require it to maintain the privacy of its users' information, though it may be required to do so under state laws, or as a contractual matter because of its privacy policy. But that doesn't mean it has nothing to worry about. Like any business in the United States, it is prohibited from engaging in deceptive trade practices, so it can't make broad promises to protect users' privacy when it has no intention of honoring them. That's why it ended up paying $5 billion for privacy violations in the past and remains under court orders requiring it to better protect users' data. Further, Facebook has users all over the world, so it is required to comply with the international privacy regulations like GDPR that can be far more stringent.
Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. That's easy - this is exactly how all StackExchange sites (including this one) work :-). See for example: How does deleting work? on meta.SE. Is it against the right to erasure mentioned here as a part of GDPR? No, it is not (otherwise StackExchange would be in rather big trouble). The "right to be forgotten" is subject to limitations. Most importantly, it only applies to personal data. Personal data is defined as (GDPR, art.4): any information relating to an identified or identifiable natural person (‘data subject’) If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. The GDPR: What exactly is personal data?), but "personal data" is things about you (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data. In addition to that, even personal data may be retained if the data controller has a need to retain that information. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment. So, in summary: A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized. The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit. The StackExchange network, for example, covers this by allowing users to: disassociate posts from their account delete their account entirely (thus effectively disassociating all posts from personal information) asking a moderator for redaction of personal data
GDPR killing genealogy websites? I could see GDPR totally killing genealogy websites if they follow the rules strictly, but would they really want to do that. Seems to me genealogy has an important historical role. Treat living persons with anonymization I assume you don't have data to identify a person or contact the living person. How would you contact to get consent to show personal information if you only have a name, impossible right? GDPR tries to stop abuse of personal data, yes, and your family tree certainly is personal data. However those who come to your website would mostly want to search and edit the non-living, search back in the history, thus the current generation follows the family tree and are not the point of entry. You can provide certain anonymization to those alive by not displaying the first names in full, maybe just the first letter. You may want to hide address, spouse, children for current generation. You could make those available for view/edit first by going through a secondary login, "not a robot". Further you may remove living people from search results and hide from search engines so they do not have ability to index the current generation. That would make it harder to abuse if you're going after an individual, but at the same time doesn't lock out the people providing information.
You tag the question with "criminal law", suggesting that by "illegal" you mean "is it a crime" -- that would depend on jurisdiction, but in the US or my state, it is not a crime. There are crimes that you could commit with such an account, but violating the TOS is not itself a crime. However, it is illegal, a breach of contract, as you can see from the TOS "You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission".
Not that I am aware of. A person who 'owns' a domain is entitled to utilize that domain including for the purposes of receiving emails. With physical mail, it is a crime in most countries to intentionally interfere with mail that is not addressed to you. For example - Australia. However, this is statute law and as such does not extend to emails - even if it did, if you own the domain then you are the person to whom it was addressed. I note that you seem to misunderstand "confidential" - this only arises in the context of a special relationship between the person transmitting the information and the person receiving it. Usually this is a contractual obligation between A and B but it can be imposed by law (e.g. doctor-patient, banker-client, lawyer-client, GDPR etc.). If A sends confidential (as between A &amp; B) information to C, C is under no general obligation to keep it confidential if C has no relationship of confidentiality with A or B. If C discloses it and B suffers damage, B sues A for breach of confidence (or the government prosecutes A for breaking the law); B has no case against C. For your situation, where B has allowed A to send the information to an obsolete address then B has contributed to the breach to an extent that B would be extremely unlikely to succeed in a suit against A.
a few quick notes that come to mind. As the commenters point out: DSGVO is indeed the German equivalent name to the GDPR (English term) "Imprint" isn't a privacy related topic that much, as such it's not really changed by the upcoming GDPR The GDPR changes many things, but the requirement for up front information isn't one of them - so it would've already been a rule to follow Sometimes the question who is responsible for privacy information might not be that easy to decide when you're on platforms. I take this situation as being pretty clear though. You are basically given a blank slate, you can do with that page whatever you want, and the visitor has no clue whatsoever that it might be hosted by Github. In addition to this, Github would be classified as a data processor (providing the tool) and you as the data controller who is in charge of practically everything except for the provision of the page. I hope this helps. Btw. it's not that hard anymore to write a privacy policy these days.
Personal data is any information relating to an identifiable person, even if that person is only identifiable with the help of additional data and/or third parties. Making inferences about a particular person, for example whether that person might have performed unauthorized construction, sounds very much like processing of personal data to me. In this scenario, the information is used to verify the tax assessment for a particular person, so the information clearly relates to a data subject. The owner for a piece of land is certainly identifiable with the help of the land registry, if one exists in the country. Similar registries might also exist with tax authorities or a postal service. Here, it is the tax authority itself doing the processing, so they probably already have tax records about the owners at the address. But just because it's processing of personal data doesn't mean that it is illegal. Satellite data and aerial photography providers can probably rely on a legitimate interest to collect, sell, or otherwise publish their data. Homeowners can reasonably expect that their property will be included in low-res aerial photography. It might not be necessary to notify the data subjects if an exception in Art 14(5) applies. A public authority using aerial photography to find building code violations or to levy correct taxes may be able to base this processing activity on authorization via some law. If the public authority would have the right to inspect the buildings, then it might be possible to argue that the public authority can use aerial photography to decide which inspections/audits to prioritize. Of course, decisions producing significant legal effects must not be based on “AI” alone, due to the Art 22 GDPR right to not be subject to unchecked automated decision making (unless specifically authorized by a suitable law).
My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine. Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted. Another good clause to have in your privacy policy is to basically state if the user submits information about another natural person that they have consent from that natural person for that data and what it would be used for. The internet is the internet. People have been trolling it for years. People have also submitted false information for years. The best a business can do is simply outline what their site does, what data is collected and what it will be used for. That along with what legal basis it’s processed for and following it makes you GDPR compliant in that regard. As to withdrawing consent and the rights given by the GDPR that’s all specific to what infustructure a business has in place. As a developer I know the headaches of the GDPR. Most of it resides in the fact data is not centralized and thus can’t easily be retrieved, modified, or removed. Once you’ve tackled that aspect providing the user their rights under GDPR isn’t to far off.