GDPR: Full Disclosure Required

«Via sicura» by Falk Lademann from Flickr (Creative Commons License)

If you’ve been following this blog, you know I’m all about preparing for the General Data Protection Regulation (GDPR) as it applies to content marketing. This rule applies to every company that sends commercial emails to anyone in the European Union. (If you don’t know where everyone on your list is located, assume at least one of them lives in the EU.) We’ve already talked about how, under this law, when you want to add a person to your email list, you must get their specific informed consent and you must be able to prove that you obtained their consent to be on your list.

The GDPR requires, when you obtain this consent, to provide the person (aka data subject) with the following information:

  • The identity and contact information of the controller of the data subject’s information or their representative;
  • The contact information for the data protection officer (if applicable);
  • Your purpose for processing the data subject’s information and legal basis for doing so;
  • The period of time the data will be stored;
  • The data subject’s right to request erasure or corrections of their data or to restrict the processing of their data;
  • The data subject’s right to withdraw their consent;
  • The data subject’s right to lodge a complaint with the supervisory authority; and
  • Whether the data subject giving their information fulfills a statutory or contractual obligation.

If you want to process the subject’s data for another purpose, you must tell the person in advance, and when a person’s data is processed for direct marketing purposes, the data subject has the right to object at any time.

At the first reading of these requirements, my first thought was that the signage at conferences where vendors collect business cards would have to become much more complicated to comply with GDPR. I thought about how this firm will comply with these requirements. People voluntarily add themselves to my email, so I don’t know where they live. I will be adding double opt-in consent for my email list, and I believe the most effective way to comply with these requirements is to include this information in the confirmatory email.

You can hear more about these requirements here:

We have to comply with these rules by May 25, 2018 when this new rule goes into effect.

If you want more information about GDPR, please watch this site and my YouTube channel because I’m creating a substantial amount of content on this topic. You can also send me an email (Note: I can’t give advice to non-clients). I use my mailing list to I share my thoughts about being a lawyer/entrepreneur, updates about projects I’m working on, upcoming speaking engagements, and I may provide information about products, services, and discounts. Please add yourself if you’re interested.

You can also connect with me on TwitterFacebookYouTube, or LinkedIn.

Preparing for GDPR: Are You Ready?

Europe Privacy Law GDPR from Smeders Internet

This year, I’m putting considerable energy into understanding and complying with the GDPR.

What is the GDPR?

The General Data Protection Regulation (GDPR) is a European law that goes into effect on May 25, 2018.

It impacts any professional commercial activities regarding natural persons residing in the EU, so that includes process personal information about natural person who lives in the EU, or sending commercial emails to any natural person who lives in the EU. Commercial emails include the offer of goods or services, even if you’re not doing it in exchange for money.

The purpose of this new law is to protect natural persons’ personal data, and it includes provisions about obtaining data subjects’ consent and using adequate security to protect their information. Failure to comply could result in millions of dollars in fines.

Who is Exempt from GDPR?

The GDPR does not apply to anyone who stores or uses person’s data for personal use – like if you maintain a personal database of contacts, and some of them happen to be people who live in the EU.

It also doesn’t apply to anonymous persons or dead people.

Complying with the GDPR

I have read the GDPR from cover to cover (260 pages). A significant amount of my work in early 2018 will be related to GDPR compliance – starting with my own company

My rule for my email list is people add themselves. It’s disrespectful when companies add you to their email list without consent, so I don’t do it. As a result, I have no idea where most of my subscribers are located. I have assume at least one of them is a person who resides in the EU, therefore the GDPR applies.

For the next few weeks, I’m going to be breaking down this law into it’s requirements and applying them to my business so I can, in turn, educate and help other companies modify their policies and practices before the law goes into effect on May 25, 2018.

This is not a law that companies can easily comply by adding a new paragraph to their terms of service. It will change their tactics and approach to content marketing.

If you want more information about GDPR, please watch this site and my YouTube channel because I’m creating a substantial amount of content on this topic. You can also send me an email (Note: I can’t give advice to non-clients). I use my mailing list to I share my thoughts about being a lawyer/entrepreneur, updates about projects I’m working on, upcoming speaking engagements, and I may provide information about products, services, and discounts. Please add yourself if you’re interested.

