Does the EU &quot;2-year guarantee&quot; apply to security vulnerabilities? As we all know, Android security is a mess. Google fixes security bugs, but it's a matter of luck whether your vendor or carrier decides to deploy the fix to your phone or tablet. In the European Union, there is a mandatory 2-year guarantee for all goods: Faulty goods must be repaired, replaced or refunded if a defect which already existed on receipt of the goods is found at most 2 years after purchasing the good. Has anyone every tried this w.r.t. security vulnerabilities? I.e., purchase a new, shrink-wrapped device (perhaps a cheap device that was released a few years ago but is still being sold) and then, after using it for about a year, force the trader to take it back because it no longer receives security updates? On the one hand, all conditions for the 2-year guarantee should be satisfied: The device was bought less than 2 years ago, the defect was already present when the device was bought, and the device can no longer serve its intended purpose (surf the web without getting your device compromised, your passwords stolen and, thus, your bank account emptied). On the other hand, I have never heard or read about such a case, so I might be missing something obvious...
No, it does not. There is indeed a 2-year guarantee for all goods, but "goods" is defined to be a "tangible movable item" according to Directive 1999/44/EC Article 1, subsection 2(b). In less legalese, a physical item; software doesn't count. While there has been discussion about extending this protection to software, I'm not aware of this having been done yet. Even if it were, determining whether goods are "faulty" ultimately comes down to whether it conforms to the contract of sale (Article 2). I think it's likely that vendors in this area would put a disclaimer for unforeseen security vulnerabilities, or something to that effect.
There are three main aspects to this: Its their website, and their terms of service. They can enforce those terms, or change them (in some appropriate manner). You have no recourse if they remove you, block you, or delete your account, for example. That's the measure that you would probably have, virtually every time. To claim damages, or litigate beyond just website access control, requires a legal claim. But there's a catch there. To claim damages, they need to show actual damage, which they wish to be compensated for. If you misused their website but no actual harm can be shown, the total damage claimable is zero, whether or not you followed their rules. Merely entering dishonest information isn't by itself harm. So they would have to show they suffered damage/harm because of that, which is directly attributable to your behaviour, was foreseeably harmful etc, or similar. They also need to consider legal costs, and ability to enforce, especially if you are in a different country. If for some reason the computer use was also illegal, then a criminal act could be committed and they could notify law enforcement. For example suppose you did this in the little known country of Honestania, where the law says that to prevent trolling and online abuse, anything posted on social media under any but your own legal name is a crime. Or suppose you'd been banned from the system and ignoring/evading such a ban was criminal computer use or criminal trespass due to the forbidden/unauthorised access (which can happen in several places). But this is purely for completeness; I guess you'd know if you were taking it further, into criminal computer use.
The first thing to notice is that the £100 offer appears to be a legit offer. That is to say, accepting it will create a binding agreement between you and the company. There is no reason yet for the company to believe that you have suffered more damages, and you do have reasonable options to prevent them (ask bank for a new card - that's not going to cost you £100). The second observation is that the GDPR does not really affect the first observation. The GDPR itself does not give rise to additional civil claims or special damages. Yes, the GDPR states that the company is in the wrong, but parties can make agreements how a wrongful deed is made right again. And their offer appears to do so. Note that accepting the offer does not take away your continuing GDPR rights. It just affects their past error. You can still ask them whether they have your card data on file today.
Possibly The game company has almost certainly excluded liability under the contract you entered. There may be some consumer protection that you have that they cannot exclude - I don’t know enough about German law to meaningfully comment. Notwithstanding, if you were to initiate legal action against the, as yet, unknown wrongdoer, you could subpoena the relevant records from the game company with a court order. No matter what privacy or other protections the other person has, the game company must obey the order or be in contempt. Without such an order the game company is right that they can’t disclose details of other users. As a practical matter, it will cost several hundred € to initiate legal action and several thousand to pursue it to the end. And you might lose. A better response is to treat the lost €80 as a relatively cheap life lesson - many people lose a lot more learning to recognise scams.
