German Court Fines Site Owner For Sharing User Data With Google To Access Web Fonts

from the getting-fined-the-odd-way dept

The European Union's data privacy law, the GDPR (General Data Protection Regulation), has caused all sorts of problems since its debut. Its debut was itself a mess, something that immediately resulted in a whole lot of websites simply refusing to allow European users to connect with them.

Since it was unclear how to avoid running afoul of the law, it was easier to avoid potential fines by simply cutting European users out of the equation. For everyone else, it was being greeted with a new warning about cookies at nearly every website they visited -- a small hassle to be sure, but a hassle nonetheless.

Then there were the truly unexpected consequences of the new law that imposed data-gathering and data-sharing restrictions on any business, whether they were internet-based or not. In some areas, GDPR was read as requiring retailers to notify purchasers of items when the items were returned -- something that would make the exchange of unwanted Christmas gifts extremely awkward.

In another weird case, post offices in Ireland removed waste bins from their facilities because customers were throwing out unwanted mail and receipts, resulting the offices' unintentional collection of personal data. When the waste bins went missing, customers resorted to throwing their trash on post office counters and floors, leaving it even more unregulated than it was when the waste bins were still in place.

Yet another side effect no one saw coming: the use of Google's Font API was enough to get a website fined by a German court. (via Slashdot)

Earlier this month, a German court fined an unidentified website €100 ($110, £84) for violating EU privacy law by importing a Google-hosted web font.

The decision, by Landgericht München's third civil chamber in Munich, found that the website, by including Google-Fonts-hosted font on its pages, passed the unidentified plaintiff's IP address to Google without authorization and without a legitimate reason for doing so. And that violates Europe's General Data Protection Regulation (GDPR).

The court says whether or not Google did anything with the forwarded IP address is beside the point. The fact is the website engaged in the unauthorized transmission of this IP address to Google by using its font API to access a font to render the text on the site. The court's decision points out this can be avoided by self-hosting the font and notes that the website operator has chosen to do this going forward. That being said, the court still feels a fine is the only way to ensure future compliance with GDPR.

Risk of repetition is to be affirmed. It is undisputed that the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website. Previous unlawful impairments justify an actual assumption of the risk of repetition, which was not refuted by the defendant. The risk of repetition is not eliminated by the fact that the defendant now uses Google Fonts in such a way that the IP address of the website visitor is no longer disclosed to Google. The risk of repetition can only be eliminated by a declaration of discontinuance with a penalty.

The fine here may have been minimal, but the law allows a penalty of €250,000 ($286,000) per violation, which the court warns the website operator is not only possible, but probable, if the problem doesn't go away. There's also the (very slim) chance the improper use of Google Fonts could result in prison time, because that's also a potential GDPR violation penalty.

While the solution here appears to be simple enough -- self-host fonts -- the reality of the situation is that this decision will lead to yet another pop-up asking for consent that will stand between site users and the content they're trying to access, and that no one will read before clicking "accept." It won't make the web a better place and it won't do much to limit the sharing of personal data with off-site entities. It will just make everything a little more annoying.

Filed Under: data protection, fonts, gdpr, germany, ip addresses, privacy, sharing, web fonts
Companies: google

FTC's Misses Opportunity To Understand Social Media; Instead Goes For Weird Fishing Expedition Against Odd Grouping Of Companies

from the this-could-have-been-helpful dept

On Monday, the FTC announced that it was issuing what's known as 6(b) orders to nine social media and video streaming companies, demanding a fairly massive amount of information regarding their data collection and usage policies, as well as their advertising practices. To me, this is a huge missed opportunity. If the FTC is truly trying to gain a better understanding of data collection, privacy, and advertising practices, perhaps to better inform Congress on how to, say, pass a truly comprehensive (and useful?!?) privacy legislation, then there are ways to do that. But this... is not that. This looks like a weird fishing expedition for a ton of unrelated information, from an odd selection of nine companies, many of whom are in a very different business than the others. It leaves me quite perplexed.

First, let's look at the odd selection of companies. The letters are going to:

• Amazon (apparently including Twitch)
• Bytedance (TikTok)
• Discord
• Facebook
• Reddit
• Snap
• Twitter
• WhatsApp (owned by Facebook)
• YouTube

Okay, so they've definitely focused on many of the big players, but they've also left out a ton as well. Where's LinkedIn? Or Github? Or WeChat? Or Pinterest? Or Quora? They list Facebook and Whatsapp... but not Instagram? Where's Zoom? Now it's true that sometimes the FTC will randomly sample a bunch of companies in a particular industry to get a look at certain practices -- but for that to make sense, you want to sample from a set of similarly situated companies. This is... not that.

