Using student directory photos Would it be legal for me to download all of the student images that appear in my university's directory and post them on a website? The Family Educational Rights and Privacy Act (FERPA) protects students' education records such that an institution may only release information found in a student's records with permission of the student. However, the one exception is directory information; institutions are free to release a student's directory information unless the student explicitly restricts its access. Since the university has given me access to the directory information some of its students, doesn't that imply that these students have not restricted access to their information and that I may freely partake?
As someone who is not a lawyer, but is familiar with FERPA and university policies as a former instructor, I would be more than willing to bet that you signed or otherwise agreed to some type of Terms of Service before being given access to that type of service. There are almost certainly numerous things you signed to become a student, as well as various policies you agreed to in first gaining access to the computer services, which would apply here. I can tell you with certainty that the school where I was a student had a policy that I agreed to that they would make certain information available to other students unless I chose for it to be restricted. However, my university did not have any photos of students that were viewable by other students in a directory. That said, there were also times I participated in extra-curricular activities where I was required to sign release forms giving the school the rights to video tape, record, and photograph me, and to do what they wished with those things. So, with that in mind, I suspect that's partly due to FERPA restrictions, but also largely due to their own privacy policies that go beyond what FERPA requires. All in all, I doubt they would be okay with you using their photos for your own private use - student privacy is something that is taken very seriously.
You are asking the wrong question. It should be: When you have downloaded the content and metadata, what are you allowed to do with it and what is forbidden? Somebody owns the copyright to the text and images in the thumbnail. This could be the operator of the third party website, or that site has licensed the content from yet another party. You haven't licensed it from anybody. So you can watch the content in accordance with the TOS, and your computer can evaluate the metadata to do it, but you cannot display it on your own site. Details will differ between jurisdictions, of course. You might also be held responsible for illegal content in the thumb you generate. Follow-up: There seems to be some question of what 'thumbnail' and 'card' mean in this context. This answer assumes a somewhat scaled-down representation of the content of the entire page, not just a collection of actual metadata like content length and expiry.
Neither the GDPR, nor the CCPA, nor any other data protection law that I am aware of, requires that when information is deleted on request, that similar information not be collected and stored in future. Under the GDPR Article 6 there would have to be a lawful basis for any processing, including storage, assuming that the GDPR applies to the directory in question. There could be a claim that such processing was lawful under article 6(e) &quot;performance of a task carried out in the public interest&quot;. I do not know if any such claim has been adjudicated. Thus there is no need to hold a database of previously erased records to determine if a new record should be blocked as &quot;previously deleted&quot;. The Wikimedia Foundation, which runs Wikipedia, I believe takes the position that the GDPR does not apply to Wikipedia, I am not sure of their detailed arguments. But surely articles on well-known people, such as a former US president, would be covered under the same provisions as would cover news reports and historical books about such a person. Perhaps that would also come under article 6(e)
This issue touches upon two distinct GDPR rights: Art 15 right to access: you have a right to receive a copy of all personal data concerning you that are undergoing processing (including storage). Access may only be denied where this would “adversely affect the rights and freedoms of others.” Art 20 right to data portability: if processing is being carried out by automated means, and processing is based on certain legal bases (consent or contract, but not legitimate interest), then you have a right to receive a copy of your personal data in a machine-readable format, for personal data that you have provided to the data controller. Whereas the right to access is fairly straightforward, the right to data portability applies under much more narrow conditions. Basically, it's a right that you can download any data that you've uploaded so that you can move to a different service. Google Takeout is primarily concerned with your right to data portability, and provides your data in a machine-readable format. Any photos that you've uploaded to Google Photos, you'll be able to download. Thus, it could be technically compliant to exclude information that they've inferred about your personal data, such as image-recognition results. Such results would still be personal data under the GDPR definition of the consent, and would be covered by your right to access. Google might argue that you already have access to this data through the web interface. In my opinion the GDPR clearly requires the data controller to provide a “copy”, i.e. the data in some durable form – not merely access through a web interface. Whereas your question is specifically about Google, the same issue applies to other services as well. E.g. Ruben Verborgh has an interesting blog series on trying to get access to all their data from Facebook, though unsuccessful so far. Similar to your scenario, Facebook offers a download for personal data but does not include all personal data in this download. In one of the documents provided by Facebook in the course of the exchange, they note that they allow access to photo tags through the web interface, but do not include this in downloaded data – without providing further justification.
