Is there really a German law that requires that credit card companies *only* provide statements in read-only format? I live in Germany and have a German €-denominated credit card. I used to download my monthly transactions in CSV format, but after a recent web site redesign, the new credit card web site only allows downloads as PDF. I contacted the bank about this, and they replied that German law requires them to give the transactions in a read-only format such as PDF. I don't know what law they're referring to, but this seems far-fetched to me. I could see a law requiring them to make statements available in a read-only format, but I find it hard to believe that the law would insist that exclusively read-only format is permitted. Would anyone be able to locate the law in question, so I can read it for myself? (I can read German reasonably well.) Articles about this law or other commentary would be welcome as well, in English or German.
The laws you are looking for are §§144 ff Abgabeordnung (AO) and are for those who are required by law (earnings greater € 500000) to retain their bank statements and wish to do so in an electronic form (§146a AO). So when needed as proof for the tax office, this unchangeable PDF format is needed. The law does not forbid the bank to also give out the bank statements in another form (not acceptable by the Federal Ministry of Finance). The CSV format would be one such format. Sonderpflichten für Besserverdiener Für Privatpersonen mit positiven Einkünften von mehr als 500.000 Euro im Jahr besteht eine besondere Aufbewahrungsfrist für Kontoauszüge von sechs Jahren. Die gesetzliche Aufbewahrungspflicht für Unterlagen von Personen, die zur Buchhaltung verpflichtet sind, beträgt übrigens zehn Jahre. Special duties for high earners For individuals with positive income of more than 500,000 euros a year there is a special retention period for bank statements of six years. Incidentally, the legal retention requirement for documents from persons who are obliged to keep accounts is ten years. Elektronischer Kontoauszug gilt als Nachweis Immer mehr Bankkunden ziehen elektronische Kontoauszüge der papiergebundenen Form vor. Da stellt sich die Frage, ob die digitalen Belege im Ernstfall genauso als Zahlungsnachweis gelten. Das Bundesministerium der Finanzen hat erklärt, dass dies der Fall ist, sofern das elektronische Dokument vorher vom Kontoinhaber auf seine Richtigkeit überprüft worden ist. Wenn ein Steuerpflichtiger also einen Kontoauszug vorlegt, den eine Bank im unveränderbaren PDF-Format erstellt hat, gilt seine Nachweispflicht als erfüllt. Da das Bundesfinanzministerium den Ausdruck des elektronischen Kontoauszugs jedoch lediglich als Kopie des Originals ansieht, sollten Betroffene das digitale Dokument besser nicht vor Ablauf der jeweiligen Aufbewahrungsfrist löschen. Electronic bank statements serve as proof More and more bank customers prefer electronic bank statements to paper-based forms. This raises the question of whether the digital vouchers also serve as proof of payment in an emergency. The Federal Ministry of Finance has stated that this is the case if the electronic document has been checked for accuracy by the account holder. If a taxpayer presents an account statement that a bank has created in the unchangeable PDF format, its obligation to provide evidence is deemed to be fulfilled. However, since the Federal Ministry of Finance regards the printout of the electronic account statement only as a copy of the original, those affected should not delete the digital document before the respective retention period has expired. Sources: § 146a AO - Einzelnorm Kontoauszüge &amp; Co. aufbewahren? – ING WissensWert
The EU-wide 48 hour limit and the German Arbeitszeitgesetz only apply to employees, not to self-employed persons or freelancers. Thus, it would in principle be legal to have a full-time job and do any amount of freelancing on the side. I'm not sure whether your PhD student position factors into this since it is unpaid. If you have multiple employers, the sum of working time matters – this is one reason why you have to notify your employers about additional jobs. One employer cannot check your time with another employer, so you should inform them when your shifts change (while employers can assign you shifts, they must consider your personal circumstances). But self-employment is not employment. If you take this offer, you would act as a German business, perform work in Germany, pay taxes in Germany, but have an UK client. (Assuming your work would be done remotely rather than travelling to the UK to perform your work there). Freelancing would also mean that you'll meet the wonderful world of German bureaucracy, including registering with the Finanzamt, writing invoices, doing accounting, filing taxes, dealing with VAT, and trying to navigate a no-deal Brexit. At least your work likely counts as freiberuflich rather than gewerblich, which would free you from a Gewerbeanmeldung. Your don't have to seek permission from your employer when taking up a side job, but you must notify them. They can object if your side job would impact your work. This would clearly be the case when working for a competitor, or when your side job would bring you over the working time limit. Since you work in the public sector, there may be additional rules (parts of Beamtenrecht apply to your employment relationship). While the working time limit does not apply to freelancing, this might still impact your job if you get too little rest, or if you would become unavailable for your main job during normal working hours. Taking up a side job despite an objection could be cause for immediate termination. Note also that you cannot generally use vacation days to work a side job since vacation is intended for recuperation. To summarize: you would not work an UK job, but be employed in Germany and be self-employed in Germany the working time limit only relates to employed work, not self-employed work your employer may nevertheless be able to object to you taking up another job if it would affect your work
Primary Theory I suspect there might not be a legal answer to this question. I have always suspected a sort of pseudo-intellectual elitism (or simple preference or carelessness) with passive voice sentence construction in general. I sense license writers have not (yet) escaped this general trend. I would love someone to prove this theory incorrect. But, alas, I doubt it will happen. Alternative Theory But because this is a Law Q&amp;A site, I will advance the following alternative theory. I don't believe it's correct. But I will advance it because it's the only possible explanation I can think of that might be even remotely based on legal reasoning... Maybe they are just basing their construction on the way the law itself is written? For example, if the law says, "Permission must be granted..." Then it would follow that a writer who wants to comply with the law might choose, "Permission is hereby granted..." instead of something like "The authors hereby grant permission..." or, as the OP suggested, "You may..."
