13

It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship....


7

Well actually... I think you'll just need to wait a little more. I monitor the situation quite closely and I can tell you that it's just a matter of time. Microsoft was one of the first (if not the first) to communicate openly about the GDPR and the changes that follow. From the blog post: If your organization collects, hosts or analyzes personal data of ...


4

Data, as it happens in law, can also be owned. That's why we have a discipline called "Intellectual Property". It is a "thing" - like other properties like cars, houses etc., someone owns it. Now, does the transfer of a computer also includes a transfer of data ownership stored inside the computer? Practically speaking, this clause is very unlikely to be ...


3

No. This is governed by the HIPAA Security Rule which was a regulation that the HIPAA statute required the Department of Health and Human Services to adopt. The Rule does require someone covered by HIPAA to have a "Business Associate Agreement" (BAA) and a Service Level Agreement (SLA) with any cloud storage provider (which would be the usual way that a U.S....


3

Here's the Google equivalent of that Microsoft blog post: Our users can count on the fact that Google is committed to GDPR compliance across G Suite and Google Cloud Platform (GCP) services when the GDPR takes effect on May 25, 2018. It's all still couched in future terms ("We'll make important updates to contractual commitments") so you still have ...


3

18 U.S. Code § 2252 defines a crime and punishment for knowingly transporting, or reproducing for distribution by any means, visual depictions involving the use of a minor engaging in sexually explicit conduct. Here are some sample jury instructions that rephrase this and give definitions for each of these terms. Here are some others (at p. 469). This law ...


3

The law in every country where your service is available prevails. That means that if your servers are in Estonia, your file storage is in Lithuania, your company is in Switzerland, you are in France, you hold Thai citizenship, your users are in the USA and the signal transits through the U.K., Belgium, Germany, Canada and Poland then you are subject to the ...


3

If you have no knowledge and can't possibly have knowledge because the data is totally private, you should fall into the safe harbor protection of 17 U.S. Code § 512 - Limitations on liability relating to material online. See this answer here which covers a lot of the information you are looking for: Legality of Proxy sites and DMCA


2

It all comes down to the ToS you agreed to when you signed up with the host, or any changes made later. If it was in your ToS it is likely that they would have a fee for the time it takes. If it isn't mentioned then they would either refuse or request a fee as it does cost to have staff carryout work.


2

Owner claims cannot satisfy chain of custody if the data hit a cloud. Is that true? No. On the one hand, as you say, you can just include the cloud provider on the chain of custody. On the other hand, opponents don't ask for chain of custody. And when they do, it's going to take a pretty drastic series of events to diminish the admissibility or ...


2

If it is fair use to copy it en clair then it is fair use to copy it enciphered. If it is not fair use en clair then it is not fair use enciphered. Enciphered works are derivative works of the original and permission of the copyright owner or fair use is required to create the encipherment. Yes it is still IP.


2

No. As long as you don't see and have no means to access this data, but it is under the control of the user at all times, you are neither the controller or the processor of this personal data, and the GDPR does not apply to you.


2

The GDPR does not regulate specific security measures beyond making recommendations about what you should considder. It requires you to evalute risks and, if necessary, implement security measures to mitigate those risks. Doing a DPIA (Data Protection Impact Assessment) to identify levels of risk may be helpful. To do a DPIA, one obviously need to know the ...


2

So far as I am aware, all jurisdictions provide some kind of defence to the offence of possessing child pornography (or, for that matter, other illegal items like drugs and weapons) for legal purposes. This is necessary at least for police and others involved in the criminal justice system – if not, it would be difficult to seize the material and admit it in ...


2

This might be an unnecessary subtle point, but the goal of the GDPR isn't to protect personal data as some abstract concept – it regulates how personal data can be processed. For an organisation's compliance obligations, it matters for what purposes they collect and process personal data. You can't shove sensitive personal data on an unsuspecting recipient ...


1

The GDPR doesn't talk about specific technologies used to access data. You are processing data of EU citizens, which is controlled by a UK company. They of course have their own obligations (as mentioned in the comments). But as a processor, your company needs to follow the GDPR rules. The chief bit here is article 28, which defines what a processor is under ...