You can also connect with me on TwitterFacebookYouTube, or LinkedIn.

Private Online Groups May Not Be Private

Child’s Playhouse, Bayreuth, Germany by Dave Shafer from Flickr (Creative Commons License)

I was contacted by person who claimed to be a member of a private Facebook group. She asked if she had any options for recourse when another group member used statements from her post in another article online. This group member also used a pixelated version of the person’s Facebook profile picture. According to the person, she wasn’t recognizable in the altered image, but she feared people could figure it out if they compared to her profile picture to the pixelated one.

No Expectation of Privacy in Online Posts
To anyone in this type of situation, I’m sorry to dash your hopes for vindication, but in most situations, there is no expectation of privacy in what you post on the internet – especially on social media, regardless of the privacy settings. It’s too easy for someone to create a screenshot, save, and/or share a post. Moreover, you never know who is looking over a user’s shoulder or with whom they’ll share their screen when they’re viewing your post that is meant for their eyes only.

This is true even when an online group is labeled as “private” or “closed.”  In many private or closed Facebook group, other members can invite outsiders to join or a new person can join if their request to be added is approved by one member of the group. Even though a private group is meant for a limited audience, post with care. You never know where a post will end up. This is why one of my rules of thumb for the internet is “Don’t post anything online that you wouldn’t put on the front page of the newspaper.”

If You Want Real Privacy
If you want to have a private conversation, keep it offline with your closest confidants or someone with who you have a confidential relationship (e.g. doctor, lawyer, therapist, priest). In a professional setting, have a written non-disclosure agreement(NDA) where everyone is contractually obligated to maintained your confidences.

Even I use NDAs. I have certain people, where when we sit down for a drink, we start the conversation by saying, “Standing NDA” and we know nothing said between us will be shared with outsiders.

The Internet is Not a Place for Privacy
If there are times when you want to speak online while maintaining a level of privacy, you can reduce the risk of being connected to a statement by using an online alter ego. If you go this route, be prepared to be unmasked and live with the consequences at any time. You may use an IP address or post something that will give away your true identity.

If you want a resource regarding the legal dos and don’ts about the internet, including additional information about online privacy, please check out The Legal Side of Blogging: How Not to get Sued, Fired, Arrested, or Killed. If you need legal help regarding internet privacy, you can contact me directly or a social media lawyer in your community. I post about these issues on TwitterFacebookYouTube, and LinkedIn. You can also get access to more exclusive content that is available only to people on my mailing list, by subscribing here.

How to have an Anonymous LLC

Anonymous by Poster Boy NYC from Flickr (Creative Commons License)

Here’s the easy answer: You don’t.

It may be impossible to own an LLC anonymously. There’s always a paper trail and financial records that eventually lead to you.

Burying Your Identity in Your LLC
Creating an LLC requires paperwork and money. The Articles of Organization that are filed with the State are public records. If you didn’t want to have your name on your company, you set up layers of companies that own companies that own your LLC so it would take longer to trace it back to you. You could also set up a blind trust where you are the beneficiary. That would keep your name off the public records, but there would still be documents somewhere that show the connection. (Because business filing are public records, I often recommend that clients not use their home address as their business address. There are many low-cost mailbox services.)

Even if your name is not on the company as an owner, there would still be the records of payments to you. It may require a court order for someone to gain access to this information, but it would be telling if the majority of payments from the company (or companies if you ran it through multiple entities) went to a single person.

When someone asks how to be an anonymous owner of a company, it raises a red flag for me about their motivations and their business activities. If a company or person is controversial or engaging in potentially malicious acts, it may raise enough eyebrows that someone will be motivated to take a closer look at its inner workings.

How to Run a Website Anonymously
Conversely, it may be possible to operate a website relatively anonymously. You would have to essentially divorce yourself from the website:

  • Use an email address for the website registration that isn’t otherwise connected to you. Don’t access this email using your phone.
  • Pay for the website with a pre-paid credit card.
  • Use a web hosting service that protects your information.
  • Only access the website using public wifi. Never access it from work or home.
  • Turn off your phone when working on your website – so the GPS in your phone will be turned off.
  • Consider using an app that masks or mocks your GPS location when you access the internet.

Even when you take all the precautions to be anonymous online, be prepared to be unmasked at anytime. Whatever you say anonymous, you best be ready to own it once your name and face are attached to it.

