&quot;Impressumspflicht&quot; outside Germany for individuals This is another &quot;Do I need an Impressum&quot; question in a special case. I understand under German law, an impressum is required for all websites except strictly non-profit-oriented websites for private purposes. Assuming I'm a small musician of some kind from inside Europe but outside Germany. I've got a website in English and my native language where I offer bookings (for paid services). Would I need an impressum? (They don't pay on the website but there's a form to get in contact with me) Another assumption; I know Germany is pretty strict and they even go after bloggers who post personal content but use Google Ads (or similar ad services). They would require an impressum if they're based in Germany. Would this also apply for bloggers outside Germany if they're using Google Ads (to finance their website)? Are there known cases where German executive go after private individuals (such as bloggers that are placing ads on their site) in another country? Wouldn't this be an enormous effort?
If you operate from outside Germany but within the EU, it is generally sufficient to satisfy your own country's regulations. This is a foundational principle of the EU single market, though it's not quite realized yet and has exemptions for consumer protection purposes. However, the German TMG law which includes the Impressumspflicht explicitly enshrines this principle. So from the German Impressumspflicht perspective, you're good to go. However, you will not be able to operate anonymously, because of your country's laws. GDPR requires you to clearly state your identity and contact details in your privacy notice. If you engage in internet-based commerce, the EU eCommerce Directive will have caused your EU member state to pass legislation that requires you to disclose: your name the geographic address where you are established contact details incl an email address if applicable, registration numbers from trade registers or similar if applicable, your VAT ID Note that you must have a VAT ID for cross-border B2B sales within the EU. You state that you are not selling anything via your website, and are instead collecting payments via another website. What the consequences of this are would depend on the laws and caselaw in your jurisdiction, but you will have to make these disclosures on at least one of the two websites. About Germany going after bloggers who show ads: income from ads is taxable income, and operating a business requires registration. However, the German Impressumspflicht is rarely enforced by the state. Instead, other market participants (competitors) trawl the internet for potential violations and then send a cease-and-desist letter. They can do this because skirting legal obligations distorts the level playing field, which harms those competitors. There is a thriving cease-and-desist industry built around this, but it only affects businesses that operate within Germany.
It's not illegal to say things in your profile. SE requires you to license your content to them on a non-exclusive basis pursuant to CC BY-SA 4.0. &quot;Non-exclusive&quot; means that you can also license the material to others on some other basis, e.g. CC0. In that case, a person who uses your material can rely on the other license that you granted. If SE wanted to, it could prohibit putting licenses in a user profile, in which case you would have to promulgate your more generous license elsewhere.
That's an old idea that has been tried several times before (such as the first, being Unvarnished: Website Lets You Review People (And Trash Them) | HuffPost, which no longer exists); and one of the latest incarnations is Peeple (mobile application - Wikipedia). There are lots of legal liabilities, including defamation and harassment/stalking, even with the Section 230 of the Communications Decency Act | Electronic Frontier Foundation which (mostly) protects the website owner from others' speech posted on the site (your mileage may vary due to jurisdiction). The only way such a site would survive is to do what Peeple and other sites have done: greatly limit the speech allowed, such as limiting to only positive reviews, giving the subject complete control over what does appear on their profile, only allowing "opt-in" profiles, verify identities, etc. You would have to implement full GDPR compliance; but various lawsuits will either shut you down before you get far enough to launch or soon after and force you to greatly limit the scope of the site. Most lawyers would advise you to find something else to do with your time and money.
Names clearly are personal data and so a good question to ask for GDPR compliance is: Do you need to do what you want to do in order to offer your product or service? For your scenario a common answer seems to be that websites ask for the users first and last name during account creation. The reason is that they need this information to confirm the identity of the account creator. But the public profile only displays a user name that the user can pick freely. In general there is no good reason to publically show the legal names of users so websites don't do it. So for your website ask yourself, why do you want to publically show the names of your users? If you have a good reason to do that specify it in the user terms and go ahead. If you don't have a good reason don't do it.