1

There are privacy laws in the EU that could prevent you from doing this, because you can't publish personal information, pursuant to current and new rules (GDPR) effective in 6 weeks. This includes an IP address: Personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be ...


1

In the absence of national security concerns, it is legal to store emails on mail servers outside the US. This is true even of information protected by HIPPA. This is a good thing, because the way the Internet works is a sort of pony express style network. Your email goes from server to server to server, potentially all over the world even if the sender and ...


1

Usually the answer to "is it legal?" to wholesale and methodically copying another website (or any other published work, be it a book, movie, music, article, internet resource, etc.) is clear: of course not. It doesn't matter if it is a one time scrape or a continuous crawl and copy; it's still copying and there are copyright laws around the world, albeit ...


1

What they can do with your data depends entirely on the TOS. There might be a provision that allows them to peer into your data for analytic purposes; there might even be a provision allowing them to copy and sell your data. Your baseline protection is copyright law: in order to copy your data (basically, do anything with it other than store it and make a ...


1

Yes it is legal In fact, most online content hosts have similar provisions. For example: You Tube For clarity, you retain all of your ownership rights in your Content. However, by submitting Content to YouTube, you hereby grant YouTube a worldwide, non-exclusive, royalty-free, sublicenseable and transferable license to use, reproduce, distribute, ...


1

....but it seems like they have crossed the line of common sense usage of my personal data. Common sense doesn't have anything to do with it. You entered into a legally binding contract by agreeing to the terms of service (TOS). That TOS says what it says: ...nonexclusive, worldwide, royalty-free and fully-paid, transferable and sublicensable, perpetual, ...


1

Since you're interacting with people in the US and know the age of your users, COPPA applies if any of them are under 13 years old: Foreign-based websites and online services must comply with COPPA if they are directed to children in the United States, or if they knowingly collect personal information from children in the U.S. The law’s definition of “...


1

As with any question dealing with accessing, copying and repurposing data, copyright law comes into play. Read I have a question about copyright. What should I read before I ask it? : Copyright law protects a creator’s right to control certain intangible works that they have created, specifically protecting original expression but not underlying facts ...


1

I worked for a Germany company and a similar question came up. An HR member (not a lawyer) mentioned six years for the average Joe though on some special situations (banking industry or some health/government jobs can have ten years). This is specific to salary slips and anything directly related to it to assist with tax audits. Emails and documents that ...


1

Your comments wonder if it's also illegal for an Indian company. The answer is simple: EU rules do not have any exception that would make it legal for you. This isn't a big surprise as it would open a trivial loophole; any company would be able to escape the ruling via an Indian subsidiary. Now the EU rules only apply to export of data originating in the ...


1

Whoever your privacy policy says As you're in the UK, you are bound by the Data Protection Act. It's worth doing some reading on this; it's based on eight principles which can be readily understood by a lay person. Most EU countries have similar laws. Principle 2 is: Personal data shall be obtained only for one or more specified and lawful purposes... ...


1

You would need to see a lawyer for a definitive answer - generally, if it is on the web and not protected by action requiring acknowledgement of terms of service/use it is "fair game". A greyer area would be if your bot follows the "Robots Exclusion standard" (ie honors the contents of robots.txt file) Relatedly it may also depend on the amount of data you ...


1

There are laws prohibiting breaking into computer systems, or committing fraud with a computer, but as far as I can tell, no law prohibiting the simple possession of illegally-obtained data (though possession of such data could under some circumstances be used as evidence of complicity in the crime, so I assume that can be ruled out). The prohibited act here ...


1

A TOS for a website is serious business; you need to precisely outline how your user's data is protected, what users can and can't do in the forum, your responsibilities to the users, and on and on. Your TOS is a legal document. Your users sign a contract when they click and accept. See Contracts of Adhesion https://www.law.cornell.edu/wex/...


Only top voted, non community-wiki answers of a minimum length are eligible