EU Parliament Told Predictive Policing Software Relies On Dirty Data Generated By Corrupt Cops

from the junk-data,-garbage-outcomes dept

Predictive policing efforts continue to expand around the world. Fortunately, so has the criticism. The data witchcraft that expects a bunch of crap data created by biased policing to coalesce into actionable info continues to be touted by those least likely to be negatively affected by it: namely, law enforcement agencies and the government officials that love them.

The theory that people should be treated like criminals because someone else did some crimes in the area in the past is pretty specious, but as long as it results in temporary drops in criminal activity, fans of unreasonable suspicion will continue to use these tools that still have no long-term proven track record.

It's not just a US problem. It's a problem everywhere. The European Parliament has been asking for feedback on predictive policing efforts, which is more than most agencies in the US are willing to do. The Executive Director of the AI Now Institute, Andrea Nill Sanchez, recently testified during a public hearing on the issue, using the Institute's 2019 report on predictive policing to highlight everything that's wrong with turning law enforcement over to modeling algorithms. (via The Next Web)

The point of Sanchez's testimony [PDF] is this: we can't trust the data being fed to these systems. Therefore, we definitely can't trust the predictions being produced by them. Dirty cops create dirty data.

Despite what the term may suggest, predictive policing is neither magic nor a precise science that allows us to see into the future. Instead, predictive policing refers to fallible systems that use algorithms to analyze available data and aim to produce a forecasted probability of where a crime may occur, who might commit it, or who could be a victim.

Left unchecked, the proliferation of predictive policing risks replicating and amplifying patterns of corrupt, illegal, and unethical conduct linked to legacies of discrimination that plague law enforcement agencies across the globe.

This is drawn from AI Now's report, which pointed out some of the most corrupt police forces in the nation were feeding data from biased policing into systems that were now destined to generate nothing but more of the same corruption.

(1) Chicago, an example of where dirty data was ingested directly into the city’s predictive system; (2) New Orleans, an example where the extensive evidence of dirty policing practices and recent litigation suggests an extremely high risk that dirty data was or could be used in predictive policing; and (3) Maricopa County, where despite extensive evidence of dirty policing practices, a lack of public transparency about the details of various predictive policing systems restricts a proper assessment of the risks.

This is only one of several problems. First, almost every system used by law enforcement agencies is a closed system, unable to be inspected by anyone outside the companies that sell them and the agencies that use them. There's nearly no way for outsiders to vet data or outcomes. They can only judge the systems by the results. And those results are withheld or released pretty much at the sole discretion of the agencies using predictive policing software. If it's not producing decreases in crime rates, citizens will be the last to know.

Second, the data used is both tainted and selective, skewing the output towards the selective enforcement agencies already engage in.

[P]redictive policing primarily relies on inherently subjective police data, which reflects police practices and policies—not actual crime rates. Law enforcement exercises enormous discretion in how it carries out its work and collects data, including the crimes and criminals it overlooks.

Finally, there's no way to cleanse the systems of dirty data. Police departments are unable to recognize that their own biases might taint inputs. And citizens are powerless to challenge the data that's being used to target them for increased law enforcement scrutiny. With pushback effectively neutralized -- both by police practices and the secrecy surrounding proprietary algorithms -- agencies are just going to continue engaging in the same biased policing, only with the justification that the software told them to do it.

Since life and liberty is on the line for citizens put at the mercy of software being fed junk data, Sanchez suggests the following should be instituted (at a bare minimum) before predictive policing software is deployed:

As a first step, agencies considering using predictive policing tools should undertake Algorithmic Impact Assessments that include the following: (1) a self-assessment evaluating the system’s potential impacts on fairness, justice, and bias; (2) a meaningful external review process; (3) public notice and comment; and (4) enhanced due process mechanisms to challenge unfair, biased, or other harmful effects.

But that's just the start. The whole system has failed for years and reform from the ground up is needed before this software can be trusted in the hands of the police. Sanchez calls for the entire criminal justice system to be reformed, since it's the source of institutional racism and the enabler of some of the worst law enforcement behavior.

The negatives far outweigh the positives when it comes to predictive policing. The EU is taking the right step by asking for public input. Here in the US, public input is still an afterthought -- something that only happens after enough damage has been done. Turning law enforcement over to tainted data and proprietary algorithms poses a genuine threat to life and liberty. Hopefully, someone in the US will take a cue from the EU Parliament's actions and start asking law enforcement agencies tough questions about their predictive policing programs.

Filed Under: eu, junk data, law enforcement, predictive policing

Double Blow To The EU's Long-Delayed Unified Patent Court, But Supporters Unlikely To Give Up

from the increasingly-anachronistic dept

Remember the EU's unitary patent plan? No surprise if you don't -- attempts to create a unitary patent system across the region have been dragging on for decades. Back in 2012, Techdirt noted that the European Parliament had finally approved the plan to set up a new Unified Patent Court (UPC) for the EU, but it still hasn't come to fruition. Recently, the scheme has been dealt two major blows that are likely to delay it further, even if they don't kill it off entirely.

The first concerns the UK. It's one of the three nations that had to sign up to the UPC agreement for it to come into force. A big question was whether it could or would do so after brexit. The answer turns out to be "no". The second problem comes from Germany, where the country's constitutional court has ruled as follows:

The Act of Approval to the Agreement on a Unified Patent Court ("the Act of Approval") to confer sovereign powers on the Unified Patent Court is void. In its outcome, it amends the [German] Constitution in substantive terms, though it has not been approved by the Bundestag with the required two-thirds majority.

However, it's possible that can be solved by the Bundestag -- German's parliament -- holding another vote which does attain the two-thirds majority. There is likely to be pressure to do so because elsewhere the ruling by Germany's constitutional court (full translation from FFII.org) is helpful to supporters of the UPC, for reasons explained by The Register:

the German Constitutional Court effectively rejected the other arguments against the UPC's validity. In essence, they were: that because the UK is exiting the EU that the UPC is no longer valid because the UK was one of three compulsory signatories to it (the other two being France and Germany); and that the European Patent Office (EPO) is insufficiently independent because of "reforms" made by its former president Benoit Battistelli that concentrated power in his hands.

Importantly, the first point means the refusal of the UK to sign up is not regarded as an issue now that it has left the EU. As Florian Mueller writes on his blog: "there is widespread consensus that re-ratification (subsequently to renegotiation) is a question of when, not if." Although FFII.org agrees the patent industry will push hard to get the UPC implemented, it notes there are yet more bumps in that particular road:

the German Constitutional Court still have to decide soon over 4 other complaints, where complainants have raised the issue that the European Patent Office (EPO) cannot be brought to court for maladministration, in breach of the "rule of law" principle. If the court finds the EPO not in line with fundamental rights, this might have a bigger impact over the current system.

This point relates to the central role that will be played by the EPO in issuing the new unitary patents, valid across the EU. The EPO has long been a controversial institution: it is not part of the EU, its premises enjoy extraterritoriality, and its executives are granted diplomatic immunity that effectively places them outside the law. If allegations of maladministration cannot be brought to EU courts, that seems like a recipe for disaster. Irrespective of those particular questions, The Register article raises a more fundamental one: is it really worth bothering with a plan that was born decades ago? Both the unitary patent and UPC reflect a very different world from the one we now inhabit, which no longer regards more powerful patents as an obvious blessing.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: brexit, epo, eu, germany, patents, uk, unified patent court

EU Considering Enacting Right-To-Repair To Return Power To Consumers, Protect The Environment

from the hopefully-not-too-little-too-late dept

Right-to-repair laws are still a work in progress, mainly due to industry opposition. The wants and needs of millions of device/vehicle owners don't amount to a hill of beans in this world full of interloping industry leaders, as noted DIY repairman/nightclub owner Rick Blaine once sourly noted.

Allowing people to actually own the things they've purchased seems like a foreign concept to US tech leaders, even though that was the status quo long before goods went digital and the DMCA was enacted. Why should people be at the mercy of those whose profits depend on walled gardens, closed loops, and well-funded lawyers issuing cease-and-desist orders at the drop of a proprietary screwdriver? Well, as someone else sourly noted, those with the gold make the rules.

While we struggle through with some piecemeal replacements for our assumed rights of ownership here in the US, it appears the European Union is going to get serious about handing customers back their purloined rights. As the New York Times reports, a right-to-repair is up for discussion -- not so much because of the impact on customers, but because of the impact on the environment.

The “right to repair,” part of a wide-ranging policy package known as the Green Deal that was introduced this month, is the latest example of the European Union’s ambitions to promote more sustainable economic growth and to prevent waste. It extends standards brought in last year that put “right to repair” obligations on the manufacturers of some large appliances.

“The linear growth model of ‘take-make-use-discard’ has reached its limits,” Virginijus Sinkevicius, the union’s environment commissioner, told reporters in Brussels as he presented the “Circular Economy Action Plan,” which includes the “right to repair” initiative.

“We want to make sure that products placed on E.U. market are designed to last longer, to be easier to repair and upgrade, easier to recycle and easier to reuse,” he added.

Obviously, providing people with a right-to-repair (and the information to make those repairs) will help curb the amount of dangerous chemicals and minerals being dumped into the ecosystem. Planned obsolescence has been the status quo for years, with repair prices and restrictions making it far easier to replace items than repair them. This has added up to serious environmental damage. It has also added to problems around the world where rare minerals are mined under the direction of governments who use their profits to finance war, rape, and numerous other atrocities.

But it will also give people back something they've historically enjoyed: the ability to tinker with and repair their purchased products without being locked out by proprietary tools and methods that are shared with only certain gatekeepers to ensure steady purchases of new products and the speedy destruction of anything slightly out-of-date.

Here's how the EU's proposal [PDF] puts it [all emphasis in the original]:

Empowering consumers and providing them with cost-saving opportunities is a key building block of the sustainable product policy framework. To enhance the participation of consumers in the circular economy, the Commission will propose a revision of EU consumer law to ensure that consumers receive trustworthy and relevant information on products at the point of sale, including on their lifespan and on the availability of repair services, spare parts and repair manuals. The Commission will also consider further strengthening consumer protection against green washing and premature obsolescence, setting minimum requirements for sustainability labels/logos and for information tools.

In addition, the Commission will work towards establishing a new ‘right to repair’ and consider new horizontal material rights for consumers for instance as regards availability of spare parts or access to repair and, in the case of ICT and electronics, to upgrading services. Regarding the role that guarantees can play in providing more circular products, the Commission will explore possible changes also in the context of the review of Directive 2019/771.

This would be a step up from the EU's aggressive recycling requirements, which demands companies selling electronics recycle at least 65% of the total weight of goods sold (i.e., recycling 65 tons for every 100 tons of goods put on sale). As it stands now, zero companies have met that requirement, which has been in place since 2012.

This would hand power back to consumers. It won't make it easier for companies to hit recycling targets, but it may alter the market for new goods, making it more financially feasible for device makers to slow the rollout of new products and extend the life of those already on the market.

If enacted, it will drastically change the way electronics manufacturers do business in Europe. It may see some drop out of the market completely. But expect a lot of opposition from the companies affected as this legislative proposal moves forward. If there's one thing companies like Apple and Microsoft can agree on, it's that customers shouldn't be allowed to cut them out of the repair/modification/replacement chain.

Filed Under: consumers, eu, right to repair

UK Says It Won't Implement The EU Copyright Directive, Which Wouldn't Have Passed Without Its Support During A Crucial Vote

from the cunning-plan-or-just-can't-be-bothered? dept

As Techdirt has reported, the EU member states are starting to transpose the EU Copyright Directive into their national laws, and the results are as bad as we feared. France wants to implement the Article 17 upload filters without user protections, while Germany plans to place ludicrous restrictions on the use of press materials as part of its implementation of Article 15. What's particularly frustrating about the whole sorry EU Copyright Directive saga is that the law was very close to being thrown out last April. That was when the final vote by the EU Council (made up of representatives of the EU member states) took place. As Mike wrote at the time, because Sweden changed its original position, and voted against the Directive, it would only have required either Germany or the UK to do the same, and the legislation would have been dropped.

An interesting wrinkle to the story is that Boris Johnson, then still jockeying for leadership of the UK Conservative party, tweeted that the EU Copyright Directive would be "terrible for the Internet", and that the UK "should not apply it." That was easy to say when he had neither power nor responsibility. But now that Johnson has become UK prime minister, and enjoys a massive majority in the House of Commons, which effectively means he can do whatever he wants, will he take the same position? Rather amazingly, it seems he will.

A written question was submitted to the UK government: "To ask the Secretary of State for Business, Energy and Industrial Strategy, what plans the Government has to bring forward legislative proposals to implement the EU Copyright Directive in UK law." To which the UK government replied:

The deadline for implementing the EU Copyright Directive is 7 June 2021. The United Kingdom will leave the European Union on 31 January 2020 and the Implementation Period will end on 31 December 2020. The Government has committed not to extend the Implementation Period. Therefore, the United Kingdom will not be required to implement the Directive, and the Government has no plans to do so. Any future changes to the UK copyright framework will be considered as part of the usual domestic policy process.

That is, after providing one of the crucial votes of support that ensured the EU Copyright Directive would become law, the UK is not now going to implement it. A cynic might think that the UK has done this to gain an advantage over the rest of the EU as member states grapple with the serious harm the Copyright Directive will inflict on the region's Internet users and startups. In truth, it is probably more a reflection of the fact that the UK government will be so busy passing legislation to cope with the aftershocks of Brexit, it won't have time to deal with minor issues like copyright.

And for those who will be celebrating this news as a great win, it's worth noting the careful phrasing of the reply: "Any future changes to the UK copyright framework will be considered as part of the usual domestic policy process". Although the UK government won't implement an EU law -- not least for dogmatic reasons -- it hasn't ruled out bringing in its own 100% true-Brit law that does much the same. It's unlikely that the well-connected UK copyright industry is going sit quietly and watch EU rivals gain special privileges online without demanding the same. Expect lots of whining and cries of pain from the recording industry and publishers until the UK government eventually gets around to passing national legislation that is as bad -- or even worse -- than the EU's.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: brexit, copyright, copyright directive, eu, uk

Leaked Document Suggests Possible Facial Recognition Ban In Europe

from the an-unlikely-outcome-but-we-can-hope dept

Bans of facial recognition tech are popping up across the United States. Facial recognition tech use by law enforcement is currently banned in the state of California and a few cities in Massachusetts have blocked local government agencies from deploying the tech.

Given the tech's relative inability to do its job, along with a host of other concerns including built-in biases that make it far more likely minorities will suffer the effects of false positives, lawmakers are finally putting the brakes on approving facial recognition use by government agencies.

A white paper leaked to Euractiv appears to indicate the biggest ban so far is under consideration in Europe -- one that would affect most of the continent.

The European Commission is considering measures to impose a temporary ban on facial recognition technologies used by both public and private actors, according to a draft white paper on Artificial Intelligence obtained by EURACTIV.

If implemented, the plans could throw current AI projects off course in some EU countries, including Germany’s wish to roll out automatic facial recognition at 134 railway stations and 14 airports. France also has plans to establish a legal framework permitting video surveillance systems to be embedded with facial recognition technologies.

Noting that the GDPR requires certain information disclosures by companies and agencies deploying the tech, the white paper [PDF] suggests going live with facial recognition tech might be unworkable, given that every person passing by an AI-enabled cam would have to consent to data collection. It suggests a moratorium might be the best solution until all the regulatory kinks can be worked out.

Building on these existing provisions, the future regulatory framework could go further and include a time-limited ban on the use of facial recognition technology in public spaces. This would mean that the use of facial recognition technology by private or public actors in public spaces would be prohibited for a definite period (e.g. 3-5 years) during which a sound methodology for assessing the impacts of this technology and possible risk management measures could be identified and developed.

That's just one of the five options being considered by the European Commission. Unfortunately, it doesn't appear to be one of its favorites. The paper says the most likely approach the Commission will take is a combination of options 3, 4, and 5. The ban is option 2.

But the GDPR definitely causes problems for the rollout of facial recognition tech in public places -- something the government agencies itching to deploy it don't appear to have considered seriously. It's pretty much unworkable unless the governments rolling these out are going to claim that being in a public place waives GDPR protections.

The desire to subject citizens to biometric collections may result in a rewrite of the GDPR or a blanket exception for collections in public places. This will only make a bad law worse.

But overall, the paper makes it clear the tech will be subject to tight regulation and much more oversight than we've seen deployed in the United States. Amendments to safety and liability laws are being considered that would allow tech companies to be held responsible for data breaches or misuse of collected biometric information. There would also be some sort of "trusted vendor" program put in place that would push companies to meet certain standards before they can be considered for government applications.

The ban is a long shot but it's still in the running. Given the number of changes that may need to be made to make facial recognition tech comply with existing European privacy laws, a temporary moratorium might be the best call to make. Clearly, the legal atmosphere in Europe isn't exactly welcoming for new data collection tech. But the narrative that more surveillance = safer countries will always have powerful proponents, which may override the privacy concerns of millions of European citizens and subject them to mass surveillance.

Filed Under: eu, europe, facial recognition

As We Get Closer And Closer To The EU Requiring ContentID Everywhere, More Abuses Of ContentID Exposed

from the vast-shakedown-machine dept

EU member states are getting ready to implement Article 17 of the EU Copyright Directive, which will more or less force every platform that hosts any user-generated content, to either license every damn thing (impossible) or to put in place a tool like ContentID, that automatically spots and takes down "infringing" content. Despite the fact that Google spent over $100 million on its ContentID and competitive offerings (mainly Audible Magic) are quite expensive, defenders of this plan kept insisting that those filters work. Plenty of people have pointed out that they don't work very well at all, and it's even worse than just leading to legitimate content being taken down. Having such a tool, means that it will be abused.

CCN.com recently wrote up yet another article highlighting the problem of massive false flagging campaigns showing up for YouTube videos:

The latest problem surrounds mass false copyright claims. It turns out that false claiming someone’s video revenue as your own is so easy that companies can seemingly do it en masse. And these companies aren’t just going after subtle, small-time channels. They’ve hit some of YouTube’s biggest creators.

Much of the article focuses on a company called Studio 71, which is the one filing a bunch of these recent false claims. Lots of folks are online highlighting these bogus takedowns.

There are a lot more like that too.

The company behind all of these claimed that it was "a technical problem with YouTube that is out of our hands" but never quite explained what sort of problem it was.

To its (slight) credit, the company claimed that it released all of those claims, even ones not disputed. But still.

At least one person asked them to explain how it happened and how it can be prevented in the future... and got no answer.

Whether or not this was an overzealous individual, an automated system out of control, or some other failure, it doesn't change the basic fact that any such filter system will be regularly abused, on purpose or not, to takedown or claim the revenue on tons of content. This is exactly what we tried to tell people in the EU before they voted on the Copyright Directive... and they kept insisting it wouldn't possibly happen. After all, they said, they wrote into the law that it shouldn't be abused. I'm sure that will work out just great...

Filed Under: contentid, copyright directive, eu, false claims, false flags
Companies: google, studio 71, youtube

EU Patent Office Rejects Two Patent Applications In Which An AI Was Designated As The Inventor

from the watch-this-space dept

We've written a bunch about why AI generated artwork should not (and need not) have any copyright at all. The law says that copyright only applies to human creators. But what about patents? There has been a big debate about this in the patent space over the last year, mainly lead by AI developers who want to be able to secure patents on AI generated ideas. The patent offices in the EU and the US have been exploring the issue, and asking for feedback, while they plot out a strategy, but some AI folks decided to force the matter sooner. Over the summer they announced that they had filed for two patents in the EU for inventions that they claim were "invented" by an AI named DABUS without the assistance of a human inventor.

And now, the EU Patent Office has rejected both patents, since they don't have a human inventor.

The EPO has refused two European patent applications in which a machine was designated as inventor. Both patent applications indicate “DABUS” as inventor, which is described as “a type of connectionist artificial intelligence”. The applicant stated that they acquired the right to the European patent from the inventor by being its successor in title.

After hearing the arguments of the applicant in non-public oral proceedings on 25 November the EPO refused EP 18 275 163 and EP 18 275 174 on the grounds that they do not meet the requirement of the EPC that an inventor designated in the application has to be a human being, not a machine. A reasoned decision may be expected in January 2020.

Frankly, this is the right decision and its one that I hope patent offices around the globe recognize and continue to keep this line in place. I fear that this will actually kick off the process that comes to the opposite conclusion, and that patent offices will change the rules to allow for AI-generated patents.

The problem, yet again, is in people's misguided belief that everything must be owned by someone, and that somehow without a patent it is impossible to successfully commercialize or market a product. There is tremendous evidence to the contrary (including just by looking at products after their patents run out -- which is often a time when more innovation occurs, since there's greater competition driving improvements). But, instead, you hear nonsense like the following from Prof. Ryan Abbott, who helped file the two now rejected patents, arguing that without patents, somehow these inventions might not come to be:

Abbott and his team believe that powerful AI systems could eventually find cures for cancer or find workable solutions for reversing climate change. “If outdated IP laws around the world don’t respond quickly to the rise of the inventive machine, the lack of incentive for AI developers could stand in the way of a new era of spectacular human endeavor,” Abbott said.

But why? AI doesn't need the monopoly control as incentive to create an invention. That's not what motivates the AI. What's wrong with just letting the AI come up with those cures for cancer and workable solutions for reversing climate change and just giving them to the world to make the world a better place?

Filed Under: ai, dabus, epo, eu, humans, incentives, ownership, patents, ryan abbott

Top EU Court's Adviser Says Personal Data Can Be Transferred Using 'Standard Contractual Clauses' -- But Also Suggests That Privacy Shield Should Be Ruled Invalid

from the sting-in-the-tail dept

As is usual for cases being considered by the EU's highest court, the Court of Justice of the European Union (CJEU), before the main ruling a senior legal adviser offers a preliminary opinion. Although the view by the Advocate General is not binding on the court, it often gives a good idea of how things will go. That makes some of the issues raised in a new opinion by Advocate General Saugmandsgaard Øe (pdf) concerning the EU's GDPR privacy regulation particularly interesting. The case is yet another one triggered by a complaint from the privacy activist Max Schrems as a result of Snowden's revelations. The background is summed up well by the press release on the Advocate General's opinion (pdf):

The data of Facebook users residing in the EU, such as Mr Schrems, are transferred, in full or in part, from Facebook Ireland, the Irish subsidiary of Facebook Inc., to servers located in the United States, where they are processed. In 2013, Mr Schrems lodged a complaint with the Irish authority responsible for monitoring the application of the provisions relating to the protection of personal data ('the supervisory authority'), taking the view that, in the light of the revelations made by Edward Snowden concerning the activities of the United States intelligence services (in particular the National Security Agency or 'NSA'), the law and practices of the United States do not offer sufficient protection against surveillance, by the public authorities, of the data transferred to that country. The supervisory authority rejected the complaint, on the ground, inter alia, that in a decision of 26 July 2000 the Commission had considered that, under the 'safe harbour' scheme, the United States ensured an adequate level of protection of the personal data transferred.

As Techdirt reported, the "safe harbor" framework was thrown out by the CJEU in 2015, because it failed to offer enough protection for EU data. It was swiftly replaced by the Privacy Shield framework -- a slightly tweaked version of the safe harbor scheme. Both made transfers of EU personal data to the US legal by certifying that US data protection standards are "adequate".

But there is another way to make such transfers legally. Instead of relying on a general framework, individual companies can use standard contractual clauses (SCC), which are simply a promise that EU personal data will be protected in the US (or elsewhere) according to EU standards. The key issue considered by the Advocate General in advance of the CJEU ruling is whether the use of SCCs for the transfer of personal data to non-EU countries is valid. On that point, the court adviser has now said that in his view SCCs can be used as an alternative to things like the Privacy Shield framework. The main reason is that SCCs can be cancelled at any time -- for example, if evidence emerges that EU personal data is not sufficiently protected under foreign laws. The Advocate General goes further, saying:

there is an obligation -- placed on the data controllers [in a company, for example] and, where the latter fail to act, on the supervisory authorities [of each EU nation] -- to suspend or prohibit a transfer when, because of a conflict between the obligations arising under the standard clauses and those imposed by the law of the third country of destination, those clauses cannot be complied with.

So the good news for companies is that SCCs are a perfectly legitimate way of transferring EU personal data to the US. The bad news is that the data protection authorities in the EU must check whether the personal data is really protected according to EU norms, and if not, to block the flows immediately. In his press release on the opinion (pdf), Schrems says this is a huge step for the enforcement of the GDPR if it is followed by the CJEU: "At the moment, many data protection authorities simply look the other way when they receive reports of infringements or simply do not deal with complaints." In particular, Schrems says the Irish Data Protection Commissioner (DPC) would have to suspend the data flows between Facebook Ireland and Facebook Inc. because the DPC has already agreed EU data is not sufficiently protected by the latter. More generally, Schrems thinks this will lead to "More privacy for EU consumers, massive issues for certain US business":

If the Court follows today's opinion to have a "targeted approach" [on a case-by-case basis], there would be no impact on most EU data transfers. EU data protection authorities may however stop transfers to US companies that fall under FISA 702 ("electronic communication service providers"). This includes companies like Facebook, Google, Microsoft, Amazon Web Services or Yahoo.

Although it's subsidiary to the main issue of whether SCCs are valid, the Advocate General concludes with something of a legal bombshell. As the press release puts it:

According to the Advocate General, the resolution of the dispute in the main proceedings does not require the Court to rule on the validity of the 'privacy shield' decision, since that dispute concerns only the validity of Decision 2010/87 [regarding SCCs]. Nevertheless, the Advocate General sets out, in the alternative, the reasons that lead him to question the validity of the 'privacy shield' decision in the light of the right to respect for private life and the right to an effective remedy.

The Advocate General is saying that the EU's top court doesn't have to consider whether today's Privacy Shield offers enough protection of EU personal data sent to the US, but if it chooses to do so, he thinks it ought to rule that it's invalid. If the CJEU agrees, and throws out Privacy Shield as it threw out the safe harbor framework, that would have a major impact on today's digital world. We'll find out some time next year whether the judges are happy to do that.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: cjeu, eu, personal data, privacy, privacy shield

Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again

from the lack-of-respect dept

One of the most visible manifestations of the EU's General Data Protection Regulation (GDPR) is the "cookie banner" that pops up when you visit many sites for the first time. These are designed to give visitors the opportunity to decide whether they want to be tracked, and if so by whom. Any business operating Internet sites in the EU should theoretically use them or something similar, or risk a GDPR fine of up to 4% of global turnover. Cookie banners may be tiresome, but at least they give users some measure of control over how much they are tracked online. But do they? Few of us have the skills or the time to check that our wishes are obeyed by every site. Fortunately, three researchers in France -- Célestin Matte, Nataliia Bielova, Cristiana Santos -- possess both, and have conducted the first rigorous study of this area. They've written a good summary of their full academic paper.

An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the Interactive Advertising Bureau Europe Transparency and Consent Framework, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:

Consent stored before choice

The cookie banner stores a positive consent before the user has made their choice in the banner. Therefore, when advertisers request for consent, the cookie banner responds with the positive consent even though the user has not clicked on a banner and has not made their choice yet.

No way to opt out

The banner does not offer a way to refuse consent. The most common case is a banner simply informing the users about the site's use of cookies

Pre-selected choices

The banner gives user a choice between one or more purposes or vendors, but some of the purposes or advertisers are pre-selected: pre-ticked boxes or sliders set to "accept".

Non-respect of choice

The cookie banner stores a positive consent in the browser even though the user has explicitly refused consent.

That's a pretty dismal state of affairs. The GDPR is designed to give control to those visiting Web sites in the EU, and yet over half of the latter studied in detail fail to respect users' choices. One person who has shown himself unwilling to accept the GDPR being flouted in this way is the privacy campaigner Max Schrems. Over the years, he has launched -- and won -- multiple legal challenges involving privacy and the GDPR. Now his privacy organization noyb.eu is turning its attention to disrespectful cookie banners:

noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a "fake consent". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.

Up to 565 "fake consents" per user. Despite users going through the trouble of "rejecting" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent "fake consent" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.

Schrems points out that one company taking advantage of "fake consent" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU's top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the GDPR is already doing.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: cookie banners, cookies, eu, gdpr, max schrems, privacy