Is offering uncapped access to certain services but not others by ISPs legal under EU net neutrality laws? Some ISPs in Europe offer data plans that are capped at certain amount of GB per month. But in this europa.eu page one can read that: The best effort internet is about the equal treatment of data traffic being transmitted over the internet, i.e. that the ‘best efforts’ are made to carry data, no matter what it contains, which application transmits the data (“application-agnosticism”), where it comes from or where it goes. The benefits of the best effort internet notably include the separation between application and network layers of the internet. (emphasis added) Is it actually legal under EU law to offer Internet services that do not treat all services/apps/websites equally when it comes to data caps?
This issue has now been ruled on by the European Court of Justice, which ruled that zero rating breaks net neutrality and is unlawful. No 106/2020 : 15 September 2020 - Judgment of the Court of Justice in Joined Cases C-807/18,C-39/19 Telenor Magyarország Original answer for historical purposes: As another page in your link says, it depends: Is zero-rating allowed under the Regulation? It depends. There are different types of zero-rating practices, some of which are more problematic than others. BEREC’s Guidelines look at different examples and provide guidance on the extent to which they could be considered permissible under the Regulation. The BEREC guidelines explain that some practices are clearly prohibited – those where all applications are blocked or slowed down once the data cap is reached except for the zero-rated application(s). Others are less clear-cut and will be need to be assessed by NRAs against a number of criteria set out in the Guidelines.
No, it's not illegal... Ads are shown as a contract between the site that hosts it and the advertising company. The contract does not stipulate that customers need to buy something, in fact, the contract can't force the customer to buy anything! At best, the contract can pay the hosting site based on the ad being shown, clicked, or any sale made after it. ...but you will do exactly the opposite Advertizement is made to put your own brand into the head of people. In fact, most ads don't have any effect on people. As I am writing this, ads for a kid TV, travels to Turkey and the primetime films for the weekend on the TV-station I have on are shown. I have no intention of consuming any of these advertised products. Impact of a campaign is measured by two metrics: people reached, and people responding. People reached is measured in clicks. People responding is measured in changes in earnings or sales. Clicking the ad increases the reached rating. If the rating is bad, the ad campaign is just ineffective... which leads to the most paradoxical thing: Bad advertisement and good advertisement both lead to more advertisement - bad to level out the missing response, good to maximize the response. By clicking on the ad you just funnel more money to the ad industry. When does it get illegal? [DDOS] The only way it would become illegal is if John Doe sets up a computer - or rather a botnet - and has that network click the ads thousands of times per second. Google can handle easily 83,000 searches per second, twitter gets more than 9000 tweets that are distributed to millions of people, Tumbler and Instagram handle together about 2500 posts per second. In fact, every second, more than 100000 Gigabytes of traffic run through the net. To have an impact on one site, you need to be truly a large number of calls... and then it is called a DDOS. DDOS is illegal under the CFAA, in this case 18 UC 1030: (a)Whoever— (5) (A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; (b)Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. In the UK, you'd break the Computer Misuse Act of 1990 section 3, because denying someone else service via DDOS is unauthorized, clearly unauthorized, and prevents access to any data (the website) on any computer (the server): (1)A person is guilty of an offence if— (a)he does any unauthorised act in relation to a computer; (b)at the time when he does the act he knows that it is unauthorised; and (c)either subsection (2) or subsection (3) below applies. (2)This subsection applies if the person intends by doing the act— (b)to prevent or hinder access to any program or data held in any computer But can a DDOS be protest? [NO!] Anonymous attempted to petition to make DDOS a legal form of protest in 2013. The petition got 6,048 of the 25000 signatures needed to warrant an answer by the white house - unlike people in 2016 asking for a Death Star. At least it prompted Joshua I. James to write a research paper about the proposal in March. He too points to the CFAA and Section 5A, especially the sentence I quoted above. Among a lot of stipulations, he points out that internet protest in the shape of a DDOS would need to follow the same rules as a legal protest on the streets - which for example demands that entrance to businesses can't be blocked, and one is not allowed to harass employees and customers. According to the general rules for legal protest as given, there are still a number of challenges. First and foremost, entrances to businesses should not be blocked. In terms of DDoS, if sustained denial of service takes place, then access (entrance) to the server (business)is eﬀectively blocked. This means that, at a minimum, sustained denial of service should be considered as a non-legal approach to protesting. Thus, he concludes sustained DDOS is per se can't be a legal protest, and even a non-sustained DDOS would impact people using the site in a way they will deem harassing - which means that even a non-permanent DDOS can't be a legal protest. And then comes the final blow: DDOS, unlike a real protest on the streets, can't, by its very nature, inform people of why there is protest, even if it were a form of protest! This means that nobody knows it is meant to be a protest and not a normal DDOS, and as it can't convey what the action is about, it can't be a proper protest.