For the smaller companies on the list, such as Reddit and Discord, the FTC demanding they file a ton of paperwork in a very short time frame is going to mean a tremendous waste of time.

The second concern is the broad nature of the requests. The "sample order" is massive. There are 53 separate requests, many with multiple sub-parts. They're not just asking for specific information, but rather going on what appears to be an incredibly broad fishing expedition for information about a wide variety of practices at all of these companies -- including broad demands for future strategies and plans. For example, beyond just information on the number of users, it demands all documents relating to "business strategies or plans," "research and development efforts," "strategies or plans to reduce costs, improve products or services..." It also seems to be demanding all "presentations to management committees, executive committees, and boards of directors."

That feels like a fishing expedition, rather than an attempt to actually understand data collection and usage practices.

There are categories of information included here that I think it would be useful for the FTC to understand. But there's just so much information requested that it seems likely to bury the useful information.

The one FTC Commissioner who dissented from this effort, Noah Joshua Phillips, raises important questions in his dissent:

Effective 6(b) orders look carefully at business practices in which companies engage in a manner designed to elicit information, understand it, and then present it to the public in way that is usable and can form a basis for sound public policy.

The first step is to select a group of recipients that will permit such examination, usually a group of firms engaged in conduct that can be compared. But the logic behind the choice of recipients here is not clear at all. The 6(b) orders target nine entities: Facebook, WhatsApp, Snap, Twitter, YouTube, ByteDance, Twitch, Reddit, and Discord. These are different companies, some of which have strikingly different business models. And the orders omit other companies engaged in business practices similar to recipients, for example, Apple, Gab, GroupMe, LinkedIn, Parler, Rumble, and Tumblr, not to mention other firms the data practices of which have drawn significant government concern, like WeChat. The only plausible benefit to drawing the lines the Commission has is targeting a number of high profile companies and, by limiting the number to nine, avoiding the review process required under the Paperwork Reduction Act, which is not triggered if fewer than ten entities are subject to requests.

Phillips calls out the same broad demands I raised above regarding business plans, R&D and presentations, noting:

Such a request would be suited to an antitrust investigation. But as part of an inquiry ostensibly aimed at consumer privacy practices, it amounts to invasive government overreach. And that is just one of the order’s 50-plus specifications.

And, finally, he highlights how this effort is just demanding way too much information to be of use for a comprehensive policy recommendation:

The biggest problem is that today’s 6(b) orders simply cover too many topics to make them likely to result in the production of comparable, usable information—yet another feature proper oversight and public comment could have flagged. Rather than a carefully calibrated set of specifications designed to elicit information that the agency could digest and analyze as a basis for informing itself, Congress, stakeholders, and the public, these 6(b) orders instead are sprawling and scattershot. Their over 50 specifications, most with numerous and detailed subparts, address topics including, but not limited to: advertising (reach, revenue, costs, and number and type); consumer data (collection, use, storage, disclosure, and deletion); as noted above, all strategic, financial, and research plans; algorithms and data analytics; user engagement and content moderation; demographic information; relationships with other services; and children and teens (policies, practices, and procedures).

Recipients of 6(b) orders typically negotiate to limit their productions, to tailor them in light of their specific business models and business practices. Perhaps the Commission will push back on attempts to do so, devoting additional lawyers to litigating the orders and having a federal judge oversee them, rather than OIRA. Or negotiation may reduce the burdens. But if that happens, each recipient will be responding to a different set of negotiated specifications. That certain of the companies in question have very different business models makes this even more likely. The end result of that is, say, the agency learning a lot about one recipient’s advertising practices, but not as much about its algorithms. For another recipient, the agency might receive information about privacy practices but very little about its plans to expand. Each of the nine recipients will produce differing, if any, amounts of information to each of the 50-plus specifications.

I actually think it would be a good thing for the FTC to better understand how these companies work and their practices. I think it could be useful for them to gain such an understanding, and then make recommendations on a comprehensive federal privacy law. But I don't see how this fishing expedition does any of that. Instead, it just asks for basically everything and the kitchen sink from a somewhat random selection of companies, some of whom will have difficulty producing all of this information.

Filed Under: data, data collection, data protection, fishing expedition, ftc, privacy, social media, video streaming
Companies: amazon, bytedance, discord, facebook, reddit, snap, tiktok, twitch, twitter, whatsapp, youtube

Japan-UK Trade Deal Shows How Controversial Digital Policies Can Be Slipped Through With Little Scrutiny Or Resistance

from the welcome-to-the-data-washing-hub dept

Techdirt has been writing about trade agreements for many years. The reason is simple: as digital technology permeates ever more aspects of modern life, so international trade deals reflect this by including sections that have an important impact on the online world. A new trade agreement between Japan and the UK (pdf) is a good example. It is essentially a copy of the earlier trade deal between the EU and Japan (pdf) -- because of Brexit, UK negotiators have not had the time or resources to draw up their own independent text, which typically requires years of drafting and negotiation. But significantly, the Japan-UK agreement adds several major sections purely about digital matters. All are terrible for the general public, as a briefing document from the UK-based Open Rights Group explains.

One issue concerns transfers of personal data between the UK and Japan. In the EU, this is governed by the well-known and relatively stringent GDPR. In fact, in order to achieve "adequacy" -- essentially, legal permission to receive EU personal data -- Japan has had to strengthen its data protection laws:

The EU required Japan to change its data protection regime, including supplementary rules on onwards transfers of EU data to other countries. The European Parliament has expressed further concerns and Japan is considering further changes.

However, the Japan-UK trade deal explicitly calls for personal data flows to be made easier, with a consequent watering-down of EU-level protections:

The UK deal includes measures which ban restrictions on the free flow of personal data, restrictions which could clash with the limits which European data protection laws place on international transfers. The EU could not adopt these measures in its treaty with Japan, and instead put in placeholder text committing both parties to review the situation in three years. The UK-Japan text heeds the wording of the USMCA [United States-Mexico-Canada Free Trade Agreement], with some extra clauses to exclude procurement and data kept on government orders.

The banning of restrictions on the free flow of personal data allows for public interest policies, following a standard formulation in trade agreements. This regime looks reasonable on paper, but in practice, it is very difficult to implement public interest policies which clash with trade liberalisation, as they are open to legal challenge, which rarely find in favour of restrictions.

Open Rights Group notes two important consequences of this decision not to follow the EU text here. First, it potentially allows personal data flowing to the UK from third countries to be passed to Japan and then on to other jurisdictions, for example the US, with almost no controls or restrictions. This would turn the UK into a "data washing hub" as the Open Rights Group puts it. In this respect, the UK-Japan deal contrasts with the EU-Japan deal, where:

The EU specifically excluded data flows from their trade agreement with Japan. Although Japan has an adequacy decision from the EU, it had to put specific arrangements in place for EU data to stay in Japan.

Given that risk, it is highly likely that the EU will refuse to grant adequacy to the UK, in order to prevent the personal data of EU citizens being sent via the UK to Japan or the US without adequate protections. The crucial role of personal data in modern business means a failure to gain adequacy will have a hugely negative impact on EU-UK trade. The other significant addition to the text in the digital sphere concerns "technical protection mechanisms" (TPMs) -- DRM and similar technologies -- and the criminalization of circumventing them. Open Rights Group points out:

Another concern for digital rights in the UK is the potential criminalisation of circumvention outside commercial endeavours, affecting ordinary people. Circumvention is not a niche activity. Millions of people used to make backup copies of DVDs and many today have to bypass technological protections in order to convert their protected ebooks to other formats. The provisions in the USMCA will require Mexico to beef up its anti- circumvention laws, including introducing criminal penalties for "commercial advantage or private gain".

Finally, there is an interesting section dealing with cryptography. The Japan-UK deal introduces provisions to shield cryptography from a range of government requirements, such as sharing or disclosing keys. However:

What is different here is that the UK also introduces a specific exception for law enforcement to demand access to encrypted communications and for financial regulation. This is not surprising given that the UK is at the forefront of government demands to access data from encrypted messaging systems such as WhatsApp or Telegram. There are no public interest policy exceptions in this area, however limited, only demands from courts, regulators or police.

Of course, the UK is not alone in wanting access to encrypted communications: a recent Techdirt article noted that the EU is also looking to require what is euphemistically termed "lawful access" -- that is, backdoors -- to end-to-end encrypted communications, as is the US and elsewhere. What is significant here is that the exception is being introduced in the context of trade, with no expert input or public debate about the details, as are the other measures discussed above. The danger is that this will become a common practice, where governments try to slip through contentious digital policies as short sections of obscure but far-reaching trade deals.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: backdoors, brexit, data protection, encryption, japan, privacy, trade deals, uk

As Expected, US Surveillance Of Social Media Leads To EU Court Of Justice Rejecting EU/US Privacy Shield

from the now-what? dept

This one sounds boring, but stick with it because it's important. Because the US and the EU have vastly different privacy regulation regimes, there has always been some conflict over how (mainly) US internet companies handle data from the EU. For years, this was "settled" by a weird and mostly useless "EU-US data protection safe harbor" agreement, in which US companies would have to get "certified" that they kept EU-originated data protected at an "equivalent" level to how it would be protected in the EU when transferring it across the Atlantic to US-based data centers. It was a bit of a nuisance as a company (we went through the process ourselves), but in 2015 the entire safe harbor agreement was invalidated by the EU Court of Justice because of the NSA's ongoing snooping on data from those internet companies, as revealed by Ed Snowden.

The EU and US freaked out, and had a frantic negotiation to come up with a new "safe harbor" agreement with the catchier name of "Privacy Shield," but as we pointed out when it was announced, the problem wasn't the text of the agreement, but rather the NSA's surveillance practices with regards to internet data. Here's what I wrote four years ago:

The real issue here is mass surveillance overall. The only real way to fix this issue is to stop mass surveillance and go back to saying that intelligence agencies and law enforcement need to go back to doing targeted surveillance using warrants and true oversight. But, instead, the EU and the US keep trying to paper over this by coming up with a new agreement.

Since then, the Privacy Shield was challenged and the challenge took its sweet time to go through the courts -- again brought by Max Schrems, whose lawsuit had sunk the original safe harbor as well. And, now, finally, four years later exactly what we expected to happen has happened. The CJEU has invalidated the Privacy Shield agreement, by basically saying "hey, the US surveillance regime remains the same, and that was the problem all along." You can read the full decision if you want to get deep into the details.

But the short summary is that while the Privacy Shield framework offered a few ways for EU residents to seek redress from some forms of surveillance, the CJEU says that's not nearly enough:

While individuals, including EU data subjects, therefore have a number of avenues of redress when they have been the subject of unlawful (electronic) surveillance for national security purposes, it is equally clear that at least some legal bases that U.S. intelligence authorities may use (e.g. E.O. 12333) are not covered. Moreover, even where judicial redress possibilities in principle do exist for non-U.S. persons, such as for surveillance under FISA, the available causes of action are limited … and claims brought by individuals (including U.S. persons) will be declared inadmissible where they cannot show “standing” …, which restricts access to ordinary courts …

As you may recall, Executive Order 12333 is the tool under which the US does most of its foreign surveillance totally outside of the oversight of Congress. This has always been a massive problem, and here the CJEU is basically saying "if the US doesn't do wholesale surveillance reform, there's going to be a serious problem with transferring data from the EU to the US."

Now, there is some argument here that EU surveillance is just as bad, and it's perhaps more than a little silly that the CJEU basically ignores that as if it's not important.

Either way, the key point to all of this is that if US companies want to be able to transfer data over from the EU to the US long term (there are ways they can do it for now), the US government needs to vastly reform its surveillance practices. Well, assuming there was a competent government that actually cared about these things. I'm a bit worried that the current administration will just ignore this or use it to attack the EU, which would be somewhat disastrous for US internet companies.

I've seen some people saying that this is a ruling against the internet companies and their data collection practices, but that's not really accurate. The problem is not so much that -- it's how the NSA spies on people with that data (with or without cooperation of the companies). This really should lead to the US internet industry pressuring the US government to stop mass surveillance -- just like we said four years ago.

Filed Under: data protection, eu, gdpr, mass surveillance, max schrems, nsa, privacy shield, surveillance
Companies: facebook, noyb

Court Tells Grandma To Delete Photos Of Grandkids On Facebook For Violating The GDPR

from the what-the-what? dept

We've talked for many years now about the overreach of the GDPR and how its concepts of "data protection" often conflict with both concepts of free expression and very common every day activities. The latest example, first highlighted by Neil Brown, is that a Dutch court has said that a grandmother must delete photos of her grandkids that she posted to Facebook and Pinterest, because it violates the GDPR. There is, obviously, a bit more to the case, and it involves a family dispute involving the parents and the grandmother, but, still, the end result should raise all sorts of questions.

And while many EU data protections folks are saying this was to be expected based on earlier EU rulings regarding the GDPR, it doesn't make the result any less ridiculous. As the BBC summarizes:

The case went to court after the woman refused to delete photographs of her grandchildren which she had posted on social media.

The mother of the children had asked several times for the pictures to be deleted.

The GDPR does not apply to the "purely personal" or "household" processing of data.

However, that exemption did not apply because posting photographs on social media made them available to a wider audience, the ruling said.

There are a few interesting elements in the actual ruling. First, the court notes that since no one made a copyright claim, it doesn't sound like the parents hold the copyright on the images -- which is notable only in that the court seems to think it's natural to use copyright to censor a grandma proudly posting photos of her grandkids.

But on the GDPR question, it notes that the lack of evidence regarding the privacy settings the grandmother used leads the court to assume they were posted publicly:

The General Data Protection Regulation (hereinafter: AVG) protects the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. However, this Regulation does not apply to the processing of personal data by a natural person in the exercise of a purely personal or household activity. Although it cannot be excluded that the placing of a photo on a personal Facebook page falls under a purely personal or household activity, in the preliminary opinion of the Court in preliminary relief proceedings, it has not been sufficiently established how [defendant] set up or protected her Facebook account or her Pinterst account. It is also unclear whether the photographs can be found through a search engine such as Google. In addition, with Facebook it cannot be ruled out that placed photos may be distributed and may end up in the hands of third parties. In view of these circumstances it has not appeared in the scope of these preliminary relief proceedings that there is a purely personal or domestic activity of [defendant]. This means that the provisions of the General Data Protection Act (AVG) and the General Data Protection Implementation Act (hereinafter: UAVG) apply to the present dispute.

And, then you combine that with the fact that children are involved, and the court says, yup, GDPR requires takedown:

The UAVG stipulates that the permission of their legal representative(s) is required for the posting of photographs of minors who have not yet reached the age of 16. It has been established that the minor children of [plaintiff] are under the age of 16 and that [plaintiff], as legal representative, has not given permission to [defendant] to post photographs of her children on social media. In the case of [child 1], his father did not give [defendant] permission either. In view of this the Court in preliminary relief proceedings will order [defendant] to remove the photo of [child 1] on Facebook and the photo of [plaintiff] and her children on Pinterest. In addition, [defendant] will be prohibited from posting pictures of the minor children of [plaintiff] on social media without permission (as referred to in the AVG and UAVG). The emotional importance of [defendant] to be allowed to place photographs on social media cannot lead to a different judgment in this respect.

Neil Brown, who highlighted this situation in the first place, has pondered that even if grandparents posting pictures of their grandkids is normal behavior, that doesn't mean it's good and it removes "autonomy" over our own data. I have a ton of respect for Brown, but this is a very European view that includes an assumption that we should have "autonomy" over anything about ourselves -- which, when judged against the harsh light of reality, seems incredibly silly.

Yes, there are cases where people will have things posted online about themselves that they'd rather are not there. And I understand that this is an even more fraught area when it comes to children. But there are very real free expression concerns as well, and the ability to use this as a tool of blatant censorship seems way too likely.

Filed Under: data protection, family disputes, gdpr, grandchildren, grandmother, photos, privacy
Companies: facebook, pinterest

UK Hospital Somehow Manages To Turn A Patient's Private Message Into Its Voicemail Greeting

from the how-may-we-misdirect-your-call dept

We've covered a lot of data breaches on this site over the years. Most involve the leakage of personal info via unsecured databases or careless data handling. But I doubt we've covered anything as bizarre as this. (via Databreaches.net)

A Devon hospital has apologised after a caller’s voicemail, containing personal patient details, became the hospital’s answerphone message for more than seven hours.

During that time the caller was inundated with calls from patients giving details about their health problems believing they were ringing North Devon District Hospital in Barnstaple.

Somehow, through the magic/convolutions of business phone systems, the message a woman left while calling to set an appointment for her husband somehow became the message greeting callers who were unable to reach a live human being.

Adding inconvenience to possibly tortious injury, the hospital somehow managed to route a number of inbound calls to the person whose message it had accidentally co-opted, resulting in the person (who had yet to discover her personal information had been compromised) fielding phone calls from other patients, who ended up sharing their personal info with a complete stranger.

The woman, who asked not to be named, said: “I didn’t think any more of it until an hour and a half later an elderly man called our home phone talking about his private parts as he had a problem and had to have an operation.

“I said to him, ‘I’m ever so sorry but I don’t know what you’re talking about?’. He replied, ‘they have given me your number’.

The hospital's explanation for this incident isn't very reassuring. It places the blame on outdated equipment. Unfortunately for people who don't want their personal info handed over to complete strangers, there's no telling how many public and private entities could make the same claim about their phone systems.

She said: “The phone lines were redirected and I was told it was completely human error because some parts of the hospital are still using old answer machines."

And yet old answering machines are operated all the time without turning a message someone left into a voicemail greeting. Sure, it's not impossible. But good god is it ever unlikely.

Stupidity before malice, as the saying goes. There's no conceivable reason the hospital would want to generate this kind of press, so it would be irrational to think someone did this to deliberately harm this person. But harm was done nonetheless, and the combination of the UK's Data Protection Act and the GDPR could result in a pretty hefty fine for the hospital. The going rate is "4% of turnover [gross revenue]" -- something that has seen maximum fines rise from £500,000 (the amount charged Equifax) to £183 million (levied against British Airways).

Since the Devon hospital is unlikely to replace its hardware immediately, the risk of repetition still remains. Considering it's apparently never happened before, the risk is low -- but certainly not nonexistent. Adding humans to outdated tech will sometimes result in errors that aren't easily replicated. Given that we've heard nothing comparable to this in the many years this blog has been running, this hospital's inadvertent use of patient's sensitive message as its own answering machine greeting is likely to remain a data breach unicorn.

Filed Under: data protection, devon, health information, privacy, uk, voicemail
Companies: north devon district hospital

One Year Into The GDPR: Can We Declare It A Total Failure Yet?

from the click-here-to-pretend-we-respect-your-privacy dept

Tomorrow will represent a full year since the GDPR went into effect. In the run-up to the GDPR, we called out many of the problems with the regulation which, while well-intended, did not seem to deal well with the nature of the internet, speech, or what privacy actually means. In the year since, we've posted numerous stories highlighting the negative consequences of this poorly considered law.

Whenever we do that, however, many of the law's defenders insist that these unintended consequences are a small price to pay for either protecting our privacy or reining in the internet giants. So, it does seem worth investigating whether or not the GDPR has done either of those things. And, so far, the evidence is sorely lacking. Indeed, on the question of dominance, we pointed out late last year that the early returns suggested that the GDPR had only made Google more dominant, which hardly seems like a way to punish the company.

And now that we have more results, it seems more and more people are realizing that the GDPR has been an utter failure. As CNBC notes in its evaluation of the law, it's hard to see how the GDPR has resulted in any benefits to the public. Instead, it's just created a big mess:

...one year later, GDPR hasn’t lived up to its potential.

Among some consumers, GDPR is perhaps best known as a bothersome series of rapid-fire, pop-up privacy notices. Those astronomical fines have failed to materialize. The law has created new bureaucracies within corporations, and with those, tension and confusion. And it’s unclear if the EU data authority that oversees the law is adequately staffed to handle its demands.

In short, from the user side especially, all the GDPR has done is made people constantly need to click on annoying privacy and cookie notices that they don't read and don't find useful at all. This shouldn't have been a surprise. We've pointed out for many years that the entire concept of a privacy policy is backwards. It creates a situation where no one actually reads it, and it doesn't do much to protect anyone's privacy. I head someone recently note that they should really be called "data exploitation policies," and that, at least, would be a bit more accurate. But still wouldn't get anyone to read them or better protect anyone's privacy.

And, as Politico has pointed out, it appears that not only has the GDPR made the big tech companies more dominant, it's now laid out the rules of the road by which they can introduce even more privacy-destroying offerings:

New forms of data collection, including Facebook’s reintroduction of its facial recognition technology in Europe and Google’s efforts to harvest information on third-party websites, have been given new leases on life under Europe’s General Data Protection Regulation, or GDPR.

Smaller firms — whose fortunes were of special concern to the framers of the region’s privacy revamp — also have suffered from the relatively high compliance costs and the perception, at least among some investors, that they can’t compete with Silicon Valley’s biggest names.

“Big companies like Facebook are 10 steps ahead of everyone else, and 100 steps ahead of regulators,” declared Paul-Olivier Dehaye, a privacy expert who helped uncover Facebook’s Cambridge Analytica scandal. “There are very big questions about what they’re doing.”

This entire approach is backwards and silly. If we want to have better control over our privacy we're not going to do it through demanding better privacy policies, or confusing data protection laws. We need to create the incentives to put the actual control of the data back into the hands of the users. And that doesn't just mean a right to download your info. It means that you have full control over your data and get to control what apps and services can access it and for what reasons. That's not the world we have today, and nothing in the GDPR gets us any closer to it.

And the answer is not "more enforcement." That just locks in the big companies even more and continues to present the roadmap to "follow" the rules, or to work the refs. Instead, if we moved to a system of protocols instead of platforms we could decouple the data from the service, putting real control of the data back in the hands of end users. Then things like privacy policies and GDPR enforces wouldn't matter so much, because we'd have direct control over our data.

Instead, all we have is a massive law that has harmed startups, entrentched big companies, failed to protect privacy and just served to annoy most users.

The reality is that many people, in order to save time, simply click “OK” on the never-ending stream of pop-ups and most everyone I spoke to confess that they just move on when unable to access the desired website. Or, as one Twitter user told expressed, “I read a lot fewer articles in US papers/magazines.”

And, sure, there have been a few fines of internet companies, but as recent GDPR complaints show, there does not appear to be any way to actually fully comply with the GDPR, which makes it a particularly useless law. If you can't actually comply, if it's not actually protecting privacy, and it's just annoying users and creating more bureaucracy, what good is it?

Meanwhile, Alec Stapp has collected a ton of stories and examples of the GDPR's negative impact. It notes much of the stuff above, but also highlights just how damaging it's been to innovation on the whole:

Startups: One study estimated that venture capital invested in EU startups fell by as much as 50 percent due to GDPR implementation. (NBER)

Mergers and acquisitions: “55% of respondents said they had worked on deals that fell apart because of concerns about a target company’s data protection policies and compliance with GDPR” (WSJ)

Scientific research: “[B]iomedical researchers fear that the EU’s new General Data Protection Regulation (GDPR) will make it harder to share information across borders or outside their original research context.” (POLITICO)

So now that we've had a year, can we admit that the GDPR has been a total failure by almost every possible measure? Supporters of the law will say to give it more time, or to say we need to "improve" the rules, but it should be obvious by now that the entire approach is the problem, not the implementation.

Filed Under: censorship, competition, compliance, data protection, dominance, eu, free speech, gdpr, privacy, tech

GDPR Concerns Temporarily Result In The Removal Of Trash Cans From Ireland Post Office

from the that's-some-fine-regulation-you-got-there,-EU dept

The regulatory nightmare known as GDPR continues to wreak havoc. The data privacy law enacted by the European Union has possibly helped protect the data of Europeans, but the thick cloud of smoke rising from the collateral damage makes it impossible to say for sure.

Regulating the internet isn't as simple as the EU Parliament thought it would be. The first reaction many US sites had to the new law was to block every user appearing to originate from a covered country. The EU Parliament couldn't even comply with GDPR properly. Its own website didn't anonymize incoming users correctly, allowing the Parliament's site to hoover up IP addresses to send through to Google Analytics. The EU Commission responded to this gaffe by exempting itself from the law.

Meanwhile, European citizens were experiencing the downsides of mandated data export. The law requires all user data collected by tech companies to be available on demand to European internet users. In theory, a wonderful idea. In practice, it means if someone hacks one of your accounts, they can start requesting your data as well. Even without being hacked, your personal data can be sent to someone else because tech companies are just as prone to clerical errors as anyone else.

This latest incident is more of the same. Another debacle powered by GDPR. This time, the problem created wasn't composed of 1s and 0s. This time the side effects could be felt physically.

All public bins have been removed from the GPO [General Post Office] due to potential privacy breaches under the General Data Protection Regulation (GDPR).

Customers and visitors to the historic building will no longer be able to dispose their litter within the premises.

An Post says under the new privacy laws, even rubbish containing personal details is considered their responsibility.

For this reason, a decision was taken to remove every bin from the post office’s main hall.

The problem? Post office customers were tossing out unwanted mail and receipts -- all of which contained confidential personal data now regulated by GDPR. The post office's solution was to remove its inadvertent data collection facilities, which apparently led to people leaving their regulated data lying on the office's counters and floors.

Fortunately, this new normal for post office users was swiftly reverted back to the old normal. The Commissioner of the Office of Data Protection issued a clarifying statement on post offices, rubbish bins, and protecting the privacy of post office customers.

When contacted this evening, a spokesperson for the Office of the Data Protection Commissioner told independent.ie that "under no circumstances" could public litter be in breach of GDPR.

Great. Glad that's cleared up. Business as usual then?

“An Post have confirmed a number of outstanding issues around the handling of waste material from public litter bins in the GPO,” a spokesperson said.

“The bins had been removed from the public office of the GPO on a trial basis and have now been re-instated,” he said.

THE BINS HAVE BEEN REINSTATED.

This is the stupid world the EU Parliament has gifted us. A breathtakingly broad law that regulates every entity that might possess the personal information of others has, however briefly, resulted in the removal of trash cans to ensure compliance. This may be the dumbest collateral damage yet, but it certainly won't be the last.

Filed Under: data protection, gdpr, ireland, irish post office, trash cans

EU Quietly Ramps Up Preparations To Re-introduce Blanket Data Retention After Top Court Threw It Out In 2014

from the let's-protect-article-13-while-we-are-at-it dept

One of the biggest wins for the general public in recent years was when the Court of Justice of the EU (CJEU), the region's highest court, ruled in 2014 that the 2006 Data Retention Directive was "invalid". That naturally didn't go down too well with many of the governments in the EU, who were keen to keep it for surveillance of their populations. Almost immediately, the European Commission began to "examine the best options for the way forward as regards the retention of telecommunications data", as Erich Möchel reported in 2015. More recently, Statewatch published a draft of an internal document from the Council of the EU (pdf), outlining the EU's plans to re-instate obligatory data retention, while an updated version was obtained and released by ORF.at (pdf). The differences between the two versions give a hint of how the EU might try to play this. The earlier one says:

The rulings of the European Court of Justice in the cases Digital Rights Ireland and Tele 2, which set out the criteria for the lawful retention of data and access thereof are of fundamental importance in this context. It should also be noted that it has been argued that the findings of the Court in those cases apply only to traffic and location data, and not to subscriber data.

In the second version, the Council of the EU is much more assertive:

The rulings of the European Court of Justice in the cases Digital Rights Ireland and Tele 2, which set out the criteria for the lawful retention of data and access thereof are of fundamental importance in this context. In this context, Member States expressed their view that the findings of the European Court of Justice in Digital Rights Ireland and Tele 2 do not apply to subscriber data, but only to traffic and location data.

So maybe the line will be that the big 2014 defeat in the courts only applied to "traffic and location data", not to subscriber data. The hope seems to be that new legislation might specify that only data about the latter should be retained, thus avoiding the EU court's restriction.

The document also provides important information about another key piece of proposed EU legislation. The e-Privacy Regulation is designed to complement the General Data Protection Regulation. Where the latter essentially protects personal data at rest -- in databases, for example -- the e-Privacy Regulation will restrict how personal data can be transferred. Even though it is close to completion, the e-Privacy Regulation has essentially been put on the back burner, with no prospect of it being passed soon. Thanks to the latest document leak, now we know at least one reason why:

Legislative reforms at national or European level, including the new e-Privacy Regulation, should maintain the legal possibility for schemes for retention of data at EU and national level that take into account future developments and that are compliant with the requirements set out by the European Court of Justice.

This exposes a fear on the part of the EU politicians that the e-Privacy Regulation might place new obstacles in the way of a re-vamped Data Retention Directive. The comment above is a reflection of the fact that the e-Privacy Regulation will only be set on the path to final approval if it allows governments to collect and store personal data as they wish.

Finally, Erich Möchel's analysis of the latest version of the document from the Council of the EU notes a troubling possibility. While the EU is smoothing the way for data retention to return, it might get rid of another pesky directive that tries to limit surveillance of online users. Article 15 of the EU's e-Commerce Directive, passed in 2000, says:

Member States shall not impose a general obligation on providers ... to monitor the information which they transmit or store, nor a general obligation actively to seek facts or circumstances indicating illegal activity.

Techdirt pointed out recently that Article 13 (now renumbered as Article 17) of the EU's Copyright Directive imposes exactly this kind of general obligation. It is therefore quite possible that the CJEU could rule that Article 13/17 of the Copyright Directive is invalid, just as it did for general data retention. Möchel suggests that as the EU tries to bring back data retention, it might also take the opportunity to get rid of that ban on general monitoring to head off any legal challenges to Article 13/17 as well.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: cjeu, data privacy, data protection, data retention, data retention directive, eu, general monitoring, privacy, surveillance