It Depends If the person reusing the image (lets call that person R for reuser) is not complying with the terms of the Creative commons license, which include a requirement to provide attribution of the source work, then R cannot rely on the license, and the granting of the license ad the presence of a license declaration is legally irrelevant. R must have some other basis to reuse the image. This could be an exception to copyright, such as fair use or fair dealing. Or possibly the image is not protected by copyright, for example because its copyright has expired, or because it is a work of the US Federal Government being used in the US. In the absence of such a basis, R is infringing copyright. In much of the world copyright now lasts for 70 years after the death of the author (or of all co-authors). In some different terms apply, ranging from life+50 to life+100. Sound recordings and photos get shorter terms in some countries. In the US the term is life+70 for recent works, but for work created and published before 1978 more complex rules apply, depending on the date of publication, and whether laws on notice and renewal were complied with. See the well-known chart Copyright Term and the Public Domain for the various cases and when copyright expires in each case. The question asks about fair use. This is a US-specific legal concept. It is designed to be flexible, an is highly fact-dependent. As a result it is rarely possible to say if a use will qualify as a fair use with certainty until a court passes on it. See Is this copyright infringement? Is it fair use? What if I don&#39;t make any money off it? for more on fair use. Not providing attribution is itself often considered to weigh against fair use. The question does not give enough detail to make even a good guess as to whether such a use is likely to be held to be fair use. Identifying the kind of eagle has some educational value, which might favor fair use to some extent, but must be considered in light of the overall purpose of the use, which is not described. There is no indication as to whether the original work is creative or factual, or whether the reuse would be likely to harm the market for the original. Much use of images on social media does not stand up under a fair use analysis. Providing proper attribution might well help any fair use claim. See also Do you have to give attribution if an image falls under Creative Commons?
I assume these are digital photos that were electronically transferred (not prints physically delivered). If they were prints physically delivered, he owns those prints, since you used to own them but you unconditionally transferred ownership to him by giving them. No backsies under the law. The photos are protected by copyright law, which means that the person who took the pictures has the exclusive right to make copies, disseminate them, and authorize making copies. In order for anyone to make a copy, they need permission – a license – from you. In the world of pre-planned business deals, the copyright holder writes up a document granting B some right to use the protected material, which typically means "you can install it on your various devices but may not give copies to others". In this case, however, you didn't create an explicit written license. So if this ends up in court, the question is what implicit license you granted. The courts will not decide that you granted him the license to unrestrictedly sell or give away copies of the protected material. The most likely outcome would be that he can only keep his copy, i.e. he will not be forced to erase the copy that you sent him. What the courts would do is try to discern what license you most likely intended to grant to him. There is a provision in copyright law that allows a licensee to make backup copies of a computer program (17 USC 117), but a digital photo is not a computer program. So the lifespan of the copy that you sent would be the lifespan of the phone (I assume) that you sent it to. Since actually using a digital photo technically requires making a copy (from disk storage to computational memory), there is a legal direction (dead-end) that you could go where the photo could exist on the phone, but never be opened again. Again, the courts would have to discern what license you probably intended w.r.t. ever opening the photo – obviously you intended that the file could be opened / viewed any number of times. You could argue that the license which you granted was conditional, i.e. "you can have and use these pictures as long as we are a thing", but establishing that this was part of the license would be tricky. Free digital content often has some "as long as" condition attached to it, i.e. "you can use this program as long as you are affiliated with University of Whatever". I don't consider a conditional license to be a ridiculous interpretation, on the other hand the particular court (judge) might decide that people who sext should be forced to live with the unpleasant consequences of their decisions. If we exclude such a line of thinking, I don't see a compelling counter-argument that your ex-partner inequitably loses a right by construing the license as conditional. I don't know if there is any case law that addresses this: at any rate, copyright law would severely limit what he could do with the pictures (the tort "invasion of privacy" also limits dissemination).
