33
votes
Accepted
Am I obligated to decrypt lots of data for GDPR requests?
It is the data controller's responsibility to respond to data subject requests. If you provide a B2B service, you are most likely a data processor who only acts on the controller's behalf, on the ...
- 23.7k
18
votes
Would open source programs that use encryption be illegal under this draft of the "Compliance with Court Orders Act of 2016"
Section 4, Definition 4 Covered Entity, emphasis added:
The term "covered entity" means a device manufacturer, a software manufacturer, an electronic communication service, a remote computing ...
- 4,786
17
votes
Accepted
Does GDPR apply if my web app stores personal data on the user's phone only?
Does GDPR apply if my web app stores personal data on the user's phone only?
No. If you are not processing Personally Identifiable Information (PII) then the GDPR does not apply to you. This is ...
- 4,425
12
votes
Does GDPR apply if my web app stores personal data on the user's phone only?
You're probably a data controller, but you have taken pretty good steps to limit your compliance obligations.
Personal data is any information relating to an identifiable person. You are a data ...
- 23.7k
11
votes
Accepted
If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?
The GDPR does not have specific rules on passwords. Instead, the GDPR imposes a more general requirement to ensure data protection by implementing “appropriate” technical and organizational measures, “...
- 23.7k
7
votes
If police get a search warrant, does it have any limitations? Must the person turn over all passwords?
In the United States . . .
Scope of Search Warrant:
To what extent can they search you and your belongings?
The scope of a search is limited by what is stated in the warrant. Not only must a ...
- 1,721
7
votes
Can a one-time-pad provide legal immunity - (make data inadmissible) -?
If it was for a criminal case, the jury would have to decide if they believed the person who claimed he/she cracked the code.
Really, any evidence is interpreted by the jury if it is regarding facts....
- 3,944
6
votes
Can I be compelled by law to decrypt information in UK?
There is RIPA which allows a court to force you to divulge a decryption key.
The penalty for not doing so is up to two years in prison, five if terrorism is involved.
The Regulation of Investigatory ...
- 1,083
6
votes
How will credit card purchases NOT fall under the guidlines of the new Supreme Court ruling?
This question, along with a number of articles on the Internet, misconstrues what the rule change is about.
The rule change does not say that you can get a search warrant, that is to enter premises ...
- 4,244
6
votes
Accepted
Is throw-away-the-key-encryption allowed under GDPR?
TL;DR
In theory there's nothing wrong with your method, it's just a way to authenticate the user, and without authentication a user has no right to request anything anyway. But in practice it looks ...
- 1,818
5
votes
Accepted
Can a one-time-pad provide legal immunity - (make data inadmissible) -?
As the question mentions, and as the answer by leaustinwile explains in some detail, it is impossible to prove by cryptanalysis that a given decoding of a communication encrypted via a one-time-pad (...
- 112k
5
votes
Can a one-time-pad provide legal immunity - (make data inadmissible) -?
Well, in this case, it is interesting to note one fact about the one-time pad. The key and the ciphertext are interchangable and indistinguishable. So rather then thinking about it as encryption, it ...
- 236
4
votes
Legal jurisdiction over cloud storage
The law in every country where your service is available prevails. That means that if your servers are in Estonia, your file storage is in Lithuania, your company is in Switzerland, you are in France, ...
- 192k
4
votes
Can you be legally compelled to disclose your password in a criminal investigation?
This is a super complex question and no one really knows the answer yet.
Orin Kerr is probably the leading scholar on this question, and he generally argues that forced decryption of one's own device ...
- 55.8k
4
votes
Accepted
Is a teacher/school administrator allowed to force me to decrypt my phone?
Public schools are on a shorter legal leash than private schools are, because they must behave like proper governments do and respect the constitutional rights of their charges. (First Amendment ...
- 206k
4
votes
Is brute forcing the password of an encrypted file legal?
If you aren’t the intended recipient of the password-protected file:
StGB § 202a makes it illegal to access this file
StGB § 202c makes it illegal to obtain (e.g., by brute forcing) the password for ...
- 1,136
4
votes
Accepted
Dealing With A Private Institution Policy To Inspect All Encryption-capable Devices Leaving The Country
You're completely misreading the goals and purpose of the Export Controls Office - Overview. They regulate the
transfer of US regulated information and technology, commodities, and
software in ...
- 18.7k
4
votes
Accepted
Is it legal to make encryption breaking technology public?
There are two processes that go on all the time, and are generally considered legal:
Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a ...
- 12.9k
4
votes
Can a company or lawyer force someone to turn over an encryption key?
Yes.
The same issue arose in ABRO Industries v. 1 New Trade, No. 3:14-cv-1984-TLS-CAN (N.D. Ind. 2017), where the defendant sought to compel the plaintiff to produce encrypted e-mails. The court ...
- 55.8k
3
votes
Does selling certificates from Let's Encrypt violate their ToS?
According to Josh Aas, Internet Security Research Group (ISRG) Executive Director, (the umbrella 501(c)(3) for Let's Encrypt):
"It is not against our terms to charge for services using our
...
- 18.7k
3
votes
Is it illegal to keep an encrypted version of illegal data?
Mere possession of copyrighted material does not infringe any of the copyright holder's exclusive rights.1
This conclusion is echoed by Jay Dratler:
Nothing in copyright law prohibits the mere ...
- 3,944
3
votes
Accepted
Are encryption apps (iOS) exempt from US Export Regulations if released to the US App Store only?
Update (12/2/16) - Just received the following confirmation from Apple Export Compliance:
The [redacted] app presently uploaded into your account CAN BE legally
released to US and Canada only, it ...
- 179
3
votes
Accepted
Can a company be sued for storing plain-text passwords?
Yes a company can be sued (since anyone can sue anyone). But in order to win a lawsuit, you have to have damages as a result of some action, AND you must prove that the action was done with intent to ...
- 341
3
votes
Would open source programs that use encryption be illegal under this draft of the "Compliance with Court Orders Act of 2016"
There is good hope that this draft will never be turned into a law, if you read headlines like on theregister: "Read America's insane draft crypto-
Understandable – it's more stupid than expected"
...
- 31.8k
3
votes
Does travelling through the US border with encrypted files break the law?
The Electronic Frontier Foundation, a San Francisco-based digital rights non-profit, specifically advises to use encryption when crossing the US borders. Read more at https://www.eff.org/wp/digital-...
- 163
3
votes
Is it legal to send encrypted messages via a post card?
Article 10 (1) Basic Law / Art. 10 Abs. 1 Grundgesetz:
The privacy of correspondence, posts, and telecommunications shall be inviolable.
You can send whatever you want via postcard (as long as it ...
- 506
Only top scored, non community-wiki answers of a minimum length are eligible