As per GDPR, how are the agree/disagree to cookie buttons to be designed? I just stumbled over this very... interesting cookie dialogue on the Ansible site: How am I, as the average user, to decide if I'm agreeing or not to the choice with &quot;Out&quot; or &quot;In&quot;? Both buttons are the same color of blue when pressed, so there is absolutely 0 clear indicator on what I am exactly choosing. I don't know if this is a mistake or just pure malice to trick users into accidentally agreeing with all cookies, but it really annoyed me, and I want to know if the law actually says whether the consent has to be named clearly (as in, &quot;I agree&quot; vs &quot;I disagree&quot; etc.) - otherwise I can see this is a big loophole that people can abuse. Also funny: You cannot open the &quot;Privacy Statement&quot; link on the bottom, because when trying to read that you are blocked by the cookie popup again.
GDPR defines consent like this in Art 4(11): ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; Further conditions on consent are given in Art 7 GDPR. For you, the important aspects are: Consent must involve an affirmative action (opt-in). Thus, consent cannot be the default and must not be pre-selected. The Planet49 judgement provides relevant case law on this. Consent must be an unambiguous indication of the data subject's wishes. Consent must be informed. This requires access to the full privacy policy. Abuse is discouraged because the data controller has burden of proof that valid consent was collected (see Art 7(1)). How does the RedHat consent tool measure up? The consent appears to require an affirmative action and seems unambiguous: no option is pre-selected, and you need to click on “Out” or “In”. The selected option is then highlighted. However, I agree that the radio buttons are not entirely clear once a selection has been made. I also agree with you that the terms “Out” and “In” are not self-explanatory. They rely on the user knowing the terms “opt-out” and “opt-in”. This could indicate that the user's action isn't unambiguous. That the privacy policy page also shows a cookie consent popup could mean that consent isn't sufficiently informed. So together, this isn't a particularly good design for a cookie consent tool. There are some potentially fatal problems that could render the consent invalid. However, it isn't obviously non-compliant – I have seen far worse.
Well actually... I think you'll just need to wait a little more. I monitor the situation quite closely and I can tell you that it's just a matter of time. Microsoft was one of the first (if not the first) to communicate openly about the GDPR and the changes that follow. From the blog post: If your organization collects, hosts or analyzes personal data of EU residents, GDPR provisions require you to use third-party data processors who guarantee their ability to implement the technical and organizational requirements of the GDPR. To further earn your trust, we are making contractual commitments available to you that provide key GDPR-related assurances about our services. Our contractual commitments guarantee that you can: Respond to requests to correct, amend or delete personal data. Detect and report personal data breaches. Demonstrate your compliance with the GDPR. Microsoft is the first global cloud services provider to publicly offer you these contractual commitments. We believe privacy is a fundamental right. The GDPR is an important step forward to further clarify and enable individual privacy rights and look forward to sharing additional updates how we can help you comply with this new regulation and, in the process, advance personal privacy protections. Microsoft has set up an informational site on GDPR here. If your eyes are on any other provider, I think the only way to learn more is getting in touch and inquiring about their progress and process. Hope this helps.
I'm pretty sure that under GDPR, you can indeed request them to send all data they have on you. If it's a complex request, they may charge you something like £10. If they have a lot of data on you, they may list the categories of data they have and ask you to pick one, rather than them having to collect and send everything. They should respond within one month, but iirc in the UK implementation, they can inform you (within that month) that they will respond within three months instead. For the rest, I only know current Dutch law. GDPR is not that different from what we already had (in general terms) and in many cases it even extends it. Under our law (WBP), you can also request a correction of the data in case it is incorrect, or deletion if they no longer need it for the purpose for which it was collected and stored. I don't really know how that works out in practice though, as Facebook can of course claim that "being able to connect you to your friends when you sign up for WhatsApp or Facebook with that number" is a legitimate purpose (in their eyes). They might also not have your full name and therefore not be able to connect your data to your request. Or, perhaps, they have only your full name (and there are probably more people with your name), so they'll have a hard time verifying that it's really your data which they would be handing over or deleting. The company is required to verify your identity before acting on your request. How they implement that is up to them. Under Dutch law, if I remember correctly, any data that can be connected to your person by any party is personally identifiable information (PII). While Facebook might not be able to find who's behind a phone number, your carrier most certainly can. Therefore, the data falls under PII protection laws and they will have to implement a way to verify you and get you your data. Finally, whether your local laws apply to Facebook, I don't know exactly. There's lots of information on this though, so you should be able to find it. Generally, countries say that if something happened within their territory (e.g. you signed up for WhatsApp while in the UK), their law applies. Companies, I've read, will instead try to claim that their main office is in SomeCountry and therefore SomeCountry's laws apply. But I'm pretty sure you'll be able to find a Facebook office somewhere where GDPR applies, so that's probably fine. While not an exact answer and while I am not sure about everything, I hope this gave you some pointers to go on!
