Are there potential legal considerations in the U.S. when two people work from the same home and use the same internet connection? Consider the following scenario: Person A is employed by a large company and has the usual &quot;everything you do while employed by us is owned by us&quot; in their employment contract. Person B is self-employed and creates intellectual property (here let's assume software) in the natural course of their business. They both work from the same home and use a shared home internet connection (for which only one of them, let's assume person A, is the official account holder). Is there a risk that person A's employer can attempt to attach themselves to person B's business or the intellectual property created by person B's business? For example, if B uploads intellectual property to a third-party service using the same IP address that A uses, can A's employer use that fact as evidence that B's intellectual property might have been created by A or with A's involvement? How does the law look at this situation?
It is conceivable that A's employer would claim that the intellectual property was actually created by A in the course of their employment rather than B. That would be a question of fact for the lawsuit to determine. Realistically, assuming A and B both testify that B created the intellectual property with no input from A and A's employer had only the IP address as evidence, it is pretty unlikely that the fact finder would find that A created the intellectual property. A's employer would almost certainly need to provide some additional evidence that would show that the balance of probabilities favored the employer's position (i.e. A works at FedEx writing software for package logistics, B is a 12 year old kid with no formal computer science training, and the intellectual property in question involves the implementation of sophisticated graph traversal algorithms that would be common in package logistics applications).
The software being free and open source has no impact on whether it infringes any patents or violates any copyrights. Copyrights attach to fixed representations of creative work in a tangible medium (e.g., the actual code and graphical elements of the software in question). As long as you aren't copying the copyrighted work of someone else, you should be in the clear. So, if you write your own code from scratch, or rely on code that you're allowed to use (e.g., "free" software with a permissive license that allows it to be used freely), you should be fine. On the other hand, if you copy a chunk of code that you aren't allowed to use, and then change the variable names so that it's superficially different, you're likely violating someone's copyright. Patents are a much more difficult question. To determine whether you would infringe any patents, you would have to read the independent claims of every patent that might be related. If you perform all the steps of any one of those claims, then you are infringing that claim (and therefore, the patent in which it is found). Unfortunately, this is much easier said than done. First, it may be difficult to search for all the potentially relevant patents, and once you've found them, there may be far too many to read. Second, claims are written in a type of language that is specific to patents, and someone without experience in patent law may not understand them correctly. Finally, the terms in the claims may not take on their plain English meaning, but rather may have been defined by the language in the rest of that patent, so it's possible that you might incorrectly think you were in the clear based on a misunderstanding arising from that. All that said, it may be best to go ahead with implementing an idea and then waiting to see what happens. Chances are that the implementation will arguably infringe some patent in some way, no matter what's done. But chances are also high that there will never be any worrisome enforcement action taken against it by a patent owner, simply due to the difficulty and expense associated with enforcing patent rights.
Caution: I am not a lawyer. It depends on who is doing the collecting and storing. If it is done "by a natural person in the course of a purely personal or household activity", then it is exempt from the GDPR, as per Art. 2. Beware, however, that "purely personal activity" means that you do not share or publish them. In this court case, having the name or phone number of someone else on your "personal" website constitutes "processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of Directive 95/46".
The first question is whose law you are concerned with, since in principle you might have violated copyright law in any country, and might be sued under the laws of multiple countries. The US has a concept of "fair use" which is notoriously difficult to apply. When you are sued in the US, you can defend against the allegation by arguing certain things: telegraphically, this includes purpose and character of use, nature of the work, substantiality in relation to the whole, and effect on market. Plus there is a 5th factor to be considered, transformativeness. The court then weighs these factors to decide if the use is "fair". By reading existing case law on the topic (conveniently available from the US Copyright office) you might develop a fact-based opinion of the risk: you would be vastly better off hiring an attorney who specializes in US copyright law to do an analysis for you. Do not hire a programmer to give you legal advice (do not hire an attorney to debug code). You would "fail" on the test of substantiality in that you are copying a highly substantial portion of the original work(s). You would "win" on nature of use (research especially non-profit and commentary are the underlying purposes that drive fair use law). It's not clear how you would fare w.r.t. nature of the work, which is intended to distinguish the extremes "news report" and "literature and artistic work" where copying news is at the fair use end of the spectrum. It is not clear how you would fare on "effect on market", but probably not so badly: are you avoiding some licensing fee? Coupled with the tranformativeness consideration, you are most likely having no effect on the market, since the product that you will distribute is not the original work, but a scientific conclusion about the work. Germany has different laws, and this article would be relevant if you cared about Germany. There was a change in the law that expanded the analog of fair use pertaining to research use. That law allows 15 percent of a work to be reproduced, distributed and made available to the public for the purpose of non-commercial scientific research. That, b.t.w., does not refer to what you are planning to do (unless you also publish quotes); for personal scientific research you may reproduce up to 75 percent. Since this is a new law only a year old, you could become part of the cutting edge in testing the limits of the law. So the standard disclaimer applies: ask your attorney. But note section 60d of the law which legalized data mining, and is squarely on point: (1) In order to enable the automatic analysis of large numbers of works (source material) for scientific research, it shall be permissible to reproduce the source material, including automatically and systematically, in order to create, particularly by means of normalisation, structuring and categorisation, a corpus which can be analysed and to make the corpus available to the public for a specifically limited circle of persons for their joint scientific research, as well as to individual third persons for the purpose of monitoring the quality of scientific research. In such cases, the user may only pursue non-commercial purposes. (2) If database works are used pursuant to subsection (1), this shall constitute customary use in accordance with section 55a, first sentence. If insubstantial parts of databases are used pursuant to subsection (1), this shall be deemed consistent with the normal utilisation of the database and with the legitimate interests of the producer of the database within the meaning of section 87b (1), second sentence, and section 87e. (3) Once the research work has been completed, the corpus and the reproductions of the source material shall be deleted; they may no longer be made available to the public. It shall, however, be permissible to transmit the corpus and the reproductions of the source material to the institutions referred to in sections 60e and 60f for the purpose of long-term storage.
