Is it legal to collect reviews/ratings about specific profession people from and show it on website? There are websites which show reviews, ratings, scores about companies (restaurants, hotels, etc.). Is it legal to show specific employee/service provider/professional like doctor or other profession full name and reviews about him publicly - does it need permission? What about GDPR, right to be forgotten and other legal considerations?
That's an old idea that has been tried several times before (such as the first, being Unvarnished: Website Lets You Review People (And Trash Them) | HuffPost, which no longer exists); and one of the latest incarnations is Peeple (mobile application - Wikipedia). There are lots of legal liabilities, including defamation and harassment/stalking, even with the Section 230 of the Communications Decency Act | Electronic Frontier Foundation which (mostly) protects the website owner from others' speech posted on the site (your mileage may vary due to jurisdiction). The only way such a site would survive is to do what Peeple and other sites have done: greatly limit the speech allowed, such as limiting to only positive reviews, giving the subject complete control over what does appear on their profile, only allowing "opt-in" profiles, verify identities, etc. You would have to implement full GDPR compliance; but various lawsuits will either shut you down before you get far enough to launch or soon after and force you to greatly limit the scope of the site. Most lawyers would advise you to find something else to do with your time and money.
The GDPR does not prescribe how exactly consent must be managed, as long as consent was obtained in line with the GDPR's principles. Similarly, the EDPB does not provide concrete recommendations in its guidelines on consent, mainly noting that Controllers are free to develop methods to comply with this provision in a way that is fitting in their daily operations. I would not be too concerned with edge cases like failing HTTP requests, at least not any more than for other HTTP endpoints. If the user indicated consent, and you act on that indication of consent in good faith, that's probably fine. However, remember that you must provide a equally easy way for the user to revoke consent later. If the user changes their mind, they can use the mechanism that you offer to inspect their consent status, and revoke it if they want. But again, how to do that is largely up to you.
Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR? Only if they offer goods/services to or monitor behavior of people in the EU (Art. 3(2)). Note that: having a commerce-oriented website that is accessible to EU residents does not by itself constitute offering goods or services in the EU. Rather, a business must show intent to draw EU customers, for example, by using a local language or currency. If it is then how (and by whom) would compliance be audited and/or enforced? Supervisory Authorities will care of it.
The people on the show would be considered public figures, so if there was information that the fictitious writing was actually based on/about them, defamation must be proven to a different standard for public figures. Public figures, including officeholders and candidates, actors or musicians successful enough to be held in "the public eye," have to show that the defamation was made with malicious intent, which is a greater burden than defamation for the average person. Also, damages may be limited to actual (special) damages unless there is actual malice. Special damages being lost income or some other quantifiable measure of loss. If one cannot tell who it (the fictional story) is about because the name is changed, then Fox, or whomever, couldn't sue anyway because they need standing, which they wouldn't have if you called the person X, unless the story was so exact that it is obvious who you are talking about. For instance, the show Law and Order is often based on famous stories in the news, or criminal cases they dig up. Those fictional story lines often add or delete details. The case may be more or less damaging to the actual person it was based on. However, they make a statement before the show airs that says something like "Any similarity to real people or events is strictly coincidental. This show is not based on any real person or event, but is a work of fiction." If I were going to make a fictional account of a big network show, I would use some sort of disclosure like that to be safe. That said, if the statements or storyline is less damaging than the facts themselves, as revealed on the show, it isn't defamatory at all: Defamation necessarily must include the act of making untrue statements about another that damage their reputation. If it doesn't damage their "good character or reputation," than it's not defamatory. Keep in mind, however, that what you may consider less or more damaging may not be the same view held by the person it's loosely based on. That is why I'd use the disclosure. As to the question "would it protect you against a lawsuit?", if you mean would it protect you from being sued, the answer is always, anyone can sue file a lawsuit. That doesn't mean they'll win but it still means you have to defend. It may likely protect you in your defense.
Yes. It is legal for them to do so. Also, they are often required, by their insurers and lawyers, if not as a matter of law, to maintain them for seven years in most cases, so that the information is available if a lawsuit arises from any of their dealings with you (e.g. if they receive notice of a lawsuit involving a Zipcar you were allegedly using or had under your control at the time of an accident, or if there is a class action lawsuit over alleged breach of contract or consumer laws involving their charges to you). There are virtually no circumstances, with the possible exception of certain credit card account information, when someone has a duty to destroy records maintained about you under U.S. law. In this particular instance, everything on your driver's license is a matter of public record in any case, so your privacy interest is reduced for this reason as well.