If you want a resource regarding the legal dos and don’ts regarding posts on the internet, please check out The Legal Side of Blogging: How Not to get Sued, Fired, Arrested, or Killed. If you need legal help regarding internet privacy, you can contact me directly or a social media lawyer in your community. I post about these issues on TwitterFacebookYouTube, and LinkedIn. You can also get access to more exclusive content that is available only to people on my mailing list, by subscribing here.

Lawsuit Filed to Unmask Anonymous Penis Sender

Don’t Mess with Texas by Jamie from Flickr (Creative Commons License)

Last week, Melody Lenox filed a lawsuit in Dallas County, Texas for a court order to determine who sent her a penis-shaped gummy candies via Dicks By Mail.

At first, this sounded like an extreme reaction. If someone spent $15 to send me candy via mail with a note that says “Eat a Bag of Dicks,” I’d probably laugh, and then eat them – because gummy candies are delicious. However, learning about the larger context of the situation, Lenox’s reaction seems reasonable.

The Bigger Story
Lenox is the head of human resources at Axxess Technology Solutions, a position that requires her to be the bearer of bad news to some employees. Prior to this unsolicited dick package, she allegedly had her car keyed and was the target of fake posts on Craigslist. She asserts that these acts are related.

In this context, pursuing a harassment lawsuit against the sender of these candies (assuming the same person(s) are committing these acts), makes sense. Ongoing acts like this are unacceptable.

What I suspect is happening in this case is Lenox filed a lawsuit against John Doe and then requested a court order to get the purchase information from Dicks By Mail. (Many companies have privacy policies that state they’ll protect your information unless they are required to provide it in response to a court order.) While it’s easy to key a car or post a fake Craigslist post anonymously, sending candy by mail requires a credit card, which will eventually lead to a real person – the suspected harasser.

Unmasking the Anonymous
Anytime you do something anonymously, be prepared to be unmasked. When you act anonymously online, there’s always a digital paper trail that shows the IP address of the internet connection used, the GPS location of your smartphone, the profile information of an anonymous website or social media profile, and in this case, the credit card information used for the transaction.

There have been plenty of situations where a person lost their job or found themselves in a lawsuit when their anonymous persona was unmasked. Using the internet is not an effective way to maintain your anonymity – unless you have mad skills in this area. (And if you have to question whether you have mad skills, you don’t.)

More about Dicks By Mail

Photo from Dicks By Mail

Dicks By Mail is a hilarious way to send a light-hearted sugar-filled message. The company does not endorse the use of their service to threaten or bully someone. If you receive Dicks By Mail it should only be for two reasons: “[S]omeone thinks you’re either a dick or wanted you to laugh!”

And they do caution people who come to the site with vindictive intent: If you are sending this with the intent to ruin someone’s day, then maybe it’s you who needs to eat a bag of dicks.”

In case you were wondering, yes, Dicks By Mail is a U.S.-based business, so if you want to stimulate the economy while telling your elected officials what you think of them, this may be a creative way to send a message (though, it may not be effective since they won’t know it came from a constituent).

The laws that apply to the internet are constantly evolving as the courts are encountering more internet-based problems. If you want to connect with me to keep up with my thoughts about social media law, you can contact me directly or connect with me on TwitterFacebookYouTube, or LinkedIn. You can also get access to more exclusive content that is available only to people on my mailing list, by subscribing here.

Should your Child have a YouTube Channel?

Tire Swing by RichardBowen from Flickr (Creative Commons License)

Tire Swing by RichardBowen from Flickr (Creative Commons License)

I recently spoke at a family law conference on how to get usable evidence from social media. Afterwards, a woman approached me and said her 11 year-old child asked to have YouTube channel and several his friends already had channels. She wasn’t sure if she should let him and asked for my input.

Google Says No
The easy and obvious surface-level response to this question is Google (which owns YouTube) doesn’t allow anyone to have an account that is under 13 years old. (That’s the rule for all social media accounts in the U.S., by the way.) However, there’s nothing wrong with a parent creating a separate Google account to use with their child to create content for a YouTube channel.

Teachable Moments and Skill Development
My first response to the idea of a child having a YouTube channel, is that it’s a great opportunity to develop their skills – both as a content creator and as a person interacting with others online. Before letting the child create video content, have a serious planning discussion with them about what they want to create, their motivations for creating it, and what topics/language are off-limits. All these things should be written down; it’s good practice for creators to have a thoughtful for plan for what they want to create. You can help your child develop their video editing and copyright writing skills, as well as learn the rules about using others’ content and doing product reviews online that comply with the federal rules.

The parent(s) should review the child’s final draft of a video before it is uploaded to their channel to make sure they’re following the rules. This is an ideal opportunity to talk with your child about the potential long-term effects of a piece of content, and how they would react if they receive feedback from peers or teachers about it at school. Also, you want to decide in advance whether you will allow comments on your child’s videos. It may be prudent to turn these off, at least at first. Allowing your child to post content online comes with the responsibility of being mindful about who is trying to interact with them – either through comments, email, or direct messages.

Safety First
If you let you child have a YouTube channel, regardless of their age, be sure you’re monitoring both what they’re communicating to others (publicly and privately) and what others are saying to them. If they are under 18 years old, you should have the passwords to all their accounts and their phone so you can effectively and closely monitor what they’re doing online. The younger they are, the more oversight they need. Use effective software to monitor and protect your kids. Here’s some real-life advice from geek parent Susan Baier about her experience raising a geek child:

I also strongly recommend that you read the books by security expert Gavin de Becker, especially The Gift of Fear and Protecting the Gift. If you want a resource about the legal dos and don’ts about social media for yourself and your children, I suggest you read The Legal Side of Blogging: How Not to get Sued, Fired, Arrested, or Killed. The lessons in there apply to all social media platforms, including YouTube. If you want to connect with me and my thoughts about children using the internet, you can contact me directly or connect with me on TwitterFacebookYouTube, or LinkedIn. You can also get access to more exclusive content that is available only to people on my mailing list, by subscribing here.

Someone Posted a Photo of Me Online Without Consent

Photographer by Robert Cooke from Flickr (Creative Commons License)

Photographer by Robert Cooke from Flickr (Creative Commons License)

People come to this site almost every day with questions about whether someone can post their picture on the internet without obtaining consent. Some people even ask if it’s a crime or whether they can sue.

Sue for what? Which of your rights have been violated?

Of course, each situation must be evaluated on its merits. It’s possible that a person is concerned with an intimate photo, a photograph that was taken in a bathroom, or circumstances where they are being harassed. I’m not saying that there aren’t situations where a person’s rights may have been violated; however, the frequency with which I get these questions makes me wonder whether most of these people have a legitimate legal concern or merely hurt feelings.

No Expectation of Privacy in Public
Remember, in the U.S., there is no expectation of privacy in anything you do in public (exceptions of course for places like bathrooms, confessionals, etc.). So, if someone snaps a photo of you that is less than flattering, and they post it on the internet, as long as they are not violating your rights, there’s nothing you can do about it.

Maybe they took a photo of you not putting your shopping cart away, walking around with your skirt tucked into your underwear, or texting while driving. I think there are much more important things to talk about in general and definitely that are worth of documenting permanently online; however, it’s not illegal. Just like it is not illegal to be stupid, it is not illegal to post stupid things online. The internet is full of stupid.

So What Do You Do?
Well, if you truly believe that you’ve been the victim of a crime or that your rights have been violated, contact the police or buy an hour with a lawyer to review your situation. You may be in a situation where your legal rights have not been violated but the posting itself and violates the terms that apply to the site where it was published. In that case, reporting the image to the website administrators may be sufficient to get it removed.

If it is purely a situation where you are merely angry or upset, and the person won’t remove the image when asked, let it go. If you’re embarrassed by your behavior, don’t do it again. If you’re in a situation where the image shows up if someone Googles your name, you can try to bury it by manipulating the search algorithm. Hopefully it’s not a situation where you screwed up so badly that the image or situation is going to dominate the search results for years to come.

On the Flip Side
If you’re thinking about snapping a picture of someone, check your motives. If you’ve taken a picture and you have the impulse to share it online, double and triple check your motives. What are the benefits of sharing this image? Are you being vindictive? If the situation were reversed, would you want an image of you in a similar situation posted? What if the person in the picture was your parent or significant other – would you post it then?

