I have found my email address online in a .txt file. What should be my next step? A few days ago someone tried to log into my bank account, the attempt was unsuccessful but it was quite concerning. I’ve spent the past weekend moving my most important accounts to alternate emails and setting up TFA everywhere. I plan to get rid of my old email altogether since it was also used to sign up for some random websites and newsletters in the past weeks. As a part of the clean up I’ve run a Google search for my email and found a .txt file online with my email and thousands of others. They were categorised as valid/invalid. The site was since taken down but I have screenshots. I live in the E.U. and I’ve been thinking about a GDPR or a police report. The website owner was really easy to find and lives in the same country as me. What should be a next step?
Just the email in such a list is annoying but not really concerning. There are millions of people who put their email into publicly available contact data, and after a couple of years of use any email is going to be exposed some way. That's why websites use passwords in addition to just the email and why mail programs have spam filters. Your email was probably not used to sign up anywhere. Instead, spammers pretend that you signed up to slow attempts to prosecute them. A bit of a joke, really, considering how hard it is to prosecute spammers. The valid/invalid remark is used to facilitate spamming, no need to send mails to long-inactive addresses. More concerning than a 'leak' of your email would be a leak of your email plus password. (Such things also happen, and they are a reason why one should use different passwords and 2FA/MFA on important sites.) If it is just the email, see my first bullet point. There is a significant likelihood that the 'website owner' you think you identified is another victim of the address trader. Getting to the real culprit will require significant forensic effort. That effort is unlikely to happen for just emails.
there was absolutely nothing in the letter. You could hold it up to the sunlight and see that it was empty. There is no legal reason to do this. Somebody screwed up. Office workers are not infallible. It happens. I've seen government officials with no grudge against my client do it too now and then. Taken together with the spelling errors in your name it reflects general administrative incompetence and not some nefarious plot. The cautious thing to do would be to call them and tell them that you got a misaddressed letter with nothing inside it. A judge might frown at your conduct if you had some inkling they were trying to communicate with you and did nothing. Save the empty envelope to prove that they didn't send you a security deposit letter as they claimed if there is a dispute or litigation down the road.
I know that I have to provide detailed information which data I save and how I use it. Yes, you should, if you are getting access to users' Dropbox accounts, which will contain all sorts of private data, copyrighted (and illegally copied copyrighted files), etc. You provide the detailed information to your users through a click-through Privacy Policy - TOS (Terms of Service) in your App, like any other App out there. Click wrap (Wikipedia) user agreements are legally binding in many jurisdictions. Even if you don't access files and information - such as personal information or files - you still need a clear TOS for your App, for both your users' and your own legal protection. But I am a poor student who don't want invest money into a lawyer to write me a privacy policy ... I do not plan to get paid for (this app)... Being a free or paid App doesn't make a difference when it comes to the TOS, if you need one, and if you need to pay for one to be drafted. But not investing money in a lawyer can be a critical mistake if your App will be distributed on the popular App directories like Google Play and iTunes and your TOS does not clearly and legally outline all possible usage and data polices. Lawyers have experience in covering all the bases. Is there any way I can do this privacy policy on my own? Sure, you can: https://www.google.com/search?q=privacy+policy+generator But you run considerable legal liability not having a TOS that correctly and legally addresses all users' privacy concerns and clearly outlines what you do to insure security. That's what lawyers are for. Is it possible to just create some “I save all your data“ policy which would of course be to much but it would include all data I save and so I would not miss anything in my policy? Sure, you can simply say I save all your data. But how can you be sure that you've haven't missed important policy details and scenarios that could result in legal action against you? Like how long do you save data? When will you delete it? How secure is it? Can the user ask for deletion? What happens if you get hacked? What about users in countries other than the US? Users under 18 years old? You must use arbitration for any disputes? And on and on. The considerable legal liability of using a non-professionally drafted TOS means you run the risk of getting sued. You have to decide if it is worth the risk.