In the United States, the main statute governing the use of health care information is HIPAA, the Health Insurance Portability and Accountability Act. HIPAA and its related statutes and regulations detail what you can and can't do with medical information. You can't always collect it; if you do, you can't always share it, and you can't always delete it. This is a complex field of law and it's easy to screw up in a way that would cause big, serious, company-destroying, job-ending problems for everyone involved. To put this another way: this is absolutely, positively, not something you want to get advice on from strangers on the internet. You don't just need a lawyer; you need a HIPAA specialist--or the equivalent in whatever other countries you plan to operate in--before you push anything out to real-life patients, especially children.
You are responsible for what data is being processed by your website. When you embed third party components on your website (e.g. iframes, scripts), you are at least jointly responsible with the third party providing these components. You are only responsible for what happens on the website (i.e. what processing is under your control), not for what the third party provider does with collected data on their services. However, note that information will be transferred to Google's servers regardless of whether the visitor has a Google account! The Fashion ID case is relevant case law establishing and explaining these points. Since you are (jointly) responsible, you need a legal basis for collecting personal data through the tracking snippet and sharing it with the third party (here Google). For example, the legal basis could be a legitimate interest, or could be consent. A legitimate interest requires that you balance this interests against the interests, rights, and freedoms of the data subject (the site visitor). If the data subject wouldn't reasonably expect this tracking, you cannot rely on a legitimate interest. Consent can always work, except that it is a freely given, informed opt-in – likely unsuitable for conversion tracking. Which legal basis to use is primarily your responsibility. You argue that the tracking snippet does not collect personal data. However, this argument is not well supported. Under the GDPR, personal data does not only include directly identifying information such as an email address, but also any information “relating” to an identifiable person. Identification includes the ability to single out someone, e.g. by a browser fingerprint. For purposes of conversion tracking, Google will clearly try to collect data that allows the visitor to be singled out, thus collecting personal data. Furthermore, specific kinds of information are regulated by the ePrivacy directive. This includes “traffic data” and “information stored on a terminal device”, regardless of whether this information is personal data under the GDPR. Under ePrivacy, such information can only be used as strictly necessary to provide the service requested by the user (and conversion tracking is not strictly necessary), or when the user gives their consent. Depending on what information is collected by the tracking snippet and on whether you are subject to ePrivacy, you would have to collect consent anyway. There is also the issue that Google Ads is an US-based service, and transferring data to the US is largely illegal since the 2020 Schrems II ruling. The US do not provide an adequate level of data protection, so that transfers would require additional safeguards. Standard Contractual Clauses (SCCs) for Controller to Controller transfers are not sufficient by itself. Of course those extra safeguards are effectively impossible to implement and no one is doing this correctly, but it's worth considering that there is additional legal risk. Explicit consent can provide a legal basis for transfers even to a country with inadequate protections, but that mechanism is intended for occasional transfers. In conclusion: you have wrongly concluded that no personal data would be involved you are jointly responsible with Google for whatever data is processed by the conversion tracking snippet you need a legal basis for sharing this data with Google legitimate interest may be sufficient, depending on what data is involved (consider ePrivacy) and depending on the result of your legitimate interest balancing test alternatively, you may require every visitors consent to track their conversions – unlikely to result in good data additionally, such use of Google Ads may run into issues around international transfers due to the Schrems II ruling this kind of stuff is difficult, and no one is really doing this correctly :/
That is a very broad clause, broader than the default US rule for copyright, for example. (I know the question asked about the UK, I just happen to know the US copyright rule.) It would seem on the face of it to include independent research on a subject totally unrelated to the person's employment, done off the company's premises and not during normal work hours, but while the person was an employee.. Indeed it would arguably include the copyright to a novel written off premises and during off hours. Use of "course of employment" (instead of "term") would improve the provision. so would "as a part of his or her employment" or "closely related to the subject of his or her employment". Another possible restriction would be "Using the Company's facilities and/or equipment, or during normal working hours". However, my experience is that an employer will have drafted whatever language it uses through its company lawyer, and will be quite unwilling to alter it in any way. A prospective employee will probably be faced with a take-it-or-leave-it choice unless that person is a nearly indispensable figure to the company. One could send the company a certified letter saying, "When i signed the contract agreeing to {company language} I did not intend to include any developments made off company premises, not using company equipment, and unrelated to the subject or scope of my employment. I retain full rights to any such developments." Such a letter would help establish that there was no meeting of the minds to assign such non-employment-related developments or IP to the Company. How much weight it would have if the rights to such developments were the subject of a court case I am not sure.