33

It is the data controller's responsibility to respond to data subject requests. If you provide a B2B service, you are most likely a data processor who only acts on the controller's behalf, on the controller's explicit instruction. This will depend on your contract with the controllers, your customers (see Art 28). Typically a processor would merely forward ...


17

Section 4, Definition 4 Covered Entity, emphasis added: The term "covered entity" means a device manufacturer, a software manufacturer, an electronic communication service, a remote computing service, a provider of wire or electronic communication service, a provider of a remote computing service, or any person who provides a product or method to ...


16

Does GDPR apply if my web app stores personal data on the user's phone only? No. If you are not processing Personally Identifiable Information (PII) then the GDPR does not apply to you. This is what a web browser does when it asks to remember your username and password for this web site. You are providing a tool, the user is using that tool to process ...


12

You're probably a data controller, but you have taken pretty good steps to limit your compliance obligations. Personal data is any information relating to an identifiable person. You are a data controller if you participate in determining the purposes and means of processing. The provider of a website is typically a data controller for any data that is ...


11

The GDPR does not have specific rules on passwords. Instead, the GDPR imposes a more general requirement to ensure data protection by implementing “appropriate” technical and organizational measures, “[t]aking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of ...


7

In the United States . . . Scope of Search Warrant: To what extent can they search you and your belongings? The scope of a search is limited by what is stated in the warrant. Not only must a warrant be supported by probably cause, it must also describe with particularity, "the place to be searched, and the persons or things to be seized." See U.S. ...


7

If it was for a criminal case, the jury would have to decide if they believed the person who claimed he/she cracked the code. Really, any evidence is interpreted by the jury if it is regarding facts. 1) An issue of fact, not law. A question of fact is resolved by a trier of fact, i.e. a jury or, at a bench trial, a judge, weighing the strength of ...


6

TL;DR In theory there's nothing wrong with your method, it's just a way to authenticate the user, and without authentication a user has no right to request anything anyway. But in practice it looks like your method doesn't have a way to deal with situations where users lose or forget their authentication data and want to be able to recover their account. ...


6

There is RIPA which allows a court to force you to divulge a decryption key. The penalty for not doing so is up to two years in prison, five if terrorism is involved. The Regulation of Investigatory Powers Act 2000 (RIPA), Part III, activated by ministerial order in October 2007,[20] requires persons to supply decrypted information and/or keys to government ...


5

This question, along with a number of articles on the Internet, misconstrues what the rule change is about. The rule change does not say that you can get a search warrant, that is to enter premises with/without machineguns etc, solely on the basis that someone is running Tor on that premises. The rule changes actually has nothing to do with search warrants. ...


5

As the question mentions, and as the answer by leaustinwile explains in some detail, it is impossible to prove by cryptanalysis that a given decoding of a communication encrypted via a one-time-pad (OTP or pad) is correct. That does not mean that there is no way to prove such a decryption accurate to the satisfaction of a court of law. If the storage or ...


5

Well, in this case, it is interesting to note one fact about the one-time pad. The key and the ciphertext are interchangable and indistinguishable. So rather then thinking about it as encryption, it is better to think of it as spliting in two. If the prosecution finds both pieces and can tie them to you, then they have a good evidence against you. Both parts ...


4

The law in every country where your service is available prevails. That means that if your servers are in Estonia, your file storage is in Lithuania, your company is in Switzerland, you are in France, you hold Thai citizenship, your users are in the USA and the signal transits through the U.K., Belgium, Germany, Canada and Poland then you are subject to the ...


4

This is a super complex question and no one really knows the answer yet. Orin Kerr is probably the leading scholar on this question, and he generally argues that forced decryption of one's own device is not a Fifth Amendment violation. As I understand it (and oversimplifying by a lot), one key piece of his position is that requiring you to put in your ...


4

Public schools are on a shorter legal leash than private schools are, because they must behave like proper governments do and respect the constitutional rights of their charges. (First Amendment rights are much broader in public schools than they are in private schools). Assuming that we're in a public school, a search of your phone is governed by a watered-...


4

If you aren’t the intended recipient of the password-protected file: StGB § 202a makes it illegal to access this file StGB § 202c makes it illegal to obtain (e.g., by brute forcing) the password for this file, if you intend to access the file that way (in the sense of § 202a) (this is the so-called hacker paragraph) If you are the intended recipient, this ...


4

You're completely misreading the goals and purpose of the Export Controls Office - Overview. They regulate the transfer of US regulated information and technology, commodities, and software in the interest of national security and economic growth. Transfer and export are not the same as the use of technology that personal devices contain. The simplest ...


3

Mere possession of copyrighted material does not infringe any of the copyright holder's exclusive rights.1 This conclusion is echoed by Jay Dratler: Nothing in copyright law prohibits the mere possession of an unauthorized copy of a copyrighted work.2 From the Fifth Circuit: The copyright owners not only had no interest in the tangible video ...


3

According to Josh Aas, Internet Security Research Group (ISRG) Executive Director, (the umbrella 501(c)(3) for Let's Encrypt): "It is not against our terms to charge for services using our certificates, though we'd strongly prefer that HTTPS just be part of every offering as a default with no additional fees." My host sells SSL letsencrypt ...


3

There is good hope that this draft will never be turned into a law, if you read headlines like on theregister: "Read America's insane draft crypto- Understandable – it's more stupid than expected" Creating the encryption is perfectly legal. You might be asked to help recover encrypted data. There is no mention of cost; I doubt that you could be asked to ...


3

The Electronic Frontier Foundation, a San Francisco-based digital rights non-profit, specifically advises to use encryption when crossing the US borders. Read more at https://www.eff.org/wp/digital-privacy-us-border-2017. While the EFF doesn't say that using encryption would be illegal, keep in mind that the US borders are a gray area, legally-speaking, and ...


3

Update (12/2/16) - Just received the following confirmation from Apple Export Compliance: The [redacted] app presently uploaded into your account CAN BE legally released to US and Canada only, it will not be necessary to go through Export Regulations. They have also rephrased the question "Does your app qualify for any of the exemptions...?" to the ...


3

Yes a company can be sued (since anyone can sue anyone). But in order to win a lawsuit, you have to have damages as a result of some action, AND you must prove that the action was done with intent to harm or was otherwise negligent. So following your website example, a lot of things would have to happen: The website would have to be hacked. If the ...


3

Article 10 (1) Basic Law / Art. 10 Abs. 1 Grundgesetz: The privacy of correspondence, posts, and telecommunications shall be inviolable. You can send whatever you want via postcard (as long as it doesn't constitute a different criminal offense). Technically, whoever were to decrypt your message, besides the addressee, would probably commit Data Espionage ...


3

GDPR regulations on the whole do not actually mention passwords (source: Information Commissioner's Office UK, this may vary in other country's implementation of GDPR) and providing that the data is only accessible by authorised parties within the organisation within the parameters set out in user agreements and/or privacy policies, then the law isn't broken....


3

There are two processes that go on all the time, and are generally considered legal: Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a gradual reduction of the work required to break the algorithm by a few orders of magnitude at a time. The history of SHA-1 is a good example of this. People ...


2

The language includes changes like inserting the underlined text in "A summons is served on an organization in a judicial district of the United States by delivering a copy to an office...", and there is a corresponding clause about a warrant "served on an organization not within a judicial district of the United States". This is relevant to ...


Only top voted, non community-wiki answers of a minimum length are eligible