The employee must, during and after employment, without limitation in time, observe a duty of confidentiality regarding [...] the Company's internal affairs such as business plans, profitability, pricing, employees, methods, processes, routines, code and the like as well as other information that the Company typically wants to keep secret The pure information that the company had at some time a security problem with their product is internal knowledge you only gained through working there. By what is written here, you are indeed prohibited from speaking about it. If it were public knowledge, you could point to a press release and say &quot;I did that, that was me fixing the problem&quot;. That would work. Because it doesn't share anything that isn't public anyway. But you cannot share things the company wants to keep secret. Finding out whether that contract is legally enforcable in your country and juristiction is the job of a real lawyer, but just as written, they are right. You signed a contract to not do that, not talk about it an certainly not publish it on the internet. So you should not do that, unless a good lawyer you trust tells you otherwise. That said, &quot;I found a security flaw&quot; is about as impressive as &quot;I found a dollar on the floor&quot;. Maybe you can talk about your knowledge to prevent something like it happening. That says nothing about whether or not it happened in your old company, and for me as an employer it is much more valuable to have you on board with structured knowledge you can apply, than with your memories of being lucky once.
You premise is correct. The processor is someone that processes data on your behalf, and since the GDPR definition of processing is extremely broad, that is about every third party subcontractor that you use for data processing, including various cloud providers. I'm afraid it will soon become a huge mess with a gazillion contracts to sign. I disagree. Yes, the GDPR says that a contract between the controller and processor must exist, but Article 28 of the GDPR does not say anything about how the controller shall document these instructions. Basically, in cases like the one you describe where John Doe relies on a web agency for having a contact form on the web, there will be a standardized (by the web agency) service agreement between the John Doe (controller) and the web agency (processor). There is nothing stopping the parties from agreeing that this service agreement that John Doe accepted as part of the onboarding procedure is also the DPA as required by the GDPR. Putting something like the following in the service agreement would do it: The parties agree that this Service Agreement between You (controller) and Us (processor) set out Your complete and final instructions to Us in relation to the processing of Personal Data and that processing outside the scope of these instructions (if any) shall require prior written agreement between You and Us. You also agree that We may engage Sub-processors to process Personal Data on Your behalf. The Sub-processors currently engaged by Us and authorized by You are listed in Annex A. I think we will se a lot of amendments in service contracts as the GDPR gets better understood, but I don't really see a flood of DPAs in addition to these amended service contracts.
In general, in the US, Bob may do this. If the second company is a competitor of the first and Bob has access to confidential information from his first employer, then there could be an issue. Some employers require their employees, or some of them, to agree to &quot;exclusive employment&quot;, that is to agree not to accept any other employment while employed by the company. If Bob has agreed to such a contract, he would be in breach of it if he took a second job and could be fired if his main employer learns of this. This is not a problem if Bob gets permission for the vacation work from his usual employer. In any case, Bob is not committing a crime, even if he is violating his contract.
With respect to the first question, discussing an idea in a non-encrypted email is not a publication that forfeits the right to patent an idea, even though it is not 100% secure. In the same way, talking about an idea for a patent with your patent lawyer in a secluded booth of a coffee shop in person does not constitute publication of the idea for this purpose, even if someone is secretly spying on you at the time. Since I am at the moment employed by a company, even though the idea originates from myself, it seems that I should quit my job first not to have my current company have any claim over my idea. It is possible that the contract makes even ideas that you come up with yourself while employed by the company the property of the company. If so, you are legally in the wrong and the idea belongs to the company. But, proving the reality that you are stealing the idea from the company is harder if there is nothing in writing. An email discussing an idea while you are employed would have to be disclosed in litigation with your employer over whether the patent applied for belongs to you or to your employer under an employment agreement. If you didn't put it in an email, it wouldn't exist to turn over in litigation.