That's you, but what if Vodafone buys this data? They know the personal data of their broadband users but they don't necessarily have religion or other personal preferences... should they?
Or how about when it's me? Maybe I just know this space better? I can get email addresses from pretty much anywhere, md5 them, check against the email hash from Lotame (or someone; it's almost always unsalted md5), and match that against Google's Bidstream. Bingo: Now I have email to "intimate" data[1], which probably surprises a lot of people!
[1]: I like that term better than both "special category data" and the older "sensitive personal data"... I think I'm going to use it
Furthermore, you probably know the IP of the user you're serving a page to, that combined with this data also makes it PII..
It's not about wether you can determine the person's name, mail address or whatever, it's wether this combination of data is or can be unique to a single person.
You can of course cookie match with them so it is possible to persinnaly identify someone if you were able to cookie them.
> In the end Google allowed publishers to use whatever method they want.
The phrase "personally identifying information" does not occur anywhere in the text of GDPR. The term used throughout is "personal data", which is defined differently.
>It's not about wether you can determine the person's name, mail address or whatever, it's wether this combination of data is or can be unique to a single person.
Uniqueness is irrelevant unless there is sufficient identifying data to associate that data with an identifiable natural person. Unless you have some means of ultimately figuring out "this data belongs to Joe Bloggs of 123 Any Street", then it isn't personal data.
Art. 4 (1):
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
https://gdpr-info.eu/art-4-gdpr/
Pseudonymous data falls within the scope of GDPR if other information could be used to associate that data with an identifiable natural person. Truly anonymous data is exempt - you might know a lot about person X, but that's only personal data if you can figure out that Person X is actually Joe Bloggs. It really isn't clear to me that Google are in breach in this instance; it's highly plausible that they are, Brave's allegations certainly warrant investigation, but the law is relatively complex and it's also somewhat plausible that Google are sailing very close to the wind while just barely remaining in compliance.
That's not exactly accurate.
I like the ICO's literature on this[1] because they put a little more colour on what it means to be "indirectly" identifiable, and they are pretty clear:
• You don’t have to know someone’s name for them to be directly identifiable, a combination of other identifiers may be sufficient to identify the individual.
• It is important to be aware that information you hold may indirectly identify an individual and therefore could constitute personal data.
• That additional information may be information you already hold, or it may be information that you need to obtain from another source.
That's the case here: An ISP such as Vodafone knows the IP addresses of their broadband users, and perhaps even some of their cookies -- they have this other piece of data that makes what Google is providing personal data. To my knowledge Google isn't attempting to even argue otherwise, instead they have taken the position that the person has consented (using various consent managers or click-to-accept dialog boxes), so therefore it's pseudonymous, which makes your next paragraph a little more important:
> Pseudonymous data falls within the scope of GDPR if other information could be used to associate that data with an identifiable natural person. Truly anonymous data is exempt...
This is incorrect. Again from the ICO:
• Pseudonymised data can help reduce privacy risks by making it more difficult to identify individuals, but it is still personal data.
• Information which has had identifiers removed or replaced in order to pseudonymise the data is still personal data for the purposes of GDPR.
Very clear: All it takes is for the data to relate to a person.
> It really isn't clear to me that Google are in breach in this instance
It's not clear to me either, or (to my knowledge) to the Irish DPC at this stage, but part of their responsibility is to figure it out. They have released very little information so far[2] so there's little point armchair-lawyering on what their position or defence would be.
[1]: https://ico.org.uk/for-organisations/guide-to-data-protectio...
[2]: https://www.dataprotection.ie/en/news-media/press-releases/d...
I was under the impression that individuals keeping notes for non-commercial purposes is not governed by the GDPR.
Bodil Lindquist v Åklagarkammaren (2003) Mrs. Lindquist (whose purposes were mostly charitable and religious) published on a private home page personal data about her colleagues, including telephone numbers and information about a coworker’s injured foot and medical leave. This case raised the question if a private home page accessible to only those who have the address is permitted under one of the exclusions (household activity). The European Court of Justice ruled that it is not.
https://gdpr-info.eu/recitals/no-18/
> This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. 2Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. 3However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.
