Does my school have a right to get involved over something relating to them, but done in isolation of them? Okey, this is going to be quite a specific question about something that has come up. I am a school student, and I sent various emails to the developers of the school management software that my school uses. I was questioning them about the possibilities of API access into the data, besides the unofficial API which I (you could almost say) hacked into. I did mention that I broke into the unofficial API in my emails, and it may be questionable whether that was legal or not - but besides the point at this stage. (Their system was totally unsecured, so technically I didn't hack it at all, but this is a question for security.stackexchange. Another important thing is that I used the words "reverse engineered" which doesn't really describe what I did, but would be technically illegal full stop) So, my school has been contacted by the developers (whom I had emailed), and basically the school is now wanting a meeting with me and my parents. I am not sure exactly what the meeting is about at this stage, but it may have something to do with my last email which was abusive and I described how terrible the software this company makes actually was. (I sent this email after they ceased to respond to my emails, in frustration) Facts I NEVER metioned my school in my emails, and my emails where from my personal email address which is NOT associated in ANY way with the school. I used my full name in the emails I stated my study year level at school Somehow, this company has tracked my school down (possibly through the national student data, since this company is basically managing it - is this even fully legal?) But here's my primary question: Does my school have any right to get involved, considering I never involved my school or linked to them in any way? If I had referenced my school, I can see why they would want to get involved - I have basically been pointing out how terrible the student management software they use is. But I didn't. How do they have a right to be involved?
From the sound of it, you have stated that you gained access to school data, possibly including private information about other students, professors, schedules, grades, disciplinary information, financial tuition or salary info, etc., that you were not authorized to have. The question of whether it was properly secured is rather beside the point. The school will now need to know the precise scope of your snooping: whether you were able to modify any information (i.e. change grades), what purpose to your snooping, etc.
Yes, you did something wrong; you used both the university's trade mark and copyright without their permission. I don't know the law in India, however, if it is similar to Australia it is unlikely that the police will be interested in doing anything about it. While it is technically a crime, criminal prosecution is usually reserved for egregious breaches on a for profit basis. I suggest you apologise and agree to stop distributing your app.
If the school is a private school, then definitely yes: the school can also mandate clothing and grooming standards, and so forth – attending private school is optional, and they can even require the parents to provide the computer. (Mandatory) public schools have less power, but they still have the right to require students to do things that the parents do not like. For example, a parent might not like the particular history curriculum, or the might not like the fact that the child has to study music, but that is a power granted to public school districts. If the requirement were &quot;unreasonable&quot; in some sense, parental prerogative might win out over the school's rational of educational necessity. But it is no more unreasonable to require a student to learn how to use a computer that it is to require them to learn how to read a book. You might argue that reading is &quot;more necessary&quot; than developing computer skills, but the school district's curricular judgment is placed above that of a parent, so you would have to establish that giving a child access to a computer is objectively unreasonable.
It is legal. What would be illegal is for a public school to promote or inhibit a religion. You can teach all sorts of facts that touch on religion (millennia of Western history) and you can e.g. survey the major religions of the worlds as a cultural phenomenon. You can use circumlocutions or proper names. It's not illegal to confess to having personal beliefs. This is about public schools, which is an arm of the government. A person who is in a school, for example a student, is not prohibited from promoting or demoting a religion, therefore a student who clearly and openly advocates the Pastafarian faith is not to be sanctioned, except insofar as the conduct is objectively disruptive. This is because the student is clearly not acting as an agent of a government institution. Things are a little murky when it comes to teachers and guest speakers. Teachers do not lose their First Amendment rights when they enter the classroom. Here is a summary of pertinent court rulings. The main principle that comes from such cases is that school districts can direct teachers to refrain from certain actions when there is a reasonable belief that the actions would run afoul of the Establishment Clause. Individual teachers have been ordered to not engage in silent reading of prayers in school (Roberts v. Madigan). Case law on guest lecturers is probably close to zero, since guest lecturers don't have the same kind of property right to be at the school expressing themselves as teachers do.
There are legitimate apps that let you buy phone numbers. With the right app I can buy let's say a landline number in Kansas. I call you, and you will think it's some guy in Kansas calling you. That's totally legal, it's a genuine phone number, and just like I can buy 10 phones and have ten phone numbers, I can use an app to pretend to have 10 phones. I cannot pretend to by your child's school with that kind of app, because for obvious reasons your child's school's number is not up for sale. If an app let's you pretend to be someone else, like your child's school, then your phone company will be very interested in hearing about that. You don't have to sue the app maker, your phone company will. These three police officers will also be very interested, and impersonating a police officer is by itself a crime. (Normally impersonating a police officer is done by putting on a uniform, but calling you with the number of that police officer will also count). So these three police officers will have a word with your husband as well. So suing the app maker (you can't sue an app, you can only sue the people responsible for it) is very hard, and not needed. Complain to your phone company, complain to the police, first to the three police officers he impersonated (the phone company will have records of phone calls seemingly coming from them) to advice them they are being impersonated, and then you complain to the police for harassment.
This sucks. It is also legal. It's a private school, they can admit who they like (provided they don't discriminate on the grounds of protected characteristics like "religion" or "caste").
I did not write "confidential" on my letter, but I assumed a business proposal is automatically considered as a confidential material. An incorrect assumption unfortunately. Unless you have a confidentiality agreement (NDA) with the first company, they and their agents are not under any legal obligation to keep information you share with them confidential. How is the legal situation here? There is none on your side. You lied about a direct question asked and were caught in the lie. Company A had no obligation to keep what you sent confidential. Even if they did, that may not (depending on how the confidentiality agreement is worded) keep the employee of company A stating that they had received the same proposal. Chalk this one up to a lesson on confidentiality and honesty in business. There are no reasonable assumptions of confidentiality in business unless you specifically state that they are confidential or are provided as part of a confidentiality agreement.
You premise is correct. The processor is someone that processes data on your behalf, and since the GDPR definition of processing is extremely broad, that is about every third party subcontractor that you use for data processing, including various cloud providers. I'm afraid it will soon become a huge mess with a gazillion contracts to sign. I disagree. Yes, the GDPR says that a contract between the controller and processor must exist, but Article 28 of the GDPR does not say anything about how the controller shall document these instructions. Basically, in cases like the one you describe where John Doe relies on a web agency for having a contact form on the web, there will be a standardized (by the web agency) service agreement between the John Doe (controller) and the web agency (processor). There is nothing stopping the parties from agreeing that this service agreement that John Doe accepted as part of the onboarding procedure is also the DPA as required by the GDPR. Putting something like the following in the service agreement would do it: The parties agree that this Service Agreement between You (controller) and Us (processor) set out Your complete and final instructions to Us in relation to the processing of Personal Data and that processing outside the scope of these instructions (if any) shall require prior written agreement between You and Us. You also agree that We may engage Sub-processors to process Personal Data on Your behalf. The Sub-processors currently engaged by Us and authorized by You are listed in Annex A. I think we will se a lot of amendments in service contracts as the GDPR gets better understood, but I don't really see a flood of DPAs in addition to these amended service contracts.