The person in the photo isn’t the only one at risk of losing face. Do you want to be the jerk who not only took this photo, but also shared it? You could harm yourself as well as the other person.

What is socially inappropriate and what is illegal are often two drastically different standards. My rule of thumb for this situations is the same: Think before you act. Think before you post. If you want to talk more about internet privacy or social media law, you can contact me directly or connect with me on TwitterFacebookYouTube, or LinkedIn. You can also get access to more exclusive content that is available only to people on my mailing list, by subscribing here.

Typical Sex Video Email Conversation

What Are You Looking At by nolifebeforecoffee from Flickr (Creative Commons License)

What Are You Looking At by nolifebeforecoffee from Flickr (Creative Commons License)

I regularly receive emails from people asking questions about the legalities related to intimate photos and videos – particularly situations when a third party has possession of them. Sometimes the third party allegedly obtained them nefariously and sometimes the people emailing me voluntarily sent the person photos or video and now they have concerns about what said person will do with them.

Now they have concerns?! These are questions they should have asked themselves before they sent the photos/video to begin with!

Here’s an example of how these conversations typically go. The text in italics are things I usually think, but don’t share with the other the person in the moment.

Prospective Client (PC): I made a video with my boyfriend and his ex got a hold of it. His ex is threatening to send it to my parents and post it. What can I do about this?

How did his ex get access to your sex video? This sounds like someone neither of you should have contact with.

ME: How old are you?

Please don’t be a child . . . please don’t be a child . . . please don’t be a child . . . (Yes, sometimes it’s a minor – or so they say.)

PC: 24.

ME: Thank goodness this isn’t a potential inadvertent kiddie porn situation.

You’re an adult. Besides being embarrassing, who cares if this person shows the video to your parents? (I’ve also had people email me claiming the third party is threatening to send it to the PC’s employer.)

ME: Where do you and the ex live?

In Arizona, merely threatening to post revenge porn is a felony.

PC: Nebraska.

Ok, well that’s outside the limits of my law license and revenge porn legal knowledge.

ME: Here’s the list of the current revenge porn and related laws in all 50 States. This will tell you how the laws in your State apply to these situations.

PC: I don’t know what to do. I want to go to the police but I don’t know if I can do that.

ME: Of course you can go to the police! Give them a call, explain your situation, and ask if there’s anything they can do to help you. They may be the best ones to know if this situation violates your State’s criminal law.

And maybe some local resources too that help people in these types of situations.

I get questions and hits on my site every day from people asking about intimate photos and videos, not all of which were taken with consent, and how to keep them from getting out. Unfortunately, I also get hits from people who want to post revenge porn without repercussions – which is disgusting.

When in doubt – don’t. Don’t create intimate photos or videos, don’t share them with others, and don’t post them online. What seemed like a good idea in the moment, may create long lasting regret, especially if it shows up when someone Googles your name. However, if you choose to create this type of material, do it with your device, keep it under password, and never let the files out of your control. Once this material is released, it’s hard to get it back or verify that every copy has been destroyed.

We’re still in the infancy of how we’re going to deal with intimate photos and videos from a social and legal perspective. If you want to chat with me about revenge porn, privacy, or any related topics, you can contact me directly or connect with me on TwitterFacebookYouTube, or LinkedIn. You can also get access to more exclusive content that is available only to people on my mailing list, by subscribing here. If you think you’re the victim of revenge porn or threatened revenge porn, contact your local law enforcement agency.

Creeper Cosplay Video | Is That Legal

Gradisca Cosplay Photo Contest 2014 by chripell from Flickr (Creative Commons License)

Gradisca Cosplay Photo Contest 2014 by chripell from Flickr (Creative Commons License)

A contact at Phoenix Comicon sent me a link to an amateur video from this year’s event. Apparently it’s feuled quite a bit of discussion regarding the legalities of shooting video at pay-to-attend events.

My initial thoughts about this video: It’s creepy.
This guy knowingly and intentionally videorecorded women without their consent and posted the compilation online in a way that objectifies them. It’s all about their bodies. Did you notice he taped at least one woman while she was walking away from the bathroom? Eww! And what’s with that disturbing music with women crying on it? This guy is right up there with creepy yellow coat man from the 2010 No Pants Light Rail Ride.