So I suppose we basically need to disclose the exact geolocation of the datacenters that store this kind of content. That is incorrect. You need to identify a place of business where federal investigators may inspect the records without first making an appointment for access. The location of cloud storage is not particularly relevant. is it possible in any way to achieve compliance with 18 USC 2257A while using Google Cloud Storage (Or perhaps any other cloud storage service)? Yes. You must store the records as required by the statute and by the regulations issued under the authority of that statute, 28 CFR Part 75. I only scanned the regulations, but it seems that the &quot;location&quot; of the records is the place where they are available for inspection, not necessarily the place where digital files are stored. (The regulations also provide that you may indeed keep the records in digital form.) But consider, for example, what would happen if the FBI came knocking for an inspection and a local utility company accidentally severed the fiber cable on the next block. Such a network outage happened at my company a few years ago, and the incident disabled all of our redundant networking, so we had no internet access whatsoever for several hours. The investigators would probably tolerate such a disruption, but it is probably better to have a copy on site in addition to any off-site copies you might have. Regardless, you should hire a lawyer with relevant experience, because you need advice from someone who can find out whether there has been any litigation that may have a bearing on your rights and obligations, and you should find out what state and local law have to say about this, if anything. This is a criminal statute, and trying to protect yourself from criminal liability without qualified legal advice is quite possibly going to leave you vulnerable.
It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR) The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person. There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability. To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used. You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent. So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear. Some previous questions and answers here on law.se dealing with GDPR consent that seem possibly relevant: User consent required under GDPR What provisions should I make regarding GDPR consent when users do not sign themselves up? GDPR - Withdrawn user consent Opt Out Consent under GDPR
You wrote: As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. True, Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. You asked: My question is whether this anonymization process counts as processing personally identifiable data under GDPR? IP addresses are personal data in some cases, so yes, you're processing personal data. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc. These are purposes considered compatible with initial purposes according to Article 5.1.(b): Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1: Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security). Or does it not matter what I do with them once they are anonymized? Yes, it does. If you're not using them for &quot;archiving purposes in the public interest, scientific or historical research purposes or statistical purposes&quot; then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing. does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required? It depends on what you want to do with anonymized data. In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
Prove my work is not a trade secret violation Please don't. It's not your job to prove your innocence. The burden is on them to be specific, explain fully, and prove specific claims about your actions. In other words, don't justify, don't explain, and don't defend yourself to them. It's actually best you do not say anything to them, and just forward the letter to your legal counsel (Since you're selling software to be used in the medical field, I assume you already have some kind of legal counsel). For instance, even saying something as innocuous as "Managing patients, Exams, Bills etc are all public knowledge." could be used against you. Because it establishes the fact that you've been working on those features with them and that you've been working on those features with your new company (which doesn't necessarily follow, for all they know, you could have purchased a library module from someone else with those exact features). In other words, even if you were to reply with such an innocuous-sounding statement, you could be saving them months of cross-border discovery and litigation about some of their claims (even if you believed you were being entirely reasonable by defending yourself). But at the same time, don't take what I'm saying to mean that you should lie to them about which features you recently worked on. When I say that you shouldn't be talking to them. I mean that you should not be talking to them. You shouldn't be engaging with them and you shouldn't be giving them any shred of information whatsoever (implied or otherwise). It's not your job to make their job any easier. Do not reply to them. Don't even acknowledge the receipt of the letter (unless you already did by signing for it, which can't be helped). Use a legal intermediary. Give the letter to your own legal counsel (whether you signed for the letter, or not) and leave any reply to him or her (assuming he/she thinks this warning letter even warrants a response). And if this former employer gives you a phone call, kindly refer them to your legal counsel without saying another word.
I believe in this case, your company (OrgX) is a data processor and your customer's organization (OrgY) is the data controller. OrgY is responsible for establishing a lawful basis for sending you (OrgX) the personal data for their employees. Note that consent is just one of six lawful bases outlined in article 6(1). I'm no expert, but I believe OrgY's admin can claim they have a legitimate interest in sending their employee's personal data for training sake. In either case, the data processor is not responsible for establishing the lawful basis for processing. Of course, data processors aren't completely off the hook. GDPR outlines specific requirements for data processors (see chapter 4, particularly article 28).