Do employees have personal liability when working for a company that violates the GDPR? I work for a company that doesn't take privacy laws very seriously. As far as I can tell, they're woefully unprepared for GDPR and don't seem to care very much. My tasks mainly consist of software development and maintenance, with some degree of systems administration, data analysis, and reporting. I regularly come into contact with user data (including plain-text passwords). Am I in any way personally at risk? To what degree is "I was just doing what I was told" a valid defense (nothing is in writing though)? If I quit my job before GDPR applies, do I escape any such liability from that employment?
Not legal advice - you should consult an attorney who knows your local jurisdiction. That's a general statement, but especially true here because the GDPR does not include personal liability for directors (or others) in the event of a data breach, but domestic laws may indeed do just that. The UK is one example where certain circumstances can lead to criminal liability for directors of a firm in the event of a breach. That said, your company should care. The fines for knowingly allowing a breach or not reporting it properly in a timely manner have been made more significant than the prior Directive. There are things you could do to potentially mitigate consequences in the event of a breach and a fine being levied on the company, such as aligning with best practices and getting certifications. In sum, the actual punishments for noncompliance will vary by jurisdiction, but any business that handles data in the EU should undoubtedly be ensuring it is aware of what, if any, obligations it has and taking steps to comply before May's deadline.
the first two highlighted parts seem to contradict each other. No, in this case they do not. The first highlighted portion refers to works or items produced "for or under the direction of the Company", whereas the second highlight refers to your creations that satisfy conditions (a) and (b). Where contradictions actually exist, the doctrine of contra proferentem entitles you (the non-draftsman of the contract) to adopt the portion or reasonable interpretation that favors your legal position. Also wondering how valid those statements actually are They are valid and become enforceable as soon as you sign the contract or your subsequent conduct reflects your acceptance thereof. it's a matter of privacy. So the question is what I can do or what the reality is of the situation The reality is that you are asked to sign a contract that is abusive and ridiculous. One vulnerability from describing your inventions (presumably in Appendix A) is that the employer gets "irrevocable, worldwide, etc" rights on them as soon as you "use or disclose any [items listed in Appendix A] when acting within the scope of [your] employment". This means that if instead of reinventing the wheel you share or apply any portion of your prior creations so as to enhance your productivity, you knowingly and irreversibly grant to the employer perpetual rights to those items. Legal disputes regarding APIs can become extremely intricate. And, since judges usually have no decent background on IT, even those few judges with integrity are unlikely to grasp the key subtleties that would lead to a correct ruling. "not useful with or related to any Company Interest" is very vague. The company could be interested in literally anything these days. Clauses which are too vague or excessively wide-encompassing are supposedly stricken as unconscionable, unenforceable, etc. However, I personally would foreclose upfront the risk of judicial hassle and decline the abusive contract. Legal issues aside, keep in mind that you are offering your expertise (in terms of supply &amp; demand, you are on the supply side). This fact has a less derogatory connotation than "asking for a job". Accordingly, the relation between the parties should be more leveled.
No, GDPR does not apply here — but other laws might . The General Data Protection Regulation only concerns itself with the following: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. per Article 2. Furthermore, there is a specific exemption (Art. 2 (2)(c)) which would seem to apply to you (emphasis mine): This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. You are sharing the conversation in a purely personal capacity and are not processing it wholly or partly through automated means nor are you intending it to form part of a filing system. Additionally, depending on the contents of the conversation and what you share, there may not be any personal data involved at all. For example, if you only share the messages themselves (and they don't contain any personal data that could identify someone) and censor/black out any names or photographs/avatars from the senders. Either way, GDPR does not appear to apply to you in this context. However, it appears that Article 18.1 of the Spanish Constitution grants the right to &quot;personal and family privacy&quot;, as does the Organic Act 1/982 on Civil Protection of the Right to Honour, Personal and Family Privacy, and Self-Image. It's possible that, depending on the contents of the conversation, the other party involved in the conversation may have a case for action against you in the civil or criminal courts (for example, if the information invades their privacy or is defamatory in some way) if you share the contents of the conversation with someone else. I am not familiar with Spanish law so cannot comment further on this matter.
