As a customer, am i liable for messaging another customer found on a Facebook business page? I am a customer for a Wedding dress shop, and I messaged another customer with a warning about the shops impending closure because of issues with lack of contact from the company. I have received a warning from the Company who have stated a serious complaint has been made, using GDPR within their warning message. Have I broken any laws/rules in contacting another customer through Facebook? The message contained no disparaging remarks towards the business.
GDPR compliance is a matter between every customer and the business, not between different customers. How did you get the other customer's contact details? If they were provided or leaked by the business, that might be a failure of the business's obligation as a data controller to protect the personal data they are processing, possibly even a data breach in the sense of the GDPR. When you contacted the other person this was presumably a purely private or household activity, just like contacting any other personal acquaintance. In that case, the GDPR simply does not apply to any “processing” you may have done (compare Art 2(2)(c)). Things would be very different if you were promoting your own business, but that doesn't seem to have been the case. If the matter really is as plain as you described, then you can effectively ignore their references to the GDPR until you are contacted by your data protection authority, by their lawyer, or are served with court papers. None of these should happen: even if you were a “data controller” and your processing were subject to the GDPR – only the other customer and not the business would be the data subject, and only a data subject has a right for remedies like making complaints to the data protection agency and only the data subject would have standing to sue you in court for GDPR violations.
Please note that I'm not a lawyer. If you need specific legal advice, please consult a qualified attorney. Every time someone buys an item from someone else, there's at least an implied contract of sale where the seller of the item agrees to give the buyer the item to be purchased in exchange for a sum of money or other object of value which the buyer agrees to pay as consideration. Generally, in an online purchase, a contract of sale is completed when payment is made and the product has shipped. If the seller fails to provide the item you intended to buy after you make your payment, that's a breach of this contract of sale as the seller has failed to execute their end of the contract. I seriously doubt a "no refunds" policy would excuse the vendor for breaching the contract of sale. If you cannot resolve the issue with the vendor, then your best bet is to initiate a dispute through your credit/debit card issuer.
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
There does seem to be a meme in the UAE of people threatening legal action for negative reviews, as a form of defamation. The police will simply tell them that this is not a crime, go hire a lawyer if you want to sue them. If you block them, perhaps they don't have any other way to contact you (seems that was the point of blocking them), which means that you cannot receive their offer &quot;If you pay us AED 1,000 we will not sue you&quot;, which could be a problem if they win their court case. Still, it is perfectly legal to ignore or block them, up to the point that you are actually served with legal papers. When they actually sue you, &quot;blocking&quot; is irrelevant, they will hire a process server to hand you the legal papers that command you to appear in court.
Given the facts as stated in the question, it appears that Spirit owes a refund. If the portal or site through which the service was sold also handles other flights that do provide wi-fi, there may not have been an intention to sell an unavailable service, and so this may not have been fraud. It is not proper to knowingly sell a service that is not available, but if it is an error, it is not strictly illegal, but the contract has not been fulfilled. One could, in such a case, attempt to place a charge-back with the credit card through which payment was made, if a card was used. Failing that, one could take the matter to small claims court. Before opening a court case, I would send a physical letter by certified mail to the airline's customer service address, with a copy to its HQ address, explaining what happened and requesting a refund by a specified date. If there is a customer service email, a copy to that as well.
The critical part is the nature of the relationship between you, the website provider, and the provider of the material you embed. If the embed-provider acts as your data processor, then things are generally fine. The GDPR does not really distinguish between personal data processing activities that you perform yourself versus activities that you've outsourced to third parties. However, you would remain responsible for compliance. This also means that per Art 28 GDPR, you will need a contract with that embed-provider (sometimes called a “Data Processing Agreement”, DPA). This contract stipulates that the processor will only use the personal data as instructed by you, but not for their own purposes. With the Google Fonts case, it must be highlighted that Google does not act as a processor for this service. Google does not offer a DPA that covers the Fonts CDN. While Google promises that it doesn't use the personal data collected in this context in any nefarious way, there are zero contractual guarantees for website providers. So we have to consider the scenario when the embed-provider is an independent data controller. We as the website provider have no control over what the embed-provider does with the collected data, our control only extends to whether or not we cause the website to disclose data to that third party. But this is still processing as personal data (see also the CJEU Fashion ID case), and we need a legal basis for this data sharing. In the Google Fonts case, the court in Munich found that there was no legal basis for using Google's CDN. There was no consent, no contractual necessity, and no necessity for a legitimate interest. After all, these fonts could all be self-hosted. (Technical remark: and given how modern browsers enforce cache isolation and provide HTTP/2, serving fonts from your main domain is probably faster anyway). Consent management services will typically act as your data processor. You don't need a legal basis for “sharing” data with them, because the processing remains under your control. As far as the GDPR is concerned, loading a script from your processor's servers is equivalent to loading a script from your own servers (which you're probably hosting via a another data processor anyway). Sometimes, the necessary data processing agreement is already part of the standard terms of service, sometimes it's a separate document that has to be signed. Figuring this out is your responsibility as the data controller, before deploying the service. Art 6 GDPR doesn't say that you always need consent. It says that you need a legal basis, for which paragraph 1 enumerates six choices. For a lot of use cases, a “legitimate interest” will be appropriate, though it requires a balancing test. Sometimes, other laws mandate that you use a particular legal basis. For example, the ePrivacy Directive says that you must get GDPR-consent when accessing or storing information on the user's device (such as cookies), unless that access/storage is strictly necessary to provide a service explicitly requested by the user.
No. From here: Organisations must not send marketing texts to individuals without their specific, valid and prior explicit consent. This consent must be recorded and kept as proof of consent. There is a limited exception for previous customers, which is known as the soft opt-in. A soft-opt in only applies if the organisation have obtained the contact details in the course of a sale (or negotiations for a sales) of a product or service to the customer; they are only marketing their own similar products or services; and they gave the customer an opportunity to opt-out of the marketing, both when first collecting the details and in every message thereafter.
The first thing to notice is that the £100 offer appears to be a legit offer. That is to say, accepting it will create a binding agreement between you and the company. There is no reason yet for the company to believe that you have suffered more damages, and you do have reasonable options to prevent them (ask bank for a new card - that's not going to cost you £100). The second observation is that the GDPR does not really affect the first observation. The GDPR itself does not give rise to additional civil claims or special damages. Yes, the GDPR states that the company is in the wrong, but parties can make agreements how a wrongful deed is made right again. And their offer appears to do so. Note that accepting the offer does not take away your continuing GDPR rights. It just affects their past error. You can still ask them whether they have your card data on file today.