Can an NDA be legally valid if there&#39;s agreement to not disclose real information? Say two parties agree to an NDA, but the NDA has a special addendum that tells the other party that they cannot reveal real information about the first party (the provider) to anyone, including the general public, media, news outlets, etc. Most NDAs are about keeping some information hidden, but is it legally valid if such information pertains specifically to one's identity and personal characteristics (such as name, location, age, height, physical features, and etc.). Will the party still be under penalty? In other short words, can an NDA be legally permissible and in effect if it pertains to personal info? An example could be someone operating in business under a different name (not illegal); someone who would suffer financial loss if a business or general public knew some info about them; or someone who has faced public scrutiny (i.e., false criminal punishment) and cannot, at least in good public image, disclose or have someone disclose their identity outside of private business matters.
I think that the question you are really asking is whether a contract not to disclose certain information (e.g. to authorities) might be void as contrary to public policy, or illegal. Sometimes it is illegal to do so. For example, often concealing personal information in connection to the transfer of funds constitutes money laundering, which is a crime, or securities fraud. The key question is whether there is a legal duty to disclose in a particular context and whether the concealment facilitates some sort of fraud.
It depends on what information you are sharing, how you got it, and what rights the business asserts over the information. For example, if it is content created by the business and they claim copyright protection you can only use it without their permission in accordance with Fair use exceptions. If you obtain the information through some limited/conditional access agreement you would be subject to the terms of that agreement. As always: If you want a legal opinion specific to your use case you need to consult a lawyer in your jurisdiction.
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
The requirement to make the code publicly available is binding on Olio, and on Olio's successor, Flex. Olio, by accepting the code under the GPL, had contracted with the original author of that code, one of the contract provisions being to make any modified code available publicly. If Olio fails to abide by that agreement, it is in violation of the license, and the original author could sue Olio for copyright infringement, or sue Flex as having bought the assets and liabilities. But the individual employees of Olio are not under any obligation to publish such modified code, as they were presumably not parties to the license deal -- Olio was. Therefore the NDA does not require them to violate any law or contract to which they might be parties. The NDA could probably not be used to prevent the employees from testifying if called in such a copyright suit. If the NDA did require an illegal action, it would be void. If it merely required a person to violate a civil agreement that could be settled for money, it might or might not be enforceable, depending on the exact provisions, its reasonableness under the exact circumstances, and the local law.
Depends on the NDA Just like any other contract, it does what it says it does. You could draft the NDA either way.
The contract is almost certainly not valid. The answer you linked references the 2001 Federal Circuit case Fomby-Denson v. Dept of the Army. The court, in its opinion, quoted from the 1948 Supreme Court case Hurd v. Hodge: [t]he power of the federal courts to enforce the terms of private agreements is at all times exercised subject to the restrictions and limitations of the public policy of the United States . . . . Where the enforcement of private agreements would be violative of that policy, it is the obligation of courts to refrain from such exertions of judicial power. It is clear that, in the case you propose, the enforcement of such a contract would go against the public interest. Quoting from the 1972 Supreme Court case Branzburg v. Hayes, the Fomby-Denson decision said: it is obvious that agreements to conceal information relevant to commission of crime have very little to recommend them from the standpoint of public policy. It further notes this clause from the First Restatement of Contracts: [a] bargain in which either a promised performance or the consideration for a promise is concealing or compounding a crime or alleged crime is illegal.
Is the their username alone, without any attached profile (like their email address or real Name) still considered personal data that has to be deleted? For something to be ‘personal data’ it must information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly. In other words: If the natural person can be indirectly identified from the username, it is personal data. If he cannot, it is not personal data. This obviously depends on the circumstances. If the user used something very similar to his real name, or his email address or uses the same nickname on a lot of different systems, then it probably is personal data. If it is an unique pseudonym that is not used elsewhere, it is less likely. If you want to make sure you comply with the right to erasure, you may want to scrub your wiki database, replacing all the username of the deleted user with "anonymous" (or something like that). If you want to be able to treat these as separate users, your scrubbing process may use unique anonymous identifiers ("anon-1", "anon-2", and so on).
One of the principles of contract law is that the offer and acceptance are evaluated based on the objectively ascertainable intentions as judged by a reasonable person. On the facts that you have provided - even if your friend claims that they filled it out wrong, there is no reason for someone to objectively think so, particularly given the fact that they went to the trouble of writing the information in. However, this will depend on what kind of legally binding document this is. If it is, in fact, a contract, then the employer must accept it before it becomes legally binding, and they must actually communicate this acceptance to your friend (the offeror). If this is a policy document, then it is only legally binding if another contract has said that it is legally binding - generally, (smart) employers will include a clause in their employment contract stating that you are to adhere to policies but that those policies do not form part of the contract. If that is the case, then your friend is legally bound by the terms of the policy and will breach their employment contract if they do not adhere to this policy. This is unlikely to be an issue of contract law in and of itself - your friend cannot unilaterally bind their employer to terms as he sees fit. More information - including the nature of the document and other agreements that were made - would be required to provide more useful information (and that's what you would give to a lawyer).