I think that there won't be any trouble from Germany, but the US could be a problem if the girl reports the case to authorities. In that case, further details would depend on the state in question. As far as Germany is concerned, there are two sections in the penal code that could be relevant here: § 176 StGB - Sexual abuse of children § 182 StGB - Sexual abuse of juveniles To make things more complicated, we would also have to take into account juvenile penal law and whether Germany would have jurisdiction in the first place. 1) Jurisdiction: I'm not sure whether this case would fall into German jurisdiction under § 3 StGB as the case could be deemed to be committed in the US. However, in that case, Germany could still assume jurisdiction under § 5 item 8 StGB. 2) Since our guy was only 18, it would be at the discretion of the court to decide whether juvenile criminal law or regular criminal law is to be applied. In the former case, the sentence would be lower (if there is a sentence at all). But then we still have to figure out whether our guy broke a law in the first place. So first of all, let's take a look at § 176 StGB: “Section 176 Sexual abuse of children (1) Whoever performs sexual acts on a person under 14 years of age (child) or has the child perform sexual acts on them incurs a penalty of imprisonment for a term of between six months and 10 years. (2) Whoever causes a child to perform sexual acts on a third person or has a third person perform sexual acts on the child incurs the same penalty. (3) In especially serious cases, the penalty is imprisonment for a term of at least one year. (4) Whoever 1. performs sexual acts in the presence of a child, 2. causes the child to perform sexual acts, unless the act is subject to a penalty under subsection (1) or subsection (2), 3. influences a child by way of material (section 11 (3)) or information and communication technologies a) in order to cause the child to perform sexual acts on or in the presence of the offender or a third person or to have the offender or a third person perform sexual acts on the child or b) in order to commit an offence under section 184b (1) no. 3 or under section 184b (3) or 4. influences a child by showing pornographic images or depictions, by playing pornographic audio recordings, making pornographic content available by way of information and communication technologies or pornographic speech incurs a penalty of imprisonment for a term of between three months and five years. (5) Whoever offers or promises to supply a child for an offence under subsections (1) to (4) or who arranges with another to commit such an offence incurs a penalty of imprisonment for a term of between three months and five years. (6) The attempt is punishable; this does not apply to offences under subsection (4) nos. 3 and 4 and subsection (5).” Since the girl is 15 years old, this section is probably not relevant. However, to know for sure, we would need to know her exact age when contact started. If she was only 13 years and 11 months and contact lasted 1 year and 2 months, then § 176 might be relevant after all. That takes us to § 182. “Section 182 Sexual abuse of juveniles (1) Whoever abuses a person under 18 years of age by taking advantage of a predicament by 1. performing sexual acts on that person or having said person perform sexual acts on them or 2. causing the person to perform sexual acts on a third person or to have sexual acts performed on them by a third person incurs a penalty of imprisonment for a term not exceeding five years or a fine. (2) A person over 18 years of age who abuses a person under 18 years of age by performing sexual acts on that person or having that person perform sexual acts on them for a consideration incurs the same penalty. (3) A person over 21 years of age who abuses a person under 16 years of age by 1. performing sexual acts on that person or having that person perform sexual acts on them or 2. causing that person to perform sexual acts on a third person or to have a third person perform sexual acts on that person, and thereby exploits the victim’s lack of capacity for sexual self-determination, incurs a penalty of imprisonment for a term not exceeding three years or a fine. (4) The attempt is punishable. (5) In the cases under subsection (3), the offence is prosecuted only upon request, unless the prosecuting authority deems there to be a special public interest in prosecution which calls for ex officio intervention. (6) In the cases under subsections (1) to (3), the court may dispense with imposing a penalty pursuant to these provisions if, having regard to the conduct of the person against whom the offence was committed, the wrongfulness of the act is minor.” § 182 para. 1 StGB applies only to cases where the offender takes advantage of a predicament. I seriously doubt there's a predicament involved here. § 182 para. 2 StGB only applies for sexual acts for consideration, i. e. when money is being paid. Since apparantly there was no payment involved in this case, no problem here and we can go on to para. 3. § 182 para. 3 StGB only applies to cases where the victim lacks the capacity for self-determination and the offender is at least 21 years old. Neither is the case here. Summary: As far as Germany is concerned, there's no trouble to be expected under § 182 StGB. § 176 StGB might cause problems but only if the girl was under 14 when contact began. (You stated that she's 15. This could mean that she just turned 15 but was 13 years and 11 months when contact began.) As far as German law is concerned, it looks like our guy was overly cautious and there was no need to cut contact. From the US perspective, however, things will probably be different. I'm not familiar with US law but we would probably need to know the state in question.
Short preface: You might want to consult with a lawyer if what that website does really constitutes trademark infringement. But the question did not ask for that. It asked what to do if you want to send a C&amp;D to a website without contact information. That's the question I will answer here. Whether or not the C&amp;D letter itself has merit in this particular situation is another question, and probably one which would violate our &quot;specific legal advise&quot; rule. You can use a whois-database to find the public information on who operates a domain. Doing so for the domain in question yields that the contact information of the actual domain owner was &quot;Withheld for Privacy Purposes&quot;. That means the domain was registered through a domain-by-proxy service. The postal address in Iceland you see in the record is the address of that service, not of the domain owner. But you can see the registrar which hosts the domain: &quot;Name Cheap Inc.&quot;. So that's somewhere you can address complaints to. If you cause them enough problems, then you might be able to get them to take the website down. Those discount webhosters don't make nearly enough money per customer to fight their legal battles for them. Just reading a C&amp;D letter already costs them more than hosting a website for a year. So they might just fire the customer to avoid the trouble of dealing with you. But then the website might just reappear hosted by some other company a day later and you are back at square one. The registrar should also be able to tell you the real identity of the person who operates the website. However, they will likely not tell you without putting up a fight, as revealing private information without being legally obligated to might make them liable for violating a bunch of privacy laws. Ask your lawyer if there is any hope to get a subpoena forcing them to give you the identity.
Term 1 isn't going to hold up, but that is not a GDPR matter. It's just a matter of basic consumer protection law in the EU. You can't offload responsibility for your mistakes. Looking at 2, Dale M. already pointer out that it's now how the GDPR works. You are the Data Controller. X,Y and Z are Data Processors. Article 28(1) of the GDPR is in direct conflict with your disclaimer. You accept zero responsibility, the GDPR says you are fully responsible. That's the exact opposite.
I don't believe GDPR makes a distinction between 'real life' and 'online'. It's all real life. You can tell anyone that they don't have consent to keep your personal data, but that doesn't mean they always have to delete it. There are six lawful bases for processing of personal data, so if an organisation is using and can justify one other than consent then they don't necessarily have to delete your data when they ask. The six bases are listed by the UK Information Commissioner's Office: (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/#ib3