Per Art 3(2), GDPR only applies to non-European companies when their processing activities relate to the offering of goods or services to people in Europe, or when the processing activities relate to monitoring people in Europe. However, the word “offer” of this targeting criterion requires some level of intent. It is not enough for GDPR to apply that they're marketing to someone who happens to be in Europe, but GDPR would apply if they are intentionally marketing to people who are in Europe. I don't know what they are marketing, so I don't know if that would be the case here. Even if GDPR were to apply, it would not be the most appropriate law. Yes, there's the GDPR right to erasure, which applies under some conditions (though there's a pretty absolute right to opt-out from marketing). The EU's ePrivacy Directive provides more specific rules though, in particular that every such marketing email must offer a way to unsubscribe. Other countries have comparable anti-spam laws, potentially also the home country for this online service.
can it be construed as a violation of 66F clause 2 if we try to circumvent the rate limit even though the information is on public domain? No, unless the element of intent to threaten [...] or strike terror can be proved. I'm assuming that by &quot;clause 2&quot; you mean the excerpt you posted. Although circumventing the limit of API calls sounds in &quot;exceeding authorised access&quot; and might even lead to DOS, it does not imply an intent to threaten the security/sovereignty/etc. or strike terror. The statute is premised on such intent. The fact that the information(packets) is(are) on public domain is irrelevant. For instance, an intent to strike terror and/or actually causing a DOS can involve [targeting] a public domain.
Providing they meet the basic requirements (see What is a contract and what is required for them to be valid?) then they are binding contracts. Consideration is not an issue: the site provides the content, the user provides eyeballs on it. Consent is the major stumbling block. Online Terms of Service are either presented as browsewrap or clickwrap or sign-up wrap. A browsewrap provides notice of the terms of service but there is no specific user assent to them. A clickwrap requires the user to check a box specifically about agreeing to the terms (with or without user registration). A sign-up wrap presents user registration with a "Sign up" and provides notice to the terms at the point of service but doesn't have a check button specifically for the terms. As an example, Stack Exchange provides two types of wrap. For the casual user, there is a Legal link at the bottom of the page - a browsewrap. If you sign-up, you go to a page that says "By clicking "Sign up", you agree to our terms of service, ..." - a sign-up wrap. Whether a Terms of Service is an enforcable contract depends on whether the user provided notice, whether the user gave consent and whether enforcing the agreement is conscionable. Clickwraps and sign-up wraps have the advantage over browsewraps in the first two of these. Assuming that the contract terms are unremarkable (i.e. they are within the range of "normal" for that type of contract) a clickwrap will normally create an enforcable contract - Forrest v Verizon and Motise v America Online being the relevant case law. Browsewraps are more problematic: Specht v Netscape said no contract but where the browsewrap is shown prominently and repeatedly they can form an enforceable contract - Hubbert v Dell and Cairo v CrossMedia Services. Zaltz v Jdate was a sign-up wrap and did create an enforceable contract. All of these turn on the facts of how the information was was presented to the user. For example, in Meyer v Kalanick the Second Circuit said: Where there is no evidence that the offeree had actual notice of the terms of the agreement, the offeree will still be bound by the agreement if a reasonably prudent user would be on inquiry notice of the terms.[sic] So, in general, Terms of Service are enforcable as a contract if a reasonably prudent user could, on inquiry (e.g. by clicking a link), make themselves aware of the terms. This also explains why skrinkwraps (when software came on actual physical media in a shrink-wrapped box with the terms inside) were not enforcable - a reasonably prudent user could not inform themselves of the terms without unwrapping a product they didn't yet own.
Is there any sources of information where extraction of data from a closed source application and provided to a data subject is further defined? No, the GDPR is based on &quot;general principles&quot; and does not concern itself with implementation details for such matters. It's possible there's EU case law on this, but I can't find any. Am I within my rights to insist on this, even if to comply they would have to do some software development? Yes you can demand it, but they don't have to comply with your demand. The information only has to be provided in a &quot;concise, intelligible and easily accessible form, using clear and plain language.&quot; and they only have to provide the information electronically where &quot;reasonably practical&quot; to do so, and they only have to take &quot;reasonable steps&quot; to do all this per Section 52 of the Data Protection Act 2018 which implements GDPR into UK law. You can complain to the Information Commissioner's Office, and they will decide if Section 52 has been complied with or not. 52 Form of provision of information etc (1) The controller must take reasonable steps to ensure that any information that is required by this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language. (2) Subject to subsection (3), the information may be provided in any form, including electronic form. (3) Where information is provided in response to a request by the data subject under [the Right of access by the data subject], the controller must provide the information in the same form as the request where it is practicable to do so.