In the question, you write: The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file). No, it does not. To quote Miss Infogeek: GDPR DOES NOT MAKE CONSENT A MANDATORY REQUIREMENT FOR ALL PROCESSING OF PERSONAL DATA. Consent (Article 6 (1)a) is indeed one of conditions that can be used to comply with the GDPR requirement that processing must be lawful, but it is not the only condition available to the controller to ensure lawful processing &ndash; there are alternatives (before the list of conditions it says that "at least one of the following" must be satisfied). All the conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. One of alternatives are Article 6 (1)f. It says says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) As noted in the question, logging IP addresses for the purpose of security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices. It is the default, and most (all?) web-sites do this. I.e. it is legal to do this without consent (if this is not the case, I am pretty sure the outcry had been heard all over the Internet by now).
Yes, since you default to no consent, ergo consent would have to be positive. It's rather unsatisfactory though as a sort of double-negative, and needs careful wording to make sure consent is informed. However, this may be a technical problem as it seems odd that you can't have an unchecked checkbox. Does the word 'checked' perhaps appear in the HTML? https://ux.mailchimp.com/patterns/forms#radio
You could establish your own server which calls the API and maintains a counter, and have al your applications call that server, the server call the API, and the server can also return a count to the application, or even return a failure code if the count is too high. As for when the count turns over, a few days experiment should establish that, but given that the API is based in the EU, I would guess it turns over at midnight UTC (aka Greenwich mean time), but of course that is only a guess. Has the API management declined even to tell when the count rolls over? That seems odd. As to the legal obligations of the API management, it would be good practice for them to have the API return a count, but I don't see that they can be required to do that. I don't know of (and could not find) any law which mandates such a count. I do think that they should inform you of the time of day at which they roll the count over. I have not yet found a law which specifically requires this.
I realize it has been eight months, but I believe I can offer an opinion. Given the nature of the question, please keep in mind that I am not a lawyer and my opinion is no substitute for professional legal counsel. [Preparing this post has been an educational experience and my opinion should in no way be interpreted as expert opinion] Assuming you have not infringed on any patents, the relevant legal challenges Valve could try include breach of contract, copyright infringement, and trade dress infringement. Breach of Contract The potential breach of contract occurs because the Steam client setup application requires you to accept a contract of adhesion (The License) before the software can be installed. I could not find a copy of The License online in plain text (this is separate from the Steam Subscriber Agreement, which you also agree to by accepting The License), but you can read it any time by running the Steam client setup application which is available at [redacted due to low rep - the Steam website]. These so-called "shrink wrap licenses" are of questionable legal value, depending on how the licensee assents to the contract. People often bring up Specht v. Netscape Communications Corp. In that case, the only reference to a license was on the download webpage, and it was only visible if the user scrolled down past the download button - Netscape argued unsuccessfully that clicking the download button indicated assent to the terms of the license. The Steam client setup application has a prominent dialogue box showing the terms of The License and requiring your explicit assent before installation can continue. A more relevant case may be ProCD, Inc. v. Zeidenberg, where the Seventh Circuit ruled that a license agreement was valid where the licensee had to click on a dialogue box assenting acceptance to the agreement. In short, you may be required to defend yourself under the terms of The License. If the licenses are thrown out as unenforceable, the prosecution would probably move towards copyright infringement. Section 1 Paragraph C of The License states (emphasis added): Except as expressly set forth elsewhere in this License Agreement, you may not, in whole or in part: copy, photocopy, reproduce, translate, reverse engineer (with the exception of specific circumstances where such act is permitted by law), derive source code from, modify, disassemble, decompile, or create derivative works based on the Program. Now you assert that there has been no reverse engineering, that you made yours "completely from scratch using completely different styling and images (even different website inside the client that is mine)". You may be challenged on these claims in court, for example comparison of source codes could rule out reverse engineering. I will touch on derivative work status later. Note that under Section 5, the provisions of Section 1 Paragraph C do not apply after you have uninstalled the Steam client software. This means in the case that you [can prove you had] uninstalled the Steam client software before making your own client, you would have a defense to breach of contract under Section 1 Paragraph C. However... The License also includes the terms of the "Steam Agreement", viewable online at http://www.steampowered.com/agreement. The Steam Agreement takes effect when you register for your Steam account. Section 2 Paragraph G of the Steam Agreement echoes the above referenced Section 1 Paragraph C of The License, and even survives termination of the Steam Agreement (your steam account being cancelled). Now assuming you can provide defense against reverse engineering, you may need a defense against the charge that your work is a derivative work. Your case may be pretty strong if you can show that your client was indeed written from the ground up - which rules out the possibility of deriving your program code from Steam's code as literary copyrights go. The prosecution could try saying you have copied the audiovisuals of their program, but your