15

Basically what the title says. I'm very ignorant when it comes to these sorts of laws and rules so please be kind. I made a post on an “audition forum” when I was 12 years old. The post included my full name, race, age and gender. I am 17 now. Do I have the right to have this information removed?

This is an American website by One Source Talent, who have had some very problematic reviews…

I’ve tried sending emails but their email under their DMCA policy is fake. I’ve ran the domain search in who.is/ICANN but it lacks the contact information.

3
  • Regardless of whether you have a legal right to have it removed, you may have some luck posting a negative review on a review site e.g. pointing out that they're publicly sharing your private information without giving you any ability to delete it. Some companies are very active in responding to such reviews, but others simply ignore it. Doing the same thing on Twitter is another option. Obviously don't put your private information on those platforms too, just describe it generally, as you did here, and provide a link in private if they respond.
    – NotThatGuy
    Commented Mar 15, 2022 at 11:44
  • The contact information for DMCA takedown notices should be both on the site and searchable in DMCA Designated Agent Directory. However, it's unlikely to do you any good, as it's unlikely for you to have a valid claim for a DMCA takedown, given you are the author and posted it yourself. However, given that you were, and are, not an adult, you may have the ability to break the contract which is the TOS, but that would need to be litigated (I could see this argued both ways, but I'd consider the probable ruling to be "no" wrt. those grounds wrt. DMCA takedown).
    – Makyen
    Commented Mar 15, 2022 at 15:36
  • 1
    Were they legally allowed to let a minor make that comment at all? If not, what are the consequences? Commented Mar 15, 2022 at 18:10

1 Answer 1

20

Various Privacy Laws may Apply

If you live in the EU, the site may be required to delete this information under the GDPR. If you live in the UK, you may have the right to deletion under the UK-GDPR. In each case the procedure for enforcing such a right if the business does not respond depends on the law of your country, and would involve a suit in the courts of that country. Even if a judgement including a court order is obtained, enforcing this on a US firm may not be easy.

If you live in California, you may have a right to the deletion of the info under the California Consumer Privacy Act (CCPA) (soon to be replaced by a modified version, the California Privacy Rights Act (CPRA)). If you live in Virginia, you may have rights under the Virginia Consumer Data Protection Act (VCDPA). All these right are subject to various exceptions.

Several other states, including Colorado, have passed similar laws, but they have not yet gone into effect.

See also "Consumers’ “Right to Delete” under US State Privacy Laws" published by Consumer Privacy World and written by By Glenn A. Brown on March 3, 2021.

Since the information was collected (posted) when you were less than 12, your parents may have the right to request deletion under the Federal Children's Online privacy Protection Act (COPPA)

The DMCA deals with alleged copyright violations, not with personal privacy issues.

CCPA / CPRA

The CCPA right to delete applies only to information supplied by the Data Subject (DS). The CCPA right to delete is given by California Civil Code section 1798.105 The Buisness has 10 days to acknowledge a request, and 45 days to respond, which may be extended for an additional 45 days.

Note also that the CCPA requires various notices to be delivered to the consumer, and normally requires a privacy policy to be posted. This must include notification of the consumer's rights.

Under the CCPA a consumer may not sue a firm directly to enforce the right to delete. Instead a complaint may be made to the California Attorney General, who is empowered to take enforcement action. Only in cases of a data breach ca a consumer sue a firm directly.

Note that he CCPA appliws only to firms that:

  • are for-profit businesses that do business in California and
  • Have a gross annual revenue of over $25 million; or
  • Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or
  • Derive 50% or more of their annual revenue from selling California residents’ personal information.

See also the official page "California Consumer Privacy Act (CCPA)"

VCDPA

Section 59.1-573 (A) provides that

(A) A consumer may invoke the consumer rights authorized pursuant to this subsection at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A known child's parent or legal guardian may invoke such consumer rights on behalf of the child regarding processing personal data belonging to the known child. A controller shall comply with an authenticated consumer request to exercise the right:

...

(A) 3. To delete personal data provided by or obtained about the consumer;

(A) 4. To obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and

(A) 5. To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

Under subsection B the controller (firm) has 45 days to respond, which may be extended for up to an additional 45 days

Under 59.1-574 (A) a controller has verious obligations including to:

Limit the collection of personal data to what is adequate, relevant, and reasonably necessary ...

and to:

Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. з 6501 et seq.).

Under subsectiuon (B) the rights may not be waived by contract. Under subsection (c) the controller must provide:

a reasonably accessible, clear, and meaningful privacy notice

and this notice must contain:

one or more secure and reliable means for consumers to submit a request to exercise their consumer rights under this chapter. Such means shall take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests, and the ability of the controller to authenticate the identity of the consumer making the request. Controllers shall not require a consumer to create a new account in order to exercise consumer rights pursuant to з 59.1-573 but may require a consumer to use an existing account.

various exemptions are provided for in the VCDPA. As with the CCPA, the previsions may only be enforced by the state Attorney General, not by private lawsuit.

The VCDPA only applies to:

persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.

In many ways it is quite similar to the CCPA.

COPPA

COPPA is a federal law that applies to services, including websites, that collect personal information about children under age 13. It imposes various responsibilities and restrictions on such providers, and give the parents of such children various rights.

According to the FTC pagw "Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business""

Even if parents have agreed that you may collect information from their kids, parents have ongoing rights — and you have continuing obligations.

If a parent asks, you must:

  • give them a way to review the personal information collected from their child;
  • give them a way to revoke their consent and refuse the further use or collection of personal information from their child; and
  • delete their child’s personal information.

The FTC's FAQ on COPPA states:

The primary goal of COPPA is to place parents in control over what information is collected from their young children online. The Rule was designed to protect children under age 13, while accounting for the dynamic nature of the Internet. The Rule applies to operators of commercial websites and online services (including mobile apps and IoT devices, such as smart toys) directed to children under 13 that collect, use, or disclose personal information from children, or on whose behalf such information is collected or maintained (such as when personal information is collected by an ad network to serve targeted advertising). The Rule also applies to operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13, and to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children. Operators covered by the Rule must:

...

  1. Provide parents access to their child's personal information to review and/or have the information deleted;

...

  1. Maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security;

  2. Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use;

The same page says that COPPA:

applies to operators of commercial websites and online services (including mobile apps and IoT devices) directed to children under 13 that collect, use, or disclose personal information from children. It also applies to operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13. The Rule also applies to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children.

The FTC, some other federal agencies, and US states may enforce the COPPA Rule.

2
  • 2
    COPPA seems pretty clearly applicable to me. Yes, OP would technically need their parents to sign the letters/emails to the site, but that's about it
    – Hobbamok
    Commented Mar 15, 2022 at 12:23
  • 2
    @Hobbamok Yes, it does, but like the other US laws, and unlike the GDPR, there is no possibility of a private lawsuit to enforce COPPA, it must be doen by a government agency, state or Federal. Commented Mar 15, 2022 at 13:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .