As Expected, US Surveillance Of Social Media Leads To EU Court Of Justice Rejecting EU/US Privacy Shield

from the now-what? dept

This one sounds boring, but stick with it because it's important. Because the US and the EU have vastly different privacy regulation regimes, there has always been some conflict over how (mainly) US internet companies handle data from the EU. For years, this was "settled" by a weird and mostly useless "EU-US data protection safe harbor" agreement, in which US companies would have to get "certified" that they kept EU-originated data protected at an "equivalent" level to how it would be protected in the EU when transferring it across the Atlantic to US-based data centers. It was a bit of a nuisance as a company (we went through the process ourselves), but in 2015 the entire safe harbor agreement was invalidated by the EU Court of Justice because of the NSA's ongoing snooping on data from those internet companies, as revealed by Ed Snowden.

The EU and US freaked out, and had a frantic negotiation to come up with a new "safe harbor" agreement with the catchier name of "Privacy Shield," but as we pointed out when it was announced, the problem wasn't the text of the agreement, but rather the NSA's surveillance practices with regards to internet data. Here's what I wrote four years ago:

The real issue here is mass surveillance overall. The only real way to fix this issue is to stop mass surveillance and go back to saying that intelligence agencies and law enforcement need to go back to doing targeted surveillance using warrants and true oversight. But, instead, the EU and the US keep trying to paper over this by coming up with a new agreement.

Since then, the Privacy Shield was challenged and the challenge took its sweet time to go through the courts -- again brought by Max Schrems, whose lawsuit had sunk the original safe harbor as well. And, now, finally, four years later exactly what we expected to happen has happened. The CJEU has invalidated the Privacy Shield agreement, by basically saying "hey, the US surveillance regime remains the same, and that was the problem all along." You can read the full decision if you want to get deep into the details.

But the short summary is that while the Privacy Shield framework offered a few ways for EU residents to seek redress from some forms of surveillance, the CJEU says that's not nearly enough:

While individuals, including EU data subjects, therefore have a number of avenues of redress when they have been the subject of unlawful (electronic) surveillance for national security purposes, it is equally clear that at least some legal bases that U.S. intelligence authorities may use (e.g. E.O. 12333) are not covered. Moreover, even where judicial redress possibilities in principle do exist for non-U.S. persons, such as for surveillance under FISA, the available causes of action are limited … and claims brought by individuals (including U.S. persons) will be declared inadmissible where they cannot show “standing” …, which restricts access to ordinary courts …

As you may recall, Executive Order 12333 is the tool under which the US does most of its foreign surveillance totally outside of the oversight of Congress. This has always been a massive problem, and here the CJEU is basically saying "if the US doesn't do wholesale surveillance reform, there's going to be a serious problem with transferring data from the EU to the US."

Now, there is some argument here that EU surveillance is just as bad, and it's perhaps more than a little silly that the CJEU basically ignores that as if it's not important.

Either way, the key point to all of this is that if US companies want to be able to transfer data over from the EU to the US long term (there are ways they can do it for now), the US government needs to vastly reform its surveillance practices. Well, assuming there was a competent government that actually cared about these things. I'm a bit worried that the current administration will just ignore this or use it to attack the EU, which would be somewhat disastrous for US internet companies.

I've seen some people saying that this is a ruling against the internet companies and their data collection practices, but that's not really accurate. The problem is not so much that -- it's how the NSA spies on people with that data (with or without cooperation of the companies). This really should lead to the US internet industry pressuring the US government to stop mass surveillance -- just like we said four years ago.

Filed Under: data protection, eu, gdpr, mass surveillance, max schrems, nsa, privacy shield, surveillance
Companies: facebook, noyb

It's Impossible To Opt Out Of Android's Ad Tracking; Max Schrems Aims To Change That

from the another-reason-to-use-apple? dept

Most of the world has been under some form of lockdown for weeks, but that clearly hasn't stopped the indefatigable Austrian privacy expert Max Schrems from working on his next legal action under the EU's GDPR. Last year, he lodged a complaint with the French Data Protection Authority (CNIL) over what he called the "fake consent" that people must give to "cookie banners" in order to access sites. Now he has set his sights on Google's Android Advertising ID, which is present on every Android phone. It builds on research carried out by the Norwegian Consumer Council, published in the report "Out of control".

Today noyb.eu filed a formal GDPR complaint against Google for tracking users through an "Android Advertising ID" without a valid legal basis. The data collected with this unique tracking ID is passed on to countless third parties in the advertising ecosystem. The user has no real control over it: Google does not allow to delete an ID, just to create a new one.

The Android Advertising ID (AAID) is central to Google's advertising system. It allows advertisers to track users as they move around the Internet, and to build profiles of their interests. Google claims that this "gives users better controls", which is true if people want to receive highly-targeted advertising. But if they wish to opt out of this constant tracking, there is a problem. Although Google allows you to change your AAID, it is not possible to do without it completely: the best you can manage is to get a new one. And as the detailed legal complaint to the Austrian Data Protection Authority (pdf) from Schrems points out, there are multiple ways to link old AAIDs with new ones:

Studies and official investigations have proved that the AAID is stored, shared and, where needed, linked with old values via countless other identifiers such as IP addresses, IMEI codes and GPS coordinates, social media handles, email addresses or phone number, de facto allowing a persistent tracking of Android users.

Schrems' organization None of Your Business (noyb.eu) claims that's unacceptable under the GDPR:

EU Law requires user choice. Under GDPR, the strict European privacy law, users must consent to being tracked. Google does not collect valid "opt-in" consent before generating the tracking ID, but seems to generate these IDs without user consent.

Google's position is weakened by the fact that Apple gives users of its smartphones the ability to opt out of targeted ads; for those using iOS 10 or later, the advertising identifier is replaced with an untrackable string of zeros:

If you choose to enable Limit Ad Tracking, Apple's advertising platform will opt your Apple ID out of receiving ads targeted to your interests, regardless of what device you are using. Apps or advertisers that do not use Apple’s advertising platform but do use Apple's Advertising Identifier are required to check the Limit Ad Tracking setting and are not permitted by Apple's guidelines to serve you targeted ads if you have Limit Ad Tracking enabled. When Limit Ad Tracking is enabled on iOS 10 or later, the Advertising Identifier is replaced with a non-unique value of all zeros to prevent the serving of targeted ads. It is automatically reset to a new random identifier if you disable Limit Ad Tracking.

The formal legal complaint was filed on behalf of an Austrian citizen, requesting that the AAID should be deleted permanently. If the action succeeds, that would allow anyone in the EU -- and probably elsewhere -- to do the same. In addition, the complaint points out that under the GDPR, the maximum possible fine, based on 4% of Google's worldwide revenue, would be about €5.94 billion. There's no chance such an unprecedented sum would be imposed, but the fact that every Android user in the EU is forced to use Google's AAID could lead to a fairly hefty fine if Schrems succeeds with his latest legal defense of privacy.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: android, android advertising id, eu, gdpr, max schrems
Companies: google, noyb

Facebook Claims Users Sign Up Because They Want To See Personalized Ads, Max Schrems Disagrees -- And Usually Wins These GDPR Arguments

from the time-to-start-planning-for-defeat dept

The privacy activist Max Schrems has been conducting a battle on multiple fronts against Facebook's use of personal data. Last year, Techdirt wrote about one of the skirmishes, which saw the EU's highest court, the Court of Justice of the European Union (CJEU), ruling that Schrems could use the GDPR to litigate in Austria, where he is based, rather than in Ireland, where Facebook has its international headquarters. The latter option would have been prohibitively expensive for Schrems, and would probably have meant he dropped the case.

Schems has now begun his legal action in Austria, before the Vienna Regional Court. According to Schrems, Facebook admitted that it has been collecting and processing data without users' consent since the introduction of the GDPR last year. However, in an interesting move, Facebook has claimed that it is not breaking EU law for the following reason:

According to the GDPR, in addition to consent, there is also the possibility of processing data for the "performance of a contract" (Article 6(1)(b) GDPR). Facebook now claims to have concluded such an "advertising contract" with users who, according to Facebook, have ordered "personalized advertising" when they signed up to the new terms and conditions on May 25, 2018.

Essentially, Facebook is claiming that people join its service because they are simply dying to see all those personalized ads that Facebook wants to show them. To counter that novel claim, Schrem's organization NOYB commissioned a study by the Austrian Gallup Institute, which interviewed a representative sample of 1000 Austrians (original in German - pdf). According to Gallup, only 4% of the sample actually loved the ads, with 6% liking them slightly, 21% indifferent and 69% disliking them or really disliking them. That's only one survey, but it certainly suggests that Facebook is clutching at straws with its new line of arguing. According to NOYB:

Cecilia Álvarez (Privacy Policy Director of Facebook EMEA) was questioned by the Viennese judge yesterday. However, she was unable to answer many of the questions. Facebook's lawyers argued that she lacked the "technical understanding" to answer questions on Facebook's handling of personal data.

As Schrems points out, Facebook would have the court believe that users know exactly what they are committing to when they agree to the service's terms and conditions, and yet: "not even the top Facebook privacy expert can explain exactly what the company does with our data." The hearing before the Viennese court to decide the issue has been adjourned until February, so nothing more will happen until then. But the stakes are high. Schrems comments: "If we succeed, Facebook will have to change its practices to comply with the GDPR and give users real voting rights. That’s our goal."

Moreover, a victory by NOYB on this point, if confirmed by the CJEU, would affect every company operating in the EU that gathers private data from its users, and sells advertising based on the personal details. However much Internet services like Facebook and Google might hate that prospect, they know that it is a real possibility, as proved by Schrems' already impressive track record of winning these kind of GDPR arguments.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: austria, eu, gdpr, max schrems, permission, personalized ads, privacy
Companies: facebook, noyb

Max Schrems Files New Privacy Complaints That Seem To Show The Impossibility Of Complying With The GDPR

from the what-a-stupid-law dept

We've written many times about privacy activist Max Schrems, who almost single-handedly brought down the silly privacy safe harbors between the EU and the US. Last year, we wrote about his newest project called noyb.eu, which stands for "None Of Your Business."