As always, it depends. However, it is by no means certain that any public facing hobby project, such as a web app, is exempt from having to comply with the GDPR. Since the GDPR is only a few days old, we have of course no case law based upon the GDPR itself yet. However, when considering this, one should take the following two facts into consideration. 1. The "personal use exeption" in the GDPR is not new. The personal use exemption is unchanged from the article 3(2) of Directive 95/46/EC. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.) 2. Case-law under the previous regulation restricts the scope of the exception The ECJ has ruled on the scope of the personal use exception in two cases: C-101/01 C-212/13 In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals. In C-101/01 it can be argued that the hobby project as a blogger was connected to the controllers professional activity (she was a catechist in a local church, and blogged about her work. including her colleagues). But in C-212/13, there no such connection to professional or commercial activity. Here, the controller operated a CCTV to protect his home, but set it up to also capture public space, and that was enough for the ECJ to decide that the personal use exception did not apply. Discussion Case-law based upon Directive 95/46/EC is in no way binding for a future court that need to rule based upon the GDPR. We need to wait for case-law decided under the GDPR to be able to have some degree of certainty about the scope of the "private use exception" under GDPR. However, given what we know about how the ECJ has ruled in these cases in the past, I think it is hazardous to think that just because what you are doing on the web is just a "hobby project" not connected to professional or commercial activity, you are exempt from complying with the GDPR. Conclusion IMHO, you may be exempt, or you may not be exempt. I think it really depends on your activity in your hobby project, and to what extent this project processes the personal data of other people than yourself.
Being as general as possible - refund policies are governed by bank and scheme policies, and so aren't necessarily the domain of law. There may be jurisdiction-specific regulations that limit your liability as a consumer, but there's not usually a legal requirement. This is almost certainly wholly governed by your credit card terms of use.¹ You can report this to your local authorities, but without proof of a crime, it's unlikely to be actionable. The website isn't necessarily to blame, either - if your computer or your connection to the website was somehow compromised, then your details may have been obtained in that way, and the website could have had nothing to do with it. Again, this is almost certainly wholly governed by their scheme agreement.¹ 1. Some off-topic information here, which may or may not be accurate, and which you should not seek clarification for here (check Money SE instead, and first check whether it is on-topic there) - generally, bank policies will refund you for fraudulent transactions below a certain quantity or value. In this case, the bank tends to take a loss and chargeback rights are not exercised. In other cases, the bank will require the merchant to prove that the authorised cardholder did in fact authorise the transaction. The level of proof is governed by the way in which the transaction was conducted and verified at the time of purchase - whether the CVV2 code was verified, whether address verification was completed, whether 3D verification was completed. If the merchant is unable to prove, according to the scheme guidelines, the transaction will be charged back to their account.
Variations of contracts must be consented to by all parties. This means that if the company sent your friend varied terms, it would have included means by which she would have consented - this may be by continuing to use a service. You cannot unilaterally change the terms of a contract. You could try to charge the company PoS terminal storage fees, but it's highly unlikely to be enforceable if they don't agree to it. In theory if they are aware of the change and they accept them in some way then they are bound to the terms just as she would be, even if they later claimed that they were not aware of them. There is some precedent - in Russia - for this with a bank and it made the news some time ago. There's plenty of cases in which people who don't read EULAs or loan contracts thoroughly are still forced to honour their obligations to their creditors under them.
I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password. It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier. If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.
There are jurisdictions that do not allow authors to place their work in the public domain, such as Germany. Main reason is the strict monistic approach the German copyright law bases on. Key feature of this approach is the concept that, in principle, the copyright/author’s right itself can neither be transferred to another person nor waived by the author herself. The German author’s right consists of two parts, the moral rights and the exploitation rights. The moral rights are – as a rule – personal rights that are bound to the person of the creator (or, after her death, her legal heirs), i.e. they can neither be transferred nor waived. Since moral and exploitation rights are considered as inseparable parts of the author’s right as a whole (monistic approach) the exploitation rights cannot – in principle – transferred or waived by contract as well. CC0 is supposed to get you as close to the public domain as possible in your legal system. CC0 helps solve this problem by giving creators a way to waive all their copyright and related rights in their works to the fullest extent allowed by law. CC0 is a universal instrument that is not adapted to the laws of any particular legal jurisdiction, similar to many open source software licenses.