There are two scenarios to consider. One is that there is such a policy written down and duly communicated in some fashion. In that case, it is obviously "okay" in all senses to enforce that policy. (That does not preclude the possibility of suing the institution because they are abridging some right of yours in having this policy, but that's a separate matter). The alternative is that there is no such policy, and someone spoke incorrectly. If that is the case, then they "can't" enforce a non-existent policy. Actually, they can prevent you from using the facility, the question is, how could you correct their misunderstanding of their policy? The most protracted way to resolve this is to file a lawsuit against the university, for denying some right (constitutional or property). A more efficient way to do that is to bring the matter to the attention of a reasonably high-ranked official within the institution, perhaps the department chair, who may not be aware that subordinates are making up or misinterpreting rules. The fact that you were unable to locate a written statement of policy online really doesn't count for much. It is entirely reasonable to believe that the chair may have instituted such a policy, under his authority as chair, and communicated it verbally to subordinates: or, the subordinates simply do not know where to find the policies. An alternative approach is to raise the question with the Student Advocate's office, if discussion with the chair is unsatisfactory.
Corrections to your statements or quotations Your quotation "To fall within the remit of the GDPR, the processing has to be part of an "enterprise" (...)" is not from the GDPR, and is an erroneous statement. Also, the threshold of 250 employees you refer to, is only relevant with regards to the record-keeping obligations of Article 30. GDPR provisions relevant to your question The GDPR applies to individuals or students in accordance with the material scope of the GDPR, which is treated in Article 2 (2) c) where GDPR states that "This Regulation does not apply to the processing of personal data: (...) by a natural person in the course of a purely personal or household activity;" The Recital 18 of the GDPR gives some insight as to what would be a purely personal or household activity as follows: (18) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities. Interpretation To my knowledge, there are no specific guidelines regarding this matter to date from WP29. Those may be adopted in the future, or some requirements may already exist in local laws in one of the EU countries or from documentation available from local data protection authorities. If you are based in the EU, you could check this with your local data protection authority. There is, however, case law from the European Court of Justice as pointed out by Free Radical, interpreting the scope of the "personal use exception" in Directive 95/46/EC (which provisions are similar to the GDPR in this matter). If your hobby is not limited to your personal circle (yourself and the persons in your household), and thus if you plan to share the results of your data collection and processing with third parties (possibly teachers, other fellow students, or anybody else if you publish the results of your work) resulting from your "hobby" activity, you certainly would not fall in this exception to the scope. Case C-101/01 is an example of publication on the Internet made by an individual claiming to use its "freedom of expression to create internet pages in the course of a non-profit-making or leisure activity". The court clarified that: exception must (...) be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people Another, less optimistic interpretation from the examples given by the GDPR recitals, could derive from the spirit in which purely personal or household activity are to be understood. These examples actually refer to limited amounts of data and which are related to the individual itself (his own address book, his social networking activity, etc.), and creating limited risks relevant to the person herself and its contacts. In this view, there is a risk that a "hobby" in which you collect data about thousands of persons unrelated to you, could be considered as not being really purely personal. Actually, an interpretation of case law C-212/13 from the European Court of Justice also mentioned by Free Radical could support this reasoning. In this case, a video recording of people was stored from cameras installed by an individual on his family home for its own security purposes, but the cameras were also monitoring a public space. The court ruled that: To the extent that video surveillance such as that at issue in the main proceedings covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity (...) Extending this reasoning to your question, a "hobby" consisting of collecting "huge list of names, emails, zipcodes" unrelated to you could be regarded as "directed outwards from the private setting (...)". Conclusion As a hobbyist, or a student, if you can work on fake computer generated data and achieve the same results in your personal learning purposes you should definitely consider doing so.