Which laws apply on the world wide web? This might be a very widely scoped question. I suspect by using common sense, that each country has different laws that might apply on internet use in that specific country. But nevertheless, I'm wondering if there are global laws or laws from countries that also apply in other countries. For example the EU Cookie Law or the Dutch Data breach notification obligation. If so, what are the (global) laws on our world wide web? Regarding, privacy (like tracking, surveillance), data protection, data leaks, illegal activities and so on.
The existence of a law/legal system is the province of sovereign states. We do not have a world government so there is no world legal system. There is such a thing as international law, however, that is based on what the sovereign nations of the world agree is international law (usually in a treaty) and the degree to which they have implemented them in domestic law. For example, the International Criminal Court has no jurisdiction over US nationals because the United States of America has refused to ratify the treaty that created it. There are also supra-national entities like the EU whose directives are binding on their member states and such states are required, as a condition of their membership, to enforce such directives domestically. A sovereign state's courts will decide when a person and their activities falls within their jurisdiction based on the circumstances of the particular case. For example, an Australian citizen can be prosecuted in Australia for paying a bribe to a foreign official in a foreign country even while working on behalf of a foreign company even if such activity is locally lawful. Why? Because Australia is a sovereign nation and it says it can. Sometimes it is impossible for a person to comply with the laws of multiple nations. For example, if the EU requires that certain data about their citizens is to be made confidential but the laws of the USA require a US corporation to disclose this information then it is impossible to comply with both. A person in such a position must decide which laws they will break. It is partly for that reason that multi-national corporations are usually multiple corporations i.e. they have a different corporate subsidiary in each jurisdiction (tax is another reason). For example, if all EU citizens do business with Google (Europe) then Google (USA) can rightfully claim that it has no data about European citizens to disclose.
The examples you cite are all based on national law in Sweden and other Nordic countries. If you check GDPR Article 7(1)(e), you will see that processing is lawful if: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; Further down in the same article, you'll see that not only Union law, but also: Member State law to which the controller is subject apply. GDPR Article 7(1)(e) is controversial and there is also a note that The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued. There has been attempts by privacy advocates to stop some of these transparency practices (in particular public tax report disclosure) by arguing that they do not meet this criterion, but so far these challenges have been unsuccessful.
The ePrivacy Directive Cookies are governed in the EU by the ePrivacy Directive which was first passed in 2002, and revised in 2009. However, if a site places a cookie, and later reads the cookie and stores an indication of the cookie content, this may be personal information and thus also subject to GDPR rules. (Other privacy laws, such as the CCPA, may also impose requirements on cookie use, when they apply.) Note that the so-called &quot;EU cookie law&quot; is a directive and not a regulation. This means that it is up to the various EU countries to implement it in their national legislation, and different countries may implement it in different ways. It would be the actual laws in individual EU countries that would be binding on website operators, and I am not going to try to find and analyze all the various laws on the topic. Paragraph 25 of the directive (linked above) reads: However, such devices, for instance so-called &quot;cookies&quot;, can be a legitimate and useful tool, for example, in analysing the effectiveness of website design and advertising, and in verifying the identity of users engaged in on-line transactions. Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment. This is particularly important where users other than the original user have access to the terminal equipment and thereby to any data containing privacy-sensitive information stored on such equipment. Information and the right to refuse may be offered once for the use of various devices to be installed on the user's terminal equipment during the same connection and also covering any further use that may be made of those devices during subsequent connections. The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible. Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose. This should mean, if implemented straightforwardly, that cookies, beyond those absolutely essential to the operation of a site, can only be placed if a user is notified of the intention to place them, and freely consents. This can be done once per user, on an initial session. Users are supposed to be provided with provided with &quot;clear and precise information&quot;. I do not think a simple statement that the site uses cookies fulfills this. At the very least the purposes for which cookies will be used should be provided. The directive does not make clear what level of detail about individual cookies such a notice must provide. The notice described in the question neither describes the purpose of cookie placement, nor does it offer any meaningful choice to accept or reject them. As such, I do not think it would be compliant with the directive. If cookies are read back (which is after all pretty much the point of having them) and can be potentially identified with an individual, then under the GDPR (article 6) there must be a lawful basis for processing them, and the interaction above would not be enough to establish consent as a lawful basis. There might be some other basis that does not require consent, however. Interpretations from others This page from cookiebot explains some of the history of the directive, and how it contrasts with the GDPR (which is a regulation, and so is directly applicable without the action of national legislatures). This page from The Verge discusses recent changes in the directive and the guidelines for applying it, and criticizes how it has been complied with, and ignored, by many sites. Cookies and the GDPR This page, &quot;GDPR, and the ePrivacy Directive&quot;, from GDPR.EU says: ... cookies, insofar as they are used to identify users, qualify as personal data and are therefore subject to the GDPR. Companies do have a right to process their users’ data as long as they receive consent or if they have a legitimate interest. Passed in the 2002 and amended in 2009, the ePrivacy Directive (EPD) has become known as the “cookie law” since its most notable effect was the proliferation of cookie consent pop-ups after it was passed. It supplements (and in some cases, overrides) the GDPR, addressing crucial aspects about the confidentiality of electronic communications and the tracking of Internet users more broadly. To comply with the regulations governing cookies under the GDPR and the ePrivacy Directive you must: Receive users’ consent before you use any cookies except strictly necessary cookies. Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received. Document and store consent received from users. Allow users to access your service even if they refuse to allow the use of certain cookies Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place. That page also describes the proposed ePrivacy Regulation which, if passed, will replace the current directive, and links to drafts of it. Conclusion The site described in the question probably does not comply with legislation implementing the ePrivacy directive. Depending on where it is hosted and targeted, and what it does with cookies that it sets, it may fail to comply with the GDPR as well. There has been very little enforcement of the directive so far. This may change in the future, particularly if it is replaced by a regulation, as has been proposed.
No, GDPR does not apply here — but other laws might . The General Data Protection Regulation only concerns itself with the following: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. per Article 2. Furthermore, there is a specific exemption (Art. 2 (2)(c)) which would seem to apply to you (emphasis mine): This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. You are sharing the conversation in a purely personal capacity and are not processing it wholly or partly through automated means nor are you intending it to form part of a filing system. Additionally, depending on the contents of the conversation and what you share, there may not be any personal data involved at all. For example, if you only share the messages themselves (and they don't contain any personal data that could identify someone) and censor/black out any names or photographs/avatars from the senders. Either way, GDPR does not appear to apply to you in this context. However, it appears that Article 18.1 of the Spanish Constitution grants the right to &quot;personal and family privacy&quot;, as does the Organic Act 1/982 on Civil Protection of the Right to Honour, Personal and Family Privacy, and Self-Image. It's possible that, depending on the contents of the conversation, the other party involved in the conversation may have a case for action against you in the civil or criminal courts (for example, if the information invades their privacy or is defamatory in some way) if you share the contents of the conversation with someone else. I am not familiar with Spanish law so cannot comment further on this matter.
I'm not sure it makes sense to talk about having "jurisdiction" over an IP address, for the purposes you're discussing. If you wanted to sue the IP address itself--something that is possible under limited circumstances--then you might need to locate it for jurisdictional purposes. But I don't think that's what you're talking about. You're talking about taking civil or criminal action against the people who are using the IP address to commit crimes. What matters, in that case, is not a theoretical legal question about the location of an IP address. It's questions like: where do these people live? Where do the people downloading the illegal content live? Where are the physical servers located? ("In the cloud" is not an answer--there are physical servers somewhere making up that cloud). For jurisdictional purposes, the chair they're sitting in when they upload the illegal data, and the location of the AC power outlet the physical server is plugged into, are as important as, if not more important than, the metaphysical "location" of the IP address of the server.
