Why is the Privacy Act called the Privacy Act? The American Privacy Act allows subjects to access copies of records held on them by US government agencies. But what does it have to do with privacy?
what does it have to do with privacy? This can be explained by reference to the full title of the Privacy Act 1974 (as amended): An Act to amend title 5, United States Code, by adding a section 552a, to safeguard individual privacy from the misuse of Federal records, to provide that individuals be granted access to records concerning them which are maintained by Federal agencies, to establish a Privacy Protection Study Commission, and for other purposes. (my emboldenment)
The DOJ has a handy FAQ about declassification on their site. There are statutory and E.O. provisions for automatic declassification of information (I think the most common one in practice is &quot;historically important information after 25 years&quot;). Though this is subject to review and may be rejected in particular situations, dictated by much the same provisions. As for reclassifying automatically declassified information, the FAQ says: CAN INFORMATION THAT HAS BEEN AUTOMATICALLY DECLASSIFIED BE RECLASSIFIED? Yes. Information that has not previously been disclosed to the public under proper authority may be classified or reclassified after an agency has received a request for it under the FOIA, Presidential Records Act, 44 USC 2204(c)(1), the Privacy Act of 1974, or the mandatory review provisions of E.O. 13526, only if such classification or reclassification meets the requirements of E.O. 13526, and is accomplished on a document-by-document basis with the personal participation or under the direction of the agency head, the deputy agency head, or the senior agency official. Information may not be reclassified after declassification and release to the public under proper authority. Similar provisions were detailed in E.O. 12958. A &quot;proper authority&quot; would not include, say, leaks, like those due to Snowden. Note that, as for Trump's situation, while he most surely counted as a &quot;proper authority&quot; while President, there is no indication whatsoever that the information was also released to the public under his or any other proper authority. A recent and somewhat controversial example of reclassification began in 1999 under the Clinton administration, as a result of aforementioned E.O. 12958, and lasted for several years after. To justify their reclassification program, officials at CIA and military agencies have argued that during the implementation of Executive Order 12958, President Clinton's program for bulk declassification of historical federal records, many sensitive intelligence-related documents that remained classified were inadvertently released at NARA, especially in State Department files. Even though researchers had been combing through and copying documents from those collections for years, CIA and other agencies compelled NARA to grant them access to the open files so they could reclassify documents. A separate article from the same link provides: ...security officials at DOE had become concerned that the implementation of EO 12958 had led to the inadvertent release in State Department and other agency records at NARA of &quot;unmarked&quot; restricted and formerly restricted data on nuclear weapons. In the fall of 1998, Congress formally authorized the Department of Energy to remove from public document repositories any and all sensitive nuclear weapons design-related information pursuant to Section 3161 of the National Defense Authorization Act for Fiscal Year 1999, entitled &quot;Protection Against Inadvertent Release of Restricted Data and Formerly Restricted Data.&quot; The argument the agencies seemed to advance for this reclassification is that prior declassifications had not undergone the proper equity considerations: meaning that agencies other than the ones who declassified them had an interest and say in their classification, which should not have been overlooked. While some complained about the reclassification of information that had entered the public domain—the material had been on the public shelves for years, and some of it had even been published and a good deal more of it sifted through by various parties—this did not seem to matter to the agencies. Much as classified information leaked by Snowden or anyone else remains classified, the information becoming common/public knowledge does not necessarily automatically affect its classification status, or ability to be (re)classified.
Neither the GDPR, nor the CCPA, nor any other data protection law that I am aware of, requires that when information is deleted on request, that similar information not be collected and stored in future. Under the GDPR Article 6 there would have to be a lawful basis for any processing, including storage, assuming that the GDPR applies to the directory in question. There could be a claim that such processing was lawful under article 6(e) &quot;performance of a task carried out in the public interest&quot;. I do not know if any such claim has been adjudicated. Thus there is no need to hold a database of previously erased records to determine if a new record should be blocked as &quot;previously deleted&quot;. The Wikimedia Foundation, which runs Wikipedia, I believe takes the position that the GDPR does not apply to Wikipedia, I am not sure of their detailed arguments. But surely articles on well-known people, such as a former US president, would be covered under the same provisions as would cover news reports and historical books about such a person. Perhaps that would also come under article 6(e)
I presume you are addressing the various wiretapping laws. In all of those channels, one would have a reasonable expectation of privacy, in contrast to using CB radio or a megaphone. However the context of using the instrument affects that expectation, for example if your phone is on speaker you do not have a reasonable expectation that those around you cannot hear your conversation, when there are others around you. Also, there is no expectation of privacy surrounding employers monitoring employee emails for valid business purposes – but the federal government can't intercept your emails (without a warrant) just because you are using business email. The expectation of privacy is really about the surrounding circumstance, not the instrument you use.
IANAL, But the information commissioners office (UK) describe personal data as: (bolding mine) The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/ So I would say that in your case it is personal information. In principle, regardless of if you can identify an individual, personal data is that which can be used to potentially identify an individual. For an extreme example of why this is important: Lets say your app sells AIDs medication. Can a hacker who got in and stole your database, be able to use that with information they stole elsewhere to identify people with AIDs and blackmail them, in a way that they wouldn't if you had not stored this identifier? Plus, if you want to err on the side of caution, there's no legal penalty for telling the user about non-personal information you store.
It's not illegal to ask. Whether they can give it to you, and under what circumstances, is another, much more complicated matter. For instance, if the database contains health information covered by HIPAA in the United States, or personal information covered by laws like GDPR or CCPA, the customer's ability to share the database may be restricted, either requiring additional confidentiality obligations/use restrictions, or preventing sharing entirely.
It is neither legal nor illegal, but would depend on the circumstances. For example, such use of a smart assistant might be perfectly fine if the childcare provider could demonstrate a legitimate interest for using the smart assistant, and gave reasonable notice about audio being recorded. Parental permission is likely not necessary. In practice, doing this right would be far too much effort. For example: Has the necessary information per GDPR Art 13 been provided, taking into account the EDPB guidelines on transparency? Under what legal basis are conversations sent to Amazon, an US-based provider, taking into account the Schrems II ruling? How will data subject rights be satisfied, in particular the right to access to these recordings, the right to erasure, and the right to object to further processing? Having discovered such processing of personal data that isn't necessarily kosher, a parent/guardian might start by objecting (GDPR Art 21) to further processing. This could be satisfied by powering off the Alexa devices in all rooms where the child is expected to be. The childcare should respond within one month. If no satisfactory response has been received, one option would be to lodge a complain with the supervisory authority, which would be the ICO in the UK.
GDPR rights and obligations cover different things: A duty of the data processor towards the government of the country where they operate to present certain documentation, and to implement technical and organizational measures to protect data. These would be audited by government agencies, not the individual customer. A single data subject cannot waive them. A duty of the data processor to process and store personal data only with a legal justification. User consent is one possible justification, if it is informed, revokable, etc. So a single data subject can waive a &quot;ban&quot; on storing his or her data in a database along with all the other users who waived that &quot;ban,&quot; but the duties towards the government regarding that data would still apply. A duty of the data processor to respond to an Article 15 request by the data subject in a certain way and timeframe. If a data subject writes a letter to the data processor and explicitly states that the letter is not an Article 15 request, then Article 15 does not apply. The data subject would of course have the right to make an Article 15 request at a later time.