Is this legal? Yes Or does it mean that employee will be in breach of his/her contract? Yes You are assuming that if the evidence is allowed to be presented then that automatically means that keeping it for that purpose is not a breach of the contract. This is not necessarily so; it can be both at the same time. That said, it is unlikely that an employer would attempt to sanction an employee for this as the courts would (rightly) see it as an attempt to pervert the course of justice. As in most things in the law it is possible for all parties in a matter to be on the wrong side of it. If you want to come to the tribunal with "clean hands" then the best thing to do is make a record (not a copy) of the relevant documents and return then to the employer. Before going to the tribunal get your solicitor to subpoena the documents that you want - they will have to produce them and you have them without breaking your contract.
Alice's business sells database management software. Organisations buy or licence the software, deploy it on hardware they control and use the software to help store and, process and analyse 'personal data' within the meaning of GDPR. Alice's business has no access whatsoever to the personal data being stored and processed by those organisations. In respect of that personal data, GDPR is not engaged by Alice's business. The business is neither a 'controller' nor 'processor' of that personal data. Who does the data protection law apply to? - European Commission Who does the UK GDPR apply to? - Information Commissioner's Office
You have several issues. Breach of Contract When you sign up with each of those services you are entering a legally binding contract and must comply with the terms of that contract. For example, this is taken from Facebook's terms: Here are some commitments you make to us relating to registering and maintaining the security of your account: You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission. You will not create more than one personal account. I haven't checked but its a fair bet that the other services have similar terms. Unless you have permission, what you are doing breaches these terms of service. If what you do causes damage to Facebook et al then they can sue you and your employer for damages. Even if it doesn't they can probably bar you from having an account for as long as they like. Improper use of images This is jurisdictional but it is generally required to have the permission of the subject of a photograph where that photograph is used for commercial gain. There are exceptions where the person is not the primary subject (e.g. crowd shots, or images primarily of something else where the person happens to be in the shot) but the type of photos you would use for these services are not going to be exempt. The sanctions for breaching this will be dependent on jurisdiction. Breach of Copyright Somebody owns the copyright in those photographs. If you do not have a licence to use them in the way you propose then you are breaching their copyright. The copyright holder can sue for damages (if any) and any profits you make. Vicarious Liability An employer is strictly liable for the actions of their employees, jointly and severally with the employee. That means a plaintiff can go after either the employer, the employee or both. An employee may have some statutory or contractual indemnity but this is by no means common.
The fact that the employer has vicarious liability for acts of its employees "within the scope of employment" does not mean the employees are not also liable for their own acts. In reality, however, the employer is more likely to have insurance for such "acts or omissions" of employees. The plaintiffs can "sue everyone in sight" and let them figure out who actually pays when they are found liable. That way, when the employee's actions are (for instance) ruled a "personal frolic" or otherwise outside the scope of the employer's liability (in tort or contract), the case doesn't get dismissed for failure to name all the proper parties. One policy goal is to place financial liability as close as possible to the person most likely to have been able to avoid the harm, thus discouraging such risks, without placing the entire burden on individuals employed in hazardous occupations and without artificially limiting potential sources of compensation.
The GDPR doesn't generally distinguish public from non-public personal data. If you have a good reason to contact the professor, do send them an email. GDPR does not prevent this. If you're sending this email for “purely personal or household purposes”, then GDPR doesn't apply anyway. There are rules in the ePrivacy Directive against unsolicited emails, but these specifically relate to emails for direct marketing purposes. A company is not allowed to send out spam marketing, regardless of whether they obtained the email address from a public data source. Companies can send email marketing to their own existing customers, or to people who have given consent. Consent is defined in a fairly restrictive way (as a specific, informed, freely given, and unambiguous indication of the data subject's wishes), so that mere publication of an email address cannot be interpreted as consent to receive marketing from a particular company.