The case is the precedent for the GDPR recital. Both of you are correct.
Bodil Lindquist v Åklagarkammaren (2003) Mrs. Lindquist (whose purposes were mostly charitable and religious) published on a private home page personal data about her colleagues, including telephone numbers and information about a coworker’s injured foot and medical leave. This case raised the question if a private home page accessible to only those who have the address is permitted under one of the exclusions (household activity). The European Court of Justice ruled that it is not.
That's not a private note, and I'd be livid if somebody was posting my contact and medical details online. I see no problem with this ruling, nor do I see it as evidence contrary to the idea that one may keep private notes.
What got my goat, though, wasn't the mere, if silly, clarification that notes are only protected if they're private. It's the phrasing of the quote to suggest that somehow these notes should have been considered private because the publisher didn't intend on anyone reading them (despite publishing them such that they could).
In fact it sounds like a precis of the quote I provided, but I could also imagine the defendant's lawyer saying it in the more loaded way presented here.
I think it's somewhat irresponsible to throw out accusations this big without even feeling the need to offer any evidence for them.
FWIW I once summed up the various fines (anti-trust etc.) doled out by the EU by country/continent. It turned out that US companies were, collectively, fined slightly less than their share of economic activity in the EU, while Asian companies were fined more and EU companies were about level.
This corresponds rather well with a non-corrupt process largely blind to companies' nationality, assuming that US companies are rather well-regulated in the US compared to Asian companies.
I haven't done the reverse for US fines of European companies. But, subjectively, the cases that made the news (mostly VW and Deutsche Bank) gel rather nicely with my (Germany-based) impression of companies with malignant corporate culture and do not require any nationalistic motivation to explain.
I know it may seem like a minor point in this context. But if we always assume all institutions are corrupt, that becomes a self-fulfilling prophesy. Institutions such as the court system and, more generally, the rule of law, are the reason we (some of us) can enjoy life in peace, and shouldn't be torn down just by empty cynicism.
The trouble is this doesn't really prove anything for the exact reason you're identifying. What you have to compare is the level of enforcement compared to the level of compliance. If US companies are more compliant than average then there should be less enforcement than average, but then you still don't know whether there is more or less than there should be. If US companies are fined 75% as much even though they break the rules 50% as much, that's evidence of bias rather than a lack of it.
Moreover, major US companies are hard sticklers for following rules. They're full of lawyers because their home country is and they'll get their pants sued off otherwise.
That actually seems to be the problem. The EU passes some complicated stack of rules, the US companies have their lawyers go through them and figure out how to comply without disrupting their business, but disrupting their businesses was the motivation for the rules. Then the EU comes around and fines them again. Everybody who dislikes them cheers, but it smells rotten because the companies knew they were under scrutiny and had good lawyers, so it's difficult to find explicit violations and consequently huge fines get meted out over behavior which is not even clearly a violation of the rules.
A company that tries to weasel around the rules while knowing exactly what the EU meant is just taking the regulators and courts for fools.
> good lawyers
If US companies keep getting fined despite having "good lawyers", maybe those lawyers aren't that good after all.
"The spirit of the law" is the refuge of people that can't be bothered to make good laws to begin with and just want to make up whatever rules they want ex post facto.
> If the spirit of the law is to ban your business model, switch to a different one or stop operating.
If the spirit of the law is to ban their business model then stop pussyfooting around it and just make that the letter of the law.
> If US companies keep getting fined despite having "good lawyers", maybe those lawyers aren't that good after all.
A good lawyer can't always overcome a bad court.
That's a good approach if you want to play silly games, but fortunately the EU prefers effective regulation. And its courts are reliable enough that we can rely on its judges having common sense when interpreting the law. Maybe the US is different.
> If the spirit of the law is to ban their business model then stop pussyfooting around it and just make that the letter of the law.
It is, actually. But the good lawyers of US companies apparently believe, for example, that "freely given consent" means "clicking a button to make an overlay go away because we make the provision of our service conditional to spying on them". What does the GDPR say?
> When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
US companies are openly breaking the GDPR and violating people's privacy. Frankly, 4% is far too low for this kind of insolence.
Regulation can only be effective if people know how to follow it. Otherwise you're just a bully punishing people for things they can't predict ahead of time, and you can't produce the desired behavior because you've failed to identify what it actually is.
> It is, actually. But the good lawyers of US companies apparently believe, for example, that "freely given consent" means "clicking a button to make an overlay go away because we make the provision of our service conditional to spying on them".
You seem to be claiming that things like this do not exist:
https://myactivity.google.com/
How is the service "conditional to spying" if you can turn it off or delete the data and still use the service?
> US companies are openly breaking the GDPR and violating people's privacy. Frankly, 4% is far too low for this kind of insolence.
You obviously have strong opinions about Google. But is there a reason you don't just stop using their services? I can't think of any that has no competitors.
Stop pretending that the GDPR doesn't do that.
> How is the service "conditional to spying" if you can turn it off or delete the data and still use the service?
You obviously don't know what you are talking about. You can't turn Google's spying off. They show a modal that you can only dismiss by "agreeing" that they use your data for their purposes.
> You obviously have strong opinions about Google. But is there a reason you don't just stop using their services? I can't think of any that has no competitors.
Because they're useful. That's why people use services. Idiotic question.
If it did that then there would be more lobbying the legislature to change it while complying with it and fewer lawsuits being filed because people disagree about what's necessary to comply with it.
> You can't turn Google's spying off.
Then why do they have a bunch of settings where you can turn it off?
> Because they're useful. That's why people use services. Idiotic question.
It seems like you want "free" services funded by targeted advertising but you don't want targeted advertising. Is that not an inherent conflict? If the end result is that you end up paying for your services with money, why don't you just start there?
I'm not interested in theoretical arguments contradicting easily verifiable facts.
> Then why do they have a bunch of settings where you can turn it off?
You can't turn the privacy violations off that Google commits for their own profit.
> It seems like you want "free" services funded by targeted advertising but you don't want targeted advertising. Is that not an inherent conflict? If the end result is that you end up paying for your services with money, why don't you just start there?
Why on earth would I pay for a service I can get for free? It's not my problem that Google doesn't charge for their services. No, they aren't trading services for privacy since you cannot trade services for privacy in the EU anymore.
Which of these do you think is more likely: That Google knows the specific things that will cause it to be fined and just doesn't care about tens of billions of dollars, or that they're trying to but can't figure out ahead of time what behavior will result in fines?
> You can't turn the privacy violations off that Google commits for their own profit.
Then what do those settings do?
> Why on earth would I pay for a service I can get for free?
Somebody is paying for it. If you get them to stop doing that, what do you expect to follow?
> No, they aren't trading services for privacy since you cannot trade services for privacy in the EU anymore.
At which point you have the possibility of most people "voluntarily" sharing their data and the service continuing to be free, or the alternative that they don't and everybody has to pay for it directly. But the first one is basically the status quo and if you're angling for the second one then, again, why don't you just start there?
I'm not interested in theoretical arguments contradicting easily verifiable facts that are phrased as false dilemmas.
> Then what do those settings do?
I don't know -- Google doesn't let me access them without logging in. Nor do I care. It definitely doesn't let you turn off the data collection that Google forces you to "consent" too. The whole point of forcing someone is not giving them a choice.
> Somebody is paying for it. If you get them to stop doing that, what do you expect to follow?
The services currently funded with corporate propaganda are instead funded in a saner way. Ideally the public funds it, but even charging people individually makes more sense than ads. However, other goods and services become slightly cheaper because their producers and providers don't spend as much on advertising. This more than compensates having to pay for services since you only have to pay for the service itself, not the service and the ad companies that charge you for the service in a stealthy and horribly convoluted way.