The "Contribution activity" is extracted from repositories hosted on Github. Looking at the privacy statement, Github considers itself as a hosting service for those repositories. See EU Directive 2000/31/EC Article 14 for the exact definition and conditions: Article 14 Hosting Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that: (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information. Article 2(4) GDPR defines that the GDPR does not apply (to Github) in this case This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive. Extracting data from the repositories to create a nicely formatted contribution activity list, would still be considered hosting as defined at Directive 2000/31/EC, because Github does not (manually) redact or modify commits. So if you want to hide your contribution activity, you must delete the contributions. And you should not ask Github to do that, but ask the owners of the repositories. And they might have good reasons to deny your request. If an owner of a repository denies your request without a good reason, you can ask Github to do so. But Github would then probably deny that request, because they explain in their privacy statement that modifying the history is not possible: The email address you have supplied via your Git commit settings will always be associated with your commits in the Git system. If you chose to make your email address private, you should also update your Git commit settings. We are unable to change or delete data in the Git commit history — the Git software is designed to maintain a record — but we do enable you to control what information you put in that record. edit To further clarify why Article 14 of Directive 2000/31/EC applies, see case C-236/08 (Google v. Louis Vuitton) where the European Court of Justice clarifies the meaning of that article (ECLI:EU:C:2010:159): In that regard, it follows from recital 42 in the preamble to Directive 2000/31 that the exemptions from liability established in that directive cover only cases in which the activity of the information society service provider is ‘of a mere technical, automatic and passive nature’, which implies that that service provider ‘has neither knowledge of nor control over the information which is transmitted or stored’. Accordingly, in order to establish whether the liability of a referencing service provider may be limited under Article 14 of Directive 2000/31, it is necessary to examine whether the role played by that service provider is neutral, in the sense that its conduct is merely technical, automatic and passive, pointing to a lack of knowledge or control of the data which it stores. The way Github creates/shows the contribution activity is in my opinion technical, automatic and passive. That means it is not liable, and that implies that the GDPR does not directly apply, unless data is unlawful, and someone notifies Github of that: The restriction on liability set out in Article 14(1) of Directive 2000/31 applies to cases ‘[w]here an information society service is provided that consists of the storage of information provided by a recipient of the service’ and means that the provider of such a service cannot be held liable for the data which it has stored at the request of a recipient of that service unless that service provider, after having become aware, because of information supplied by an injured party or otherwise, of the unlawful nature of those data or of activities of that recipient, fails to act expeditiously to remove or to disable access to those data. Surely the GDPR might be the reason data is unlawful. But you need a reason, in particular based on Article 17 ("right to be forgotten"). For example if personal data of a 12 year old child is processed without permission of it's parent. Without such a reason the legitimate interest of the repository owner will probably prevail (who wants to keep the git history complete).
Subject to a few exceptions, such as fair dealing, copyright holders have a right to dictate how their creations are performed, communicated to the public, and reproduced. It is technically an infringement, and illegal, to download without respecting the copyright owner's terms. The Copyright Act sets a limit of $5000 for non-commercial infringement cases: 38.1 (1) (b) in a sum of not less than $100 and not more than $5,000 that the court considers just, with respect to all infringements involved in the proceedings for all works or other subject-matter, if the infringements are for non-commercial purposes. Practically, due to the fairness and reasonableness of Canadian courts and legislation, few-to-no lawsuits are brought against personal, non-commercial infringers as they are not cost-effective for rights holders. A reasonable award of, say, $150 for downloading one movie, is hardly worth the time, expense or risk to prosecute, especially if the defendant has no obvious income or assets to cover an award of damages, legal costs, etc. Even when your ISP forwards a notice from a rights holder alleging infringement, as they are required to by law, the chances of actually being sued are (currently) slim. Further, if you only download and don't upload or "make available" you may be less likely to receive such notices or threats from some rights holders, depending on how they choose to identify IP addresses of apparent infringers. For example, many rights holders, or the enforcement companies they employ, try to download infringing files through BitTorrent and accuse all peers of infringement. To catch people who only download, the rights holder would have to actually offer and distribute their own copyrighted works, and they seem more reluctant to use this approach.