29
votes
Accepted
Brute force, mass image production copyright trolling?
This has been asked about music. A large flaw is that independently creating something that has already been copyrighted is not copyright infringement. Copyright infringement requires copying, ...
- 11.6k
26
votes
Accepted
Does the German GDPR require storing the data in a German datacenter for a tele-health company?
The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in ...
- 23.7k
25
votes
Does derivative works law allow someone to create a new work based on an old one as long as they make modifications?
Your client is confused about how copyright law works (at least in the United States and virtually every other country I've ever heard about copyright in).
If I were guessing, they read something like ...
- 10.2k
19
votes
Accepted
Legality of Using Unofficial API
If the app (and the service accessed from the app) truly doesn't have any EULA, ToS, or license agreement, to include restrictions on reverse engineering, you can probably create an alternate front ...
- 666
14
votes
Accepted
Is a company liable if someone leaves their bank logged in on a company PC?
The party providing the computer, ISp connecting the computer to the internet, or manufacturer of the computer would not be liable. A person wishing to sue for damages would have to establish that the ...
- 206k
13
votes
Must public content/data created by a US city have an open license?
Am I correct to infer that content/data created by a US city have an
open license (public domain if created by US city employees or open
license if created by a contractor)?
No. For example, Larimer ...
- 186k
13
votes
Is it illegal for a firm to train an AI model on a CC BY-SA 4.0 corpus and make a commercial use of it without distributing the model under CC BY-SA?
united-states
The flowchart included in the question is trying to summarize a rather large amount of legal uncertainty into one image. It must be emphasized that each decision point represents an ...
- 3,095
11
votes
Accepted
If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?
The GDPR does not have specific rules on passwords. Instead, the GDPR imposes a more general requirement to ensure data protection by implementing “appropriate” technical and organizational measures, “...
- 23.7k
10
votes
Does derivative works law allow someone to create a new work based on an old one as long as they make modifications?
This would be a violation of copyright (your client creating the derivative work) and likely be a violation of the EULA (extracting and distributing parts of the software).
Creating work based on a ...
- 4,618
9
votes
Is a sent email in someone else’s inbox subject to data subject rights of the sender?
An Art 15 Subject Access Request (SAR) “shall not adversely affect the rights and freedoms of others.”
It would be a grave violation of privacy for an email provider to search its users' account ...
- 23.7k
9
votes
Legality of Using Unofficial API
england-and-wales
If you know you have no authorisation to access the API then on the face of it this seems to be contrary to s1 Computer Misuse Act 1990 (and possibly s3 Unauthorised acts ... with ...
- 12.2k
8
votes
Must public content/data created by a US city have an open license?
There are two separate legal issues here. One pertains to copyright. US government works are statutorily excluded from copyright protection, all other works are protected by copyright. Licensing for ...
- 206k
8
votes
Must public content/data created by a US city have an open license?
The difference between the quotes in the question from data.gov and those from Legal Aid at Work is that the former talks of "U.S. Government employees," while the latter refers to "...
- 2,832
7
votes
Accepted
Can a company charge you to update your address under GDPR?
Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety:
The data subject shall have ...
- 23.7k
6
votes
Accepted
Supreme Court Cases That Have Been Decided on Statistical Evidence---Are There Any?
It is far from obvious what would qualify as a “Supreme Court cases decided based on statistical evidence”, actually, it is far from obvious what constitutes “statistical evidence”. At the minimum, I ...
- 206k
6
votes
Does derivative works law allow someone to create a new work based on an old one as long as they make modifications?
The client is mistaken. There is no such thing as "derivative Works law", at least not in the sense that the client suggests; there is only copyright law.
US Copyright Law
17 USC 106 says:
...
- 112k
6
votes
Legality of Using Unofficial API
In the US, the relevant law is the Computer Fraud and Abuse Act, which makes it a federal crime to access a protected computer system without proper authorization or to exceed the scope of your ...
- 169
5
votes
Accepted
Do initials count as personal data?
Basically how reducible is personal information until it's no longer personal information?
When it can no longer be used, alone or combined with other data, to identify a person (or small number of ...
- 192k
5
votes
GDPR: Can I collect non-personally identifiable information?
There are two relevant bodies of EU law to consider here.
The GDPR covers processing of personal data. Personal data is any data where the data subject can be identified directly or indirectly.
The ...
- 23.7k
5
votes
Accepted
GDPR and Storing Non-EU Citizen Data as an EU-based company
are there any GDPR considerations that must be in place when an EU company stores personal information from citizens outside of the EU?
Absolutely. The territorial scope of the GDPR is specified at ...
- 33.9k
5
votes
Is a company liable if someone leaves their bank logged in on a company PC?
The usual question for questions like this, "what legislation?"
When a company sets up IT infrastructure for use by their employees, it may have to take steps to assure that no personal data ...
- 13.2k
5
votes
Does the Colorado Privacy Act apply to churches with memberships (ex: Jehovah’s Witnesses)?
Probably not.
The Act applies to:
(1) EXCEPT AS SPECIFIED IN SUBSECTION (2) OF THIS SECTION, THIS PART
13
APPLIES TO A CONTROLLER THAT: (a) CONDUCTS BUSINESS IN COLORADO OR
PRODUCES OR DELIVERS ...
- 186k
4
votes
Accepted
Data copyright for public domain content or natural resources
Copyright protects literary and artistic expression, not facts.
So, in a database, the structure of the tables, the construction of the queries and the presentation of the user interface are all ...
- 192k
4
votes
Accepted
How can you guarantee deletion of consumer data on the internet?
Neither the GDPR, nor the CCPA, nor any other data protection law that I am aware of, requires that when information is deleted on request, that similar information not be collected and stored in ...
- 112k
4
votes
Does derivative works law allow someone to create a new work based on an old one as long as they make modifications?
Derivative works add protection, they don't remove or replace any.
If work X is created by A, then A gets protection for unauthorized use of X.
If work Y is created by B as a derivative of X, then:
A ...
- 816
4
votes
What is the legality of the use of non-commercial-use-only software as a tool in a company?
There is no fixed legal meaning to "non-commercial", instead, every license must define what is meant by "non-commercial", if it uses that term. CC BY-NC 4.0 says that
...
- 206k
4
votes
Accepted
How does GDPR's right to erasure apply to deduplicated storage?
I think there are a couple of different ways to look at this.
Deduplication is a technical detail that's irrelevant here
While the data may be deduplicated on a technical level, the files remain ...
- 23.7k
3
votes
Supreme Court Cases That Have Been Decided on Statistical Evidence---Are There Any?
This is not, unfortunately, a direct answer to your question. Nonetheless, it might be of interest to you.
The US Census has been the subject of extensive legal wrangling, ending in the Supreme Court ...
- 191
3
votes
Inactive account deleted under GDPR (data retention) laws. Should the credit on it have been refunded to the account holder?
There are two "cancellations" here. There is a contract between the customer and the company. This contract was ended. Also, as part of GDPR obligations, the data of the former customer was ...
- 5,040
3
votes
GDPR account verification
This is less of a compliance question, and more of an infosec question. On one hand, you want to be able to restore access to an account to users who have lost their access. On the other hand, you ...
- 23.7k
Only top scored, non community-wiki answers of a minimum length are eligible