This is related to Can a store sell merchandise I&#39;ve left in the store? The phone in question has been mislaid and anyone who finds it has a duty to deliver it to the owner of the bench for safekeeping pending the true owner's return: if the owner does not return within a reasonable time the phone becomes the property of the bench owner (e.g. the city that owns the park). However, the specific question here is: Where the owner has returned within a reasonable time but the possessor of the phone is now clearly attempting to steal it. Most jurisdictions recognise that a person is entitled to use reasonable force to defend their life or property. For example, the law in Australia1, is generally case law for which the authority is the High Court's decision in Zecevic v DPP (1987) 162 CLR 645: The question to be asked in the end is quite simple. It is whether the accused believed upon reasonable grounds that it was necessary in self-defence to do what he did. If he had that belief and there were reasonable grounds for it, or if the jury is left in reasonable doubt about the matter, then he is entitled to an acquittal. Stated in this form, the question is one of general application and is not limited to cases of homicide. So, you are entitled to do "what you believe upon reasonable grounds that it was necessary to do" to defend your property. This would include using physical force to stop their flight and return your property to your possession: it would not include force that posed real and foreseeable risk of inflicting death or grievous bodily harm upon them. In addition, because you have reasonable grounds to believe that they have committed a crime, you are allowed to arrest them and deliver them to lawful custody (i.e. a police officer). Naturally, if you do not have reasonable grounds them you have just kidnapped them. The consequences if you do injure them is that you can be charged with a crime (battery, grievous bodily harm, manslaughter, murder etc.) and/or be sued for damages (medical bills, lost wages etc.) in both cases you could use self-defence as a defence. The difference between self-defence and vigilante justice is one is legal and the other isn't
Obviously you may end up voiding warranties, losing on-going support from the manufacturer, or there may be a contract you agreed to stating that you won't do it, but assuming none of that is relevant (e.g. a salvaged Tesla doesn't get support/warranty anyway) is there any law preventing you from modifying your property to remove the limits placed on it? This assumes away one of the biggest issues, which is doing this is almost certainly a breach of contract unless the contract term is void as against public policy (which it probably isn't). So, the manufacturer can sue you for money damages probably equal to the difference in value between the limited and unlimited hardware in the marketplace. The manufacturer might also be able to obtain an injunction against this practice, which could result in the incarceration of someone who knowingly violated this court order for contempt of court, once an injunction is secured from a court to enforce the contract. There is also an anti-hacking statute in the United States, whose plain language appears to prohibit taking actions that override a digital system's security features. Unlocking these hardware features would appear to violate this statute. This is part of the Digital Millennium Copyright Act (DMCA) and is codified at United States Code Title 17, Section 1201. As Wikipedia explains: 17 U.S.C. 1201 is often known as the DMCA anti-circumvention provisions. These provisions changed the remedies for the circumvention of copy-prevention systems (also called "technical protection measures") and required that all analog video recorders have support for a specific form of copy prevention created by Macrovision (now Rovi Corporation) built in, giving Macrovision an effective monopoly on the analog video-recording copy-prevention market. The section contains a number of specific limitations and exemptions, for such things as government research and reverse engineering in specified situations. Although, section 1201(c) of the title stated that the section does not change the underlying substantive copyright infringement rights, remedies, or defenses, it did not make those defenses available in circumvention actions. The section does not include a fair use exemption from criminality nor a scienter requirement, so criminal liability could attach to even unintended circumvention for legitimate purposes. The statute is quite lengthy and full of technical definitions and narrow exceptions and exceptions to exceptions to the general rule. These legal issues have mostly gained media attention in the context of farmers who seek to hack into the built in software of their farm machinery in order to repair it where the manufacturing companies have not cooperated. There have been legislative fixes proposed that would make these prohibition void as against public policy for some specific purposes like doing repairs. There have also been efforts to characterize this kind of business practice as an anti-trust violation. But, none of that legislation has passed in the United States, to the best of my knowledge and belief. But, I am not aware of any high profile legal precedent that has addressed this point but I wouldn't rule out the possibility that there is one. The closest case I could find on point (from the High Court in Australia) is Stevens v. Sony, which holds "that a device allowing PlayStations to play games with a different region code did not violate the anti-circumvention laws, because the mechanism in the PlayStation did not directly prevent the infringement of copyright." I am not personally familiar with non-U.S. law on this topic. Wikipedia reviews some of the applicable law in the E.U. and Australia. According to this Wikipedia entry, pursuant to European Directive 2001/29/EC of the European Parliament and of the council of May 22, 2001 on the harmonisation of certain aspects of copyright and related rights in the information society, E.U. member nations must adopt domestic anti-circumvention statutes that meet certain minimum E.U. standards set forth in the directive. Also according to the same Wikipedia entry: "Australia prohibits circumvention of "access control technical protection measures" in Section 116 of the Copyright Act." In Australia, "Penalties for violation of the anti-circumvention laws include an injunction, monetary damages, and destruction of enabling devices."
The GDPR only mentions cookies once (Recital 30). (It says that cookies are personal data if they are associated with natural persons.) As far as cookies go, nothing has really changed since 2002, and the exception granted in the EU cookie directive Article 5(3) is still valid: This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. If your site complies with the 2002 directive today, it will be GDPR compliant. All the "EU Cookie Law Compliance" plugins I've checked out let the admin configure the site to comply with the 2002 directive, and most let you choose between implicit consent (which is, and still will be, OK if you or third party services do not use cookies for profiling or to collect personal data), soft consent, or hard consent. The latter is however mandatory if you or third party services use cookies to for profiling or to collect personal data. However, if at least one of your cookies are used for profiling (and if you use Google analytics, you are), or if they are used to collect personal data, the exception from explicit consent quoted above does not apply and implicit consent (i.e.: "continued use of the site amounts to implicit consent to the use of cookies") has never been legal for the site. So while nothing has changed since 2002, there is a lot of misinformation about cookies floating on the Internet, and a lot of sites have their cookie banners set up wrong. You may want to do a new cookie audit for your site to verify that you comply with existing legislation.
That's an old idea that has been tried several times before (such as the first, being Unvarnished: Website Lets You Review People (And Trash Them) | HuffPost, which no longer exists); and one of the latest incarnations is Peeple (mobile application - Wikipedia). There are lots of legal liabilities, including defamation and harassment/stalking, even with the Section 230 of the Communications Decency Act | Electronic Frontier Foundation which (mostly) protects the website owner from others' speech posted on the site (your mileage may vary due to jurisdiction). The only way such a site would survive is to do what Peeple and other sites have done: greatly limit the speech allowed, such as limiting to only positive reviews, giving the subject complete control over what does appear on their profile, only allowing "opt-in" profiles, verify identities, etc. You would have to implement full GDPR compliance; but various lawsuits will either shut you down before you get far enough to launch or soon after and force you to greatly limit the scope of the site. Most lawyers would advise you to find something else to do with your time and money.