> At which point you have the possibility of most people "voluntarily" sharing their data and the service continuing to be free, or the alternative that they don't and everybody has to pay for it directly. But the first one is basically the status quo and if you're angling for the second one then, again, why don't you just start there?
Because I'm a dirty commie who is not in the habit of donating money to multinational for-profit corporations. Is that a serious question?
Theoretical arguments apply to things that aren't happening. This is happening right now.
False dilemmas imply that there is a choice presented as binary which really has more than two alternatives. Since Google is being fined billions of dollars, one option is that they knew ahead of time what would cause that to happen and did it anyway, the other is that they failed to predict that their conduct would have that result. What is your proposed third alternative?
> I don't know -- Google doesn't let me access them without logging in. Nor do I care. It definitely doesn't let you turn off the data collection that Google forces you to "consent" too.
How do you know if you don't know?
Tracking preferences are state. They have to be attached to something in order to be applied to it. What do you propose they use to assign your tracking preferences to you, if not an account?
> The services currently funded with corporate propaganda are instead funded in a saner way. Ideally the public funds it, but even charging people individually makes more sense than ads.
Both of those options are already available. You could have your government fund competing services or pay for them yourself right now, or ten years ago, or at any point in the future.
> However, other goods and services become slightly cheaper because their producers and providers don't spend as much on advertising.
This is plausible, but then why all the indirection? Pass a law expressly prohibiting targeted advertising.
Note that there is a counterargument however. If advertising is less effective, companies will still pay for it but attract fewer new customers to the industry and correspondingly sustain fewer competitors and sell fewer units to amortize fixed costs over, and it becomes more difficult for new competitors to gain customers, which reduces competition and raises retail prices per unit.
It's not clear which of these is the case and it's probably a different result for different industries.
"Rule of lawyers" is what happens when it isn't and then you need a rhetorician to have an ex post facto political debate about "the spirit of the law" in a courtroom rather than in the statehouse where it belongs to begin with.
> rather than in the statehouse where it belongs to begin with.
The GDPR was debated in the European Parliament, a court can easily refer to its protocols to find out its drafters' intent.
But seriously, if you're at the point of having to rely on "the spirit of the law" it's pretty much always because the letter of the law is poorly drafted. It doesn't really matter which continent you're on.
There is a truth to that. We need to rely on the spirit of the law because lawmakers, like everyone else, are neither omniscient nor do they never make mistakes. Letting people use unintended loopholes makes sense if you treat the law as a game, not if you treat it as a mechanism to achieve justice.
The question is, what do you do when you find one?
Option one is that you go back to the legislature and have them fix the law, which then applies to future conduct. Particularly for issues affecting ongoing operations on this scale, this is a completely reasonable option.
Option two is that you go to the court and ask them to remake the law and apply it retroactively to past conduct, then impose billions of dollars in fines for following the law as it was written.
But option one doesn't extract revenue from foreign companies. Which is why people are suspicious of your motives when you jump to option two.
Option one also has the advantage that it can produce more coherent results, because the legislature doesn't have to operate under the pretext that it isn't making a change to the law when it really is.
I don't think we need to cater to paranoid Americans.
> Option one also has the advantage that it can produce more coherent results, because the legislature doesn't have to operate under the pretext that it isn't making a change to the law when it really is.
It's perfectly reasonable for a legislature to assume it isn't changing the law when the law isn't being changed and it's not the legislature that is acting.
A fine position if you don't care about businesses abandoning the European market and the US government using it to justify retaliation against EU companies in the US market.
> It's perfectly reasonable for a legislature to assume it isn't changing the law when the law isn't being changed and it's not the legislature that is acting.
If a court is interpreting the law to mean something other than what it says, it's changing the law.
Oh well. We might become as isolated as China. Businesses don't care about rule of law when there is profit to be made. Also most people are capable of understanding how laws and courts work.
> If a court is interpreting the law to mean something other than what it says, it's changing the law.
If a court is making jokes and filming sketches, it's a comedy troupe.
What did you mean by this nonsense?
That may end up happening. With the copyright directive and these fines, companies may find that serving EU consumers is not worth it and may start blocking EU users from their services.
And the difference is? Those are both very subjective.
The EU could get around this by not writing crappy laws, but I guess this is why we have courts.
Compared to what is the letter of the law subjective? Pure math?
> The EU could get around this by not writing crappy laws, but I guess this is why we have courts.
People not making mistakes and having infinite foresight would solve so many problems. Probably not the one of natural language being fuzzy, though.
> US companies were, collectively, fined slightly less than their share of economic activity in the EU,
I can imagine why you would control for economic activity, but I have no idea what impact that had on the results relative to other reasonable controls. If we're wondering about punishing bad decisions, you could have instead controlled for the number of decisionmakers from these companies in the EU. Or you could have controlled for the number of different endeavors or types of products or lines of business (because each different source of revenue is a source of malfeasance moreso than each individual euro earned). I'm really mostly concerned about that last one. What is the chance each revenue stream will get more scrutiny by being foreign? Court cases don't target individual euros earned, they target a certain product or way of doing business.
Regardless of controls, it doesn't change the tortured logic in some high profile cases comparing US and EU institutions under the same standard. If the Spanish media publicizes something as widely as it can, that's great, because it's good for the public to have that information. If an American tech firm allows people to access those publications, that's bad, because it's bad for the public to have that information.
I'd love to change my mind about the bias in the EU, I'm open to new evidence. All it would take is a few EU cases where they found that the big American company was blameless, but the small European company should be fined.
It's not a case where the US and EU companies are on the same side like I originally proposed, but those might be too rare to test anyway, so I was probably being a bit silly.
Failing back to these more common cases, I don't think (and shouldn't have implied that) one case alone in a decade completely decides the question of bias, but it should definitely shift the probabilities here, if you want to be bayesian about it.
EDIT for emphasis.
It's a complicated counterexample to the premise that the EU is preoccupied with fining US companies.
We are less likely to hear about small companies getting fined by prominent bodies, because they have less impact, because their case doesn't receive public attention, because they don't lawyer up in long protracted battles, etc.
> the Spanish media vs. American tech firm
One is a press organization, the other is (usually) an ad-tech business. Different rules apply for different deontology sets. Much like FB doesn't get the same slack as the NYT when it comes to disclosing stuff.
They can be found at the following links: http://www.igmchicago.org/surveys/antitrust-and-internationa...
http://www.igmchicago.org/surveys/antitrust-and-internationa...
At least in the academic economist community, there is disagreement on the EU's use of antitrust powers (although it leans toward the EU promoting competition more than being protectionist).
I generally interpret this data to mean that viewing the application of EU antitrust as protectionist is a defensible, although uncommon, opinion.
I would be interested in seeing this analysis, but I'd also be interested in knowing two things:
1. When was it done?
2. Were you analysing fines by member states or fines by the Commission itself?
My very strong impression is that in recent years there's been a new phenomenon of the EU itself dishing out fines of vast new magnitude - not an EU member state, but the Commission. This wasn't true 10 years ago, but it feels like it's started in earnest now. Indeed GDPR and Vestager's time as anti-trust commissioner are relatively new.
Institutions such as the court system and, more generally, the rule of law, are the reason we (some of us) can enjoy life in peace, and shouldn't be torn down just by empty cynicism
Whilst I fully agree, there are some other factors at play here.
One is that EU level fines aren't levied by the court system. The EU bureaucracy acts as judge, jury and executioner. Fines simply ... appear. There is no right of defence. Fined firms may then appeal to the ECJ, but this takes a very long time and I don't know if there are any cases yet where an appeal went against the Commission.
This is not how normal justice works of course. Normally the government has to prove a firm guilty of criminal behaviour first, then punish it second. The EU reverses it. That's a fundamental change.