Last week, Schrems and noyb announced a big list of GDPR complaints filed in Austria, against basically every streaming media company, none of which -- they claim -- are in compliance with the GDPR. Schrems also provided everyone with a handy dandy chart showing the basic details of the results of the GDPR requests they made to eight different streaming platforms, where they fell down, and how much they might be on the hook for:

If you'd like to see the actual complaints, here they are for Amazon, Apple, DAZN, Flimmit, Netflix, Soundcloud, Spotify, and YouTube.

I have lots of thoughts about this, so let's list them out:

1. This demonstrates the near impossibility of complying with the GDPR: While I'm sure many will view this as a positive for the GDPR, in that Schrems is going after a bunch of big companies who many people love to hate, I'd argue that these complaints really show just how ridiculous the GDPR is in practice. At least with the larger companies on this list (Amazon, Apple, YouTube, Netflix, and Spotify) it is ridiculous to argue that any of them were deliberately avoiding the GDPR requirements. All of those companies have been well aware of the GDPR for years and spent the past few years spending many, many millions of dollars preparing for the GDPR. All have decently large teams focused on doing everything they can to comply, in part because of the possibility of massive fines if they fail.

   The fact that those large companies, who have all the resources in the world, are still deemed by Schrems to fail on nearly every aspect of the GDPR suggests, pretty clearly, that it is nearly impossible for anyone to truly be GDPR compliant in any reasonable sense.

2. The nature of the complaints shows just how silly the GDPR continues to be: Taking the Apple Music complaint as an example, the company did allow noyb and its client to download all the data it had, but noyb is demanding significantly more information under the GDPR -- much of it is information that would effectively be impossible to provide in the first place. For example, the complaint notes that Apple didn't provide "information about the purposes of the processing." But... isn't that the kind of information that anyone signing up for Apple Music already knows about when they sign up? Apple is using your information to provide you access to music and to recommend other music to you. What good does it do to have that information need to be spelled out once again at a later date to avoid massive billion dollar fines?

3. The possible fines remain completely insane: Note the numbers on the "maximum penalty" associated with these complaints. Under the GDPR, a company can be fined either €20 million or 4% of annual global turnover whichever is greater. So those eye-popping numbers are basically that 4%. Remember, most of the companies here bent over backwards to try to comply, with most of them setting up useful systems that allow users to download all of their data, even if noyb didn't like the format that data was in. And yet they might still face billions in fines?

4. GDPR could destroy some of these companies: It is surprising to see two companies -- DAZN and Soundcloud -- not respond at all to these requests. Both of them are based in the EU (though DAZN may escape via Brexit shortly, but it operates in many EU countries). I would think, at the very least, these companies would have in place some method of responding to GDPR requests. Soundcloud, despite its level of popularity, has struggled even to stay alive -- and came very close to shutting down a year and a half ago before getting a last minute reprieve from some investors. Either way, the company is clearly struggling, and the fact that both of these company's "maximum" possible fines are €20 million suggests that this is "greater" than 4% of their annual turnover. In short, this is likely a crippling and possibly company-destroying amount for these smaller operations. I'm still surprised neither responded to the requests at all -- but it's going to be difficult for either to stay in business facing these kinds of headwinds thanks to the EU's overaggressive regulations.

I'm sure that many don't seem to care that this might cause problems for these companies, or that it may be literally impossible to comply with these regulations. But we should all be concerned if regulations make it effectively impossible to be in business on the internet in the EU. We should be even more concerned that -- as many of us predicted -- regulations like the GDPR seem to have a high likelihood of completely destroying smaller players, like SoundCloud. The huge fines for the big companies are eye-popping and totally disconnected from any actual "harms," but most of those big companies can grudgingly afford to pay them. That seems unlikely for the smaller players meaning that -- once again -- the EU seems to be clearing the field of smaller internet companies, and leaving in place only the giants, from whom the government will just keep siphoning off cash.

One final point on all of this: I recognize that there are lots of legitimate concerns about privacy in this day and age -- and, in particular, how various data collection companies are using our private data. And I've long been on record that companies should be not just a lot more transparent about the data they collect and how they use it, but also should push control over that data out to the end users. But, looking over this list, none of these are companies that I'm particularly worried about concerning how they use my data. Yes, there are potential privacy concerns here, but the idea that SoundCloud or Spotify contains data so sensitive that they should be fined massive amounts for not making it "intelligible" just seems disconnected from any real harms and any real concerns.

Indeed, my concern with this type of litigation is that it actually waters down and distorts the real concerns we should be having over privacy in the internet era. Netflix not giving me all of the data on what I've been watching via streaming doesn't seem like a particularly big consumer concern -- and yet if it sucks all the air out of the room, it makes it that much harder to deal with real privacy questions raised by internet giants.

Filed Under: data protection, eu, gdpr, max schrems, privacy, streaming
Companies: amazon, apple, dazn, flimmit, netflix, noyb, soundcloud, spotify, youtube