You haven't specified a jurisdiction. In the United Kingdom† this is a clear violation of section 3 of The Computer Misuse Act 1990 (1) A person is guilty of an offence if— &nbsp; &nbsp; (a) he does any unauthorised act in relation to a computer; &nbsp; &nbsp; (b) at the time when he does the act he knows that it is unauthorised; and &nbsp; &nbsp; (c) either subsection (2) or subsection (3) below applies. (2) This subsection applies if the person intends by doing the act— &nbsp; &nbsp; (a) to impair the operation of any computer; &nbsp; &nbsp; (b) to prevent or hinder access to any program or data held in any computer; [F2or] &nbsp; &nbsp; (c) to impair the operation of any such program or the reliability of any such data; [F3or &nbsp; &nbsp; (d) to enable any of the things mentioned in paragraphs (a) to (c) above to be done.]] Deleting the data is unauthorized (3.1.a) The ethical hacker knows it is unauthorized (3.1.b) Deleting the data prevents access to the data (3.2.b and hence 3.1.c) † This is one of the few Acts that apply to the whole of the UK.
Enforcement against non-EU entities is difficult, and especially digital services would be impossible to shut down. Ultimately, enforcement would depend on judicial assistance between the relevant EU member state and the jurisdictions where the data controller is established or has relevant assets. Your case involves physical goods and other regulations though, so that (some amount of) compliance by the data controller is necessary in order to have continued access to the EU single market. Which instruments for enforcement of fines are available depends on the EU member state, but could e.g. involve confiscation of products or payments. A non-EU B2B service provider would also have economic incentives to comply as EU data controllers cannot share personal data unless an adequate level of protection is ensured. In reality, it is fairly unlikely that non-EU data controllers will get fined anytime soon because data protection authorities tend to prioritize more clear cut cases, and tend to stay within their jurisdiction. Of course, non-EU data controllers are usually required to register an EU representative precisely to subject them to a particular authorities' jurisdiction, but a non-compliant controller is unlikely to do that. A note on the GDPR's territorial scope: it is far less extraterritorial than some people believe. Per GDPR Art 3(2) the regulation applies to non-EU data controllers, (a) to the extent of their processing activities that relate to offering of goods and services (also unpaid services) to data subjects in the EU, or (b) when they monitor/track behaviour of data subjects as far as the behaviour takes place in the EU. For example, a B2C company would have to comply with the GDPR regarding how they handle shipping addresses of their EU customers. The EDPB has issued in-depth analysis as part of their guidelines 3/2018 on the territorial scope. However, the ECJ has found that some of the GDPR's effects are confined to the EU. For example, Google has to hide some results from EU searches in order to comply with the GDPR's Right to Erasure, but cannot currently be forced to hide the results from non-EU searches.
While German law indeed requires providing correct contact information it does not require the recipient to answer queries. It is there so that you can submit legal notifications. In your case I wouldn't be so sure that the information is not correct. However, even if the contact information is incorrect, there is not much you can do about it. This is reserved to the following groups by § 8 Abs. 3 UWG: every competitor; associations with legal personality which exist for the promotion of commercial or of independent professional interests, so far as a considerable number of entrepreneurs belong thereto, and which distribute goods or services of the same or similar type on the same market, provided such associations are actually in a position, particularly in terms of their personnel, material and financial resources, to pursue the tasks, under their memoranda of association, of promoting commercial or independent professional interests, and so far as the contravention affects the interests of their members; qualified entities that prove that they are entered on the list of qualified entities pursuant to section 4 of the Injunctions Act or on the list of the Commission of the European Communities pursuant to Article 4 of Directive 98/27/EC of the European Parliament and of the Council of 19 May 1998 on injunctions for the protection of consumer interests (OJ Number L 166 page 51); Chambers of Industry and Commerce or Craft Chambers. Unless you are a competitor you are out of luck. The hoster or other providers can't do anything and don't need to, as they are not required to check legality of their user's websites. It doesn't really matter where you are by the way for these laws.