What did Flybe actually do wrong? Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc. They sent an email to this list of unknown users to determine just that, but they were later given a penalty for spamming (£70K). It is only fair to say that they did this because of the impending changes with the new GDPR rules. If this was a genuine attempt to ensure that the company remain within the remains of the law/GDPR rules, how else could they have gone about this? If we are talking millions of rows of user data that could bring in a large amount of business, would it have been better for them to dispose of this? I also wonder if a much larger company, e.g. Some big pharma company, did the same. Would they suffer the same sort of penalty?
Given a large database of email addresses that you can't prove have given consent to receive email, the only legal thing to do with it, is to (securely) delete it. (I am going to switch your question about a larger company to a bank: in the UK, big pharma is forbidden from advertising to individuals.) In principle the rules are the same for a huge bank and everything down to a self-employed plumber. In practice the plumber will be told "don't do that again" rather than fined. This case was treated under the Data Protection Act, which has a maximum fine of £500,000&nbsp;&ndash; so a big bank would probably have been fined more, but not necessarily much more. Under GDPR, fines are related to turnover, so the fine would be a lot bigger for a large bank. The incident is a year old now. Details here.
In the UK it is an offence to cause a computer to gain unauthorised access to any program or data held in any computer (s1 Computer Misuse Act 1990). It seems likely that other European jurisdictions have similar laws. Certainly Germany does: Penal Code 202a data espionage (German text - English translation). (I mention Germany because the linked thread does.) It might constitute theft in the jurisdiction if the finder did not take reasonable steps to find the owner - which may include informing the police of the find. Depending on the jurisdiction it might count as 'treasure' or abandoned property such that the finder is obliged to inform the authorities (the jurisdiction has the presumption of ownership of abandoned or lost property - e.g. Scotland), which then decide what to do with it. Legally speaking it seems to me that, to declare it legal, we have to get over such hurdles. [edit] There seems to be some dispute in the comments that cryptocurrency is subject to any regulation, counts as property, is something of value or is something that is owned and can be stolen, such that the person in the questioner's scenario could be held to account under the law for his behaviour. Aren't they merely numbers? No - plainly they do have value because people trade them with currency and goods and services. The UK's tax authority, HMRC, "does not consider cryptoassets to be currency or money" but sees them as having economic value because "they can be 'turned to account' - for example, exchanging them for goods, services, fiat currency (that is money declared by a government to be legal tender) or other tokens". They are "a new type of intangible asset". Individuals are liable "to pay UK tax if they are a UK resident and carry out a transaction with their tokens which is subject to UK tax". They are liable for "Income Tax and National Insurance contributions on cryptoassets which they receive from their employer as a form of non-cash payment [or from] mining, transaction confirmation or airdrops." (HMRC cryptoassets for individuals) Are they property? Something that can be owned, something that can be dishonestly appropriate (i.e. stolen)? That's the interesting dispute. Recently, the High Court of England and Wales ruled in a bitcoin ransomware-related case that "for the purpose of granting an interim injunction in the form of an interim proprietary injunction ... crypto currencies are a form of property capable of being the subject of a proprietary injunction". In that judgment there is some discussion of the authorities for considering or deciding they are property. ([2019] EWHC 3556 (Comm)) read from para 50 if not the whole judgment. In at least two other cryptocurrency-related cases the High Court treated the cryptocurrency as property. Vorotyntseva v Money-4 Limited, trading as Nebeus.com [2018] EWHC 2598 (Ch) and Liam David Robertson v Persons Unknown 2019. There was also a suggestion in the comments that the police would not understand and would not be interested. But there are several jurisdictions where people have been investigated, arrested, prosecuted and convicted of crimes relating to cryptocurrencies. A simple internet search for bitcoin theft, fraud or money laundering will result in some reports. In any case their interest or lack of it is irrelevant to what the law may say.
[I'm not so well-versed on US and Russian law, thus I will limit my answer to EU law.] Your specific use of a user identifier, as I understood from your question, can be classified as personal data, so in your case, the GDPR seems to apply. This means that you need to have a) legitimate purposes to process that personal data (e.g. crash reporting) and b) a legal justification for each purpose of processing: it could be based on consent or another legitimate purpose (inc. your own legitimate interests). Consent might not be the best option for you, but it's up to you to decide. In any case, you need to assess the risks to the data subjects (your users) before you decide. How likely is it that you will get breached, and what potential harm will that cause to your users? These are some guidelines; my recommendation is that you read the law and the guidelines by the Article 29 Working Group and European Data Protection Board, or hire some good experts on this. There is no easy answer, or one size fits all solution. The GDPR isn't so hard to understand or implement, but it does require some change in mindset. With the new law, processing personal data carries a higher risk of penalties, so you should do it only when it's absolutely necessary, and with respect to the rights of your users.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
This would not be "legal jeopardy" per-se, really the only remedy that Stack Exchange would have in a case like this would be to ban both accounts. It would be different if you caused SE some kind of monetary/reputation damages to the site itself. From SE's Acceptable Use Policy: Identity Theft and Privacy. Users that misleadingly appropriate the identity of another person are not permitted. It seems your described scheme would violate that term. But this isn't a legal problem, just an operational one. You aren't violating any law (unless there are local laws against this) by paying somebody to "be you" on SE. The most that this would earn you and your cohort would be a ban and probably removal of the contributions.
Yes Businesses (and consumers) can choose who to do business with and what information they ask for and disclose and when they do that. If you’re uncomfortable with how they do business, don’t deal with them. If they don’t like how you do business, they are free not to deal with you. This is called discrimination. However, it is not unlawful because only discrimination against a person due to membership of a protected classes is unlawful. This person “won’t answer my questions” is not discrimination based on a protected class (unless they are a monk who has taken a vow of silence).
You call their employer and impersonate them The onus is on the employer to keep your personal data secure. If they do not take reasonable steps to verify that the caller is indeed you, they fail that duty and can be held to account. So, not a loophole.
There are no direct penalties per GDPR. The data controller must make sure that the person making the request is the data subject, or at least authorized by the data subject. If the controller has reasonable doubts about the identity, they should request additional information for identification purposes. The controller must find a middle ground between violating the GDPR by rejecting a potentially valid request and violating the GDPR by disclosing data to potentially unauthorized recipients. Having reasonable technical and organization measures that prevent unauthorized disclosure is part of the controller's responsibilities per Art 24. What the data controller can do is to block future requests from the alleged stalker. When a request is “manifestly unfounded or excessive, in particular because of their repetitive character”, then the controller can charge a reasonable fee or refuse to act on the request (Art 12(5) GDPR). But it's up to the controller to prove that the requests are unfounded or excessive, it is not possible to reject potentially valid requests on sight. Depending on what the alleged stalker does with the obtained data, they would fall within the scope of the GDPR themselves and would probably be violating it because there is no sufficient legal basis. Also, the alleged stalker, as a data controller, would be required to inform the data subject about subsequent processing of the data per Art 14 GDPR. Attempting to obtain another person's personal data through an access request would have to be punishable by other laws. For starters, such attempts would likely involve identity theft, and successfully obtaining the data would probably be a kind of fraud.