Are secret societies legal? What is the legal status of secret societies? Some assumptions on these societies to restrict the question: 1) They are not involved in unlawful activities in the countries in which members operate. 2) They may be concerned about politics or religion. 3) They operate online. (This point raises the further question: under which jurisdiction they would be regulated?) 4) By secret I mean: they want their members, activities and operations to be concealed to non-members. They want the organisation itself to be unknown.
Depends on the purpose of the society and physical location of its members. A secret society aiming to coordinate bank robberies would be pretty much illegal anywhere. A secret society sharing photos of cats would be fine in most parts of the world. I'm not sure about the jurisdiction. All the places in which members live? Where the servers are located? The place of residence of the founder? All of that matters. Members, founder, servers are all subject to the laws of the land where they are. (That said, the fact that the members only interact online changes nothing.) For example, say there is a secret online society with some sort of political agenda and members all over the world. Whilst for members living in most of the English-centric world (UK/US/Canada/AU/NZ/Singapore etc.) such a membership would be perfectly legal, members living in Italy and Poland will be breaking the law.
Yes. Art 13 requires you to provide “the identity and the contact details of the controller”. You are the data controller. Your name and address are necessary to establish your identity. Using AdSense means you're offering an internet society service commercially. In that case, there's also probably some EU fair competition directive that was implemented in your countries national law and will provide equivalent requirements. For example, my country Germany has a far-reaching Impressumspflicht. Not sure if this is the most relevant EU law, but Art 22 of Directive 2006/123 requires that your country passed laws to ensure that you make available “the name of the provider, his legal status and form, the geographic address at which he is established and details enabling him to be contacted rapidly and communicated with directly and, as the case may be, by electronic means”. I think you would be in scope of this directive since you're acting commercially. This legally mandated self-doxxing is unfortunate for private bloggers, but it's also essential for making it possible to enforce data subject rights: if you were to violate someone's privacy rights, how could they sue you if they don't know where to serve you with a lawsuit? However, all things are a balancing act. These requirements are not intended to limit freedom of expression. If you're just trying to communicate something to the public without jeopardizing your anonymity, then paradoxically social media services can be more attractive.
Scenario 1. It doesn’t matter what it says. If it was not legally ratified, it is not legally in force. There is no absolutely no paradox at all. It is essentially just a draft amendment and would be thrown out if any attempt was made to enforce it and challenged.
A law has to be "broad" to include a lot of possible crimes and intent of criminals and account for the good faith of non-criminals. "Intentionally access without authorization/exceed" is actually fairly specific; "intent" is the keyword. Someone making a mistake may have intent to login, but no intent to commit a crime. Someone confused by "different pages of demo and live accounts" can easily defend their actions by pointing out that they were confused. It's up to the reasonableness of the pertinent law enforcement and prosecutors to take into account the evidence that reasonable mistakes were made by little old ladies and not charge them with a crime. And for the most part, 98% of the time, law enforcement and prosecutors are reasonable.
I doubt that they are legally required to get your VAT as a condition of registration. However, they are a private company, and they are allowed to attach almost any restriction they want to registration. It is more likely that they require your VAT for some of the business interactions that they expect will happen after you register for the site and have decided to make it a condition of registration.
This would seem to fall under &quot;negative&quot; freedom of association; that is, the freedom to not associate with certain other people. This article discusses the matter in the context of individuals who refused to join a trade union: the ECHR decided that the right to not join a union is just as much a part of freedom of association as the right to join one. By extension, if you decide to hold a meeting (which is also part of the freedom of association), then you have the right to exclude people that you don't want to associate with. You might have a problem if you want to demonstrate in a public place: the undesirable people have just as much right to turn up as you do. However if you have had to get police approval for your demonstration (there is a bunch of ECHR law covering that) then you might be able to tell the police that those people are not part of your demonstration, and ask that they be treated as an unauthorised demonstration. It would be up to the police to take appropriate action at that point.
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
There may be a purpose to have laws which are impossible to follow. (I'm neither a lawyer nor a politician, following points are what I like to call qualified hearsay - they come from qualified people I know personally but were given as a remark or during a chat over a cup of coffee and therefore are not easily substantiable with rigorous sources. You can treat them as a hypothetical ideas for your thought experiments.) Everybody is implicitly guilty Confident citizens and transparent law is the worst enemy of totalitarian regime. You learn to live with ingrained feeling that there surely is something you are guilty of. Merely being addressed by police makes you nervous and malleable; should you stand up against oppression, it is easy for the state apparat to detain or convict you of one or more default offenses. A good example would be the law present in many, if not all, socialist bloc countries saying that knowing of a comrade having commited an offense or merely planing to and not reporting it to authorities is an offense in itself. Whether you did or did not know would be determined by the authorities. Make your laws very strict with a hope thay they will be followed at least to a degree Not laws in themselves, but standards (technical norms) regarding nuclear power stations in the former Soviet Union were strict to the point where they were technically impossible to follow given the state of the art. For example the standards for manufacture of high pressure pipes would state very low level of material impurities that when the actual manufactured material contained twice the level of impurities the pipe will still be very safe to operate. In a centrally planned economy with ever more ambitious production projections and declared zero need for contingency this was one of several ways how to create a bit of a wiggle room. (Source: I once worked for a nuclear power research institute supporting Soviet technology and was told this by an expert on stainless steel.) So there you have a bit of an illustration what may happen if a law is intentionally impossible to follow. Since you labelled your question 'United States', I believe the follow-up question is why would anyone want to propose such a law.