What made this video so disturbing? Greg Benson of Mediocre Films does videos of women in cosplay at San Diego Comic-Con and I’ve never had an issue with it. I watched one of his videos from last year for comparison:

I don’t have an issue with this video for several reasons:

  • He obviously gets consent from the women to film them. There’s no hidden agenda.
  • He interacts with these women. Even when he’s enjoying the beauty around him, Greg treats these women like people, not a peep show.
  • The video has a dual purpose – one of which is showcasing these stunning costumes. (Hey Greg – if you do another video like this, would you please call it “Women of Comic Con” instead of “girls?” It’s a better embodiment of these women’s badassery.)

So is Creeper Guy’s video from Phoenix Comicon illegal?
Probably not – at least based on the footage posted. It’s not illegal to be a jerk.
If he had a ticket to the event, he wasn’t trespassing. The polite thing to do at a con is to ask permission before taking photos of attendees, but it’s not required.  He could have been a guy walking around looking like he was shooting general footage of the event, which lots of people do.

So far he’s not running ads on the video in question, so he’s not publicizing anyone’s image without permission. Phoenix Comicon is an event that’s open to the public to attend so there’s no expectation of privacy on the expo floor.

Is what this guy did vile? Yes.
Should he be banned from future Phoenix Comicon events? Perhaps, but that’s not my call to make. With a crowd of over 80,000 in attendance, it would be easy for someone to slip in.

However, instead of dealing with this situation from purely a legal perspective, I encourage the community to be aware of creepers at events like Phoenix Comicon. If you see someone leering at others or doing vulgar things like filming people’s asses as they walk, call them out and/or report them to event security. If you see someone being harassed, report that too and support that person. We have an obligation to keep an eye on each other.

There’s nothing wrong with enjoying the view, as long as you can do it appropriately. Remember, cosplay is not consent.

This is an issue impacting the entire geek/con community. If you believe you are the victim of a crime at a con, contact law enforcement for assistance. If you have questions about social media law or internet privacy that you want to discuss with me, you can contact me directly or connect with me on TwitterFacebookYouTube, or LinkedIn. You can also get access to more exclusive content that is available only to people on my mailing list, by subscribing here.

Arizona’s New Revenge Porn Law

Bound by Connor Tarter from Flickr (Creative Commons License)

Bound by Connor Tarter from Flickr (Creative Commons License)

Arizona has rejoined the ranks of U.S. states that have criminal law against revenge porn. This bill was announced with much fanfare in January, but there was barely a whisper when Governor Ducey signed it into law earlier this month. And because this law was passed on an “emergency” basis, it became effective the moment it was signed.

The New Law
A.R.S. § 13-1425 makes it illegal to intentionally disclose the image of an identifiable person in a state of nudity or engaged in sexual activity, when the person has an expectation of privacy, with the intent to harm, harass, intimidate, threaten, or coerce the depicted person. Some important things to note, “image” includes photos, videos, and other digital recordings; and to “disclose” an image means to display, distribute, publish, advertise, or offer.

Offer. Just offering to share revenge porn could be a crime.
Let that sink in for a minute.

The Penalties
If you are convicted of revenge porn using electronic means (email, text message, or social media) under this new law, it’s a Class 4 felony, which is punishable by 1.5 years in prison and a fine up to $150,000.

If you’re convicted of threatening to post/share revenge without actually disclosing the image, that’s a Class 1 misdemeanor, punishable by 6 months in prison and a fine up to $2,500.

Additionally, it will be up to the judge’s discretion to declare whether your crime makes you a registered sex offender.

These are significant punishments for actions taken when you’re merely pissed off at an ex. It’s not worth the risk when the consequences are this severe.

What if I Sext Someone a Naked Picture?
One question I’m frequently asked is if someone texts or emails you a naked selfie, whether you can post that image online. If someone sends you an explicit image, they have not relinquished their expectation of privacy. If you post that image online or share it with others, it could be criminal revenge porn.

If you believe you are the victim of revenge porn or threatened revenge porn, contact law enforcement for assistance. I’m curious to see the outcomes of the first cases tried in Arizona under this new law. If you have questions about social media law or internet privacy that you want to discuss with me, you can contact me directly or connect with me on TwitterFacebookYouTube, or LinkedIn. You can also get access to more exclusive content that is available only to people on my mailing list, by subscribing here.