program was written "from scratch using completely different styling and images". Eventually prosecution may have to move into trade dress infringement. Copyright Infringement In a case of alleged copyright infringement, the first order of business is to prove there is a copyrighted work to begin with. The work in question is the Steam client by Valve Corporation. Again, I am not an expert but I could not find any copyright registration for the Steam client (http://www.copyright.gov/records/ -> Post-1978 Records -> Search by Name "Valve Corporation"). Copyright registration is required before infringement suits can be filed. Valve can register after infringement occurs but they will be limited to actual damages and profits. Nevertheless Valve does claim copyright over its product. A notice is posted on The License and Steam Agreement, and from the client itself the Help menu contains a command "Legal Info" which opens a webpage containing a copyright notice. Since 1979 it has not been necessary to post a copyright notice, but a notice helps break a defense of innocent infringement. You imply that you copied elements of the Steam client "to give customers a similar feel to what they are used to [the Steam client]". In your specific case innocent infringement may not be a valid defense. It seems you are most concerned about copyright infringement over the menus. An extremely relevant case is Lotus Development Corp. v. Borland International, Inc. In that case the First Circuit held that the menu heirarchy for Lotus 1-2-3 (the progenitor of virtually all menu heirarchies today) was uncopyrightable as a "method of operation" under U.S.C. 17 Section 102(b). We think that "method of operation," as that term is used in [U.S.C. 17 Section] 102(b), refers to the means by which a person operates something, whether it be a car, a food processor, or a computer. Thus a text describing how to operate something would not extend copyright protection to the method of operation itself; other people would be free to employ that method and to describe it in their own words. Similarly, if a new method of operation is used rather than described, other people would still be free to employ or describe that method. We hold that the Lotus menu command hierarchy is an uncopyrightable "method of operation." The Lotus menu command hierarchy provides the means by which users control and operate Lotus 1-2-3. If users wish to copy material, for example, they use the "Copy" command. If users wish to print material, they use the "Print" command. Users must use the command terms to tell the computer what to do. Without the menu command hierarchy, users would not be able to access and control, or indeed make use of, Lotus 1-2-3's functional capabilities. If specific words are essential to operating something, then they are part of a "method of operation" and, as such, are unprotectable. This is so whether they must be highlighted, typed in, or even spoken, as computer programs no doubt will soon be controlled by spoken words. The Supreme Court affirmed the decision with an even court (Judge Stevens recusing), so no national precedent was set. Nevertheless the ruling has not been overturned - the First Circuit goes into great detail explaining their decision, and I do recommend reading the ruling. We have already discussed derivative works and reverse engineering with contracts, and the same defense would apply under copyright law: source code comparison. Trade Dress Normally things like design and layout are left to patent law. A desperate prosecution, however, may claim that by copying their "look and feel" you infringe on their trade dress. The relevant text is part of U.S.C. 15 Section 1125(a) (emphasis added): (1) Any person who, on or in connection with any goods or services, or any container for goods, uses in commerce any word, term, name, symbol, or device, or any combination thereof, or any false designation of origin, false or misleading description of fact, or false or misleading representation of fact, which- (A) is likely to cause confusion, or to cause mistake, or to deceive as to the affiliation, connection, or association of such person with another person, or as to the origin, sponsorship, or approval of his or her goods, services, or commercial activities by another person, or (B) in commercial advertising or promotion, misrepresents the nature, characteristics, qualities, or geographic origin of his or her or another person's goods, services, or commercial activities, shall be liable in a civil action by any person who believes that he or she is or is likely to be damaged by such act. (2) As used in this subsection, the term "any person" includes any State, instrumentality of a State or employee of a State or instrumentality of a State acting in his or her official capacity. Any State, and any such instrumentality, officer, or employee, shall be subject to the provisions of this chapter in the same manner and to the same extent as any nongovernmental entity. (3) In a civil action for trade dress infringement under this chapter for trade dress not registered on the principal register, the person who asserts trade dress protection has the burden of proving that the matter sought to be protected is not functional. Defense against such a claim would be showing that the elements of Steam's "look and feel" were adapted because of functional reasons - see example rationale in the previously mentioned Lotus v. Borland. Overall, so long as you did write the program from scratch and there are no patent violations, you have in my opinion a strong case. There may be moral questions about unfair competition (why should you be allowed to capitalize off Valve's work put into the Steam client?), to which I would point out that your product does not appear to be in direct competition with the Steam client. Without direct competition or confidence in evidence of IP infringement it is quite unlikely Valve will file suit against you. If you would rather avoid even the possibility of legal action, you could always contact Valve directly and ask for a license.
I live in the EU and Facebook has blocked access to my account unless I accept their privacy rules, which means giving up GDPR protections. Facebook operates in the EU and has EU data subjects, therefore Facebook is subject to GDPR. You should be able to withdraw your consent. Article 7(3) says: The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.