Secondly the ECJ is a corrupt court. It has a history of corrupt and ideologically motivated practices. For instance it has heard a case where the plaintiff didn't know they were part of a court case at all. When informed of this state of affairs by journalists, the ECJ ignored it and continued. There have been a long string of rulings where the ECJ openly and blatantly ignored what the written law of the treaties actually said, with Kafka-esque interpretations of language the treaty authors thought was bulletproof.
Why is the ECJ like that? Because like all EU institutions it is created and staffed by people who are ideologically committed to the furtherance of the EU project. They are not independent; they are fully bought into the Federalist agenda. That agenda is currently suffering due to member states not wishing to grant the EU more money, and because the UK is leaving (trying to leave), which will cause a large drop in budget. Endless vast fines against tech firms for violating laws so vague all sorts of ordinary behaviours could conceivably be illegal is a perfect vehicle for them to top up the bank balance ... because that's where fines go. Straight into the EU's own institutional pockets.
The EU is different because it has a long term overriding Federalist agenda independent of EU elections, which can't actually change anything.
As for the budgets, maybe you're running behind the times.
Let's take the UK's budget contribution to the EU in 2017, it's about £13 billion. That's a lot of money, the UK is one of the biggest budget contributors.
Just one single fine of one single company, the 2018 fine against Google, clocks in at $5 billion! Earlier in that year the EU fined Qualcomm $1 billion. In 2017 Google was fined $2.7 billion.
The fines against US tech firms alone are in the same range as the entire contribution of one of Europe's biggest economies. There is an absolutely vast conflict of interest there, on a scale never seen before.
> While I think Google is technically in the right here, they're gonna loose big time because they're a foreign company and don't have much love with the public.
They don't need love with the public, just with the ECJ.
IANAL but I would assume that all it takes is one incident of it actually being personally identifiable to erase this argument. All it takes is one data point that is "unique enough" to map it to one person. Imagine a very unique combination of these three values (religion, age, personal preferences: muslim, 21, likes curling) and add an equally unique location (Iceland) and you may be in trouble.
Even if you cannot use the data to identify a person, maybe your ISP or the police could, making the information "personally identifiable". According to https://www.groundlabs.com/what-is-pii-for-gdpr/ IP addresses count as PII.
> Some requests totally are identify-able though, for example if the user goes on to click one of our ads, buy something, and give us their postal address.
And if you operate at scale, that might happen thousands of times per day.
IMHO this is a serious GDPR infringement.
Do you notify users that you process PII, even if you don't bind on this request? Do you give users the option to opt-out before you do? If not, you are in serious trouble.
https://www.nytimes.com/2012/10/13/technology/ftc-staff-prep...
So, if it is possible to correlate the personal data with other records that identify an individual (whether by you or a third party with whom the data is shared) it is personal data.
Full disclosure: I work for Veritas Technologies, which, among many other things, provides technologies that help companies find, filter and take action on PII and personal data. Opinions shared here are my own, and do not necessarily represent the views of my employer.
[1] https://ico.org.uk/for-organisations/guide-to-data-protectio...
Anymore I just straight up “lie” about personal details. A relationship with a tech company is based upon serving my needs first, not theirs, IMO. And at least for me the need they fill is convenience of not having to build the service they provide. Which I would do if said service did not exist.
So there’s that. Have my fake data. Sell emotional but technically inaccurate promises to advertisers all ya want, SV.
Also... use a [email protected] email address to avoid having to sign up for real.
Sure they won't directly come after you, but if you're in court for some other reason, the fact you put 'hwpsn62#!' as your mother's maiden name might add one more charge...
I am also dubious since its Ireland and Google offices,servers is located on Ireland. Thus Ireland data regulation authority might rule in favor for Ireland.
You are either compliant or not. Claiming that you are 90% GDPR compliant still makes you non-compliant.
> While I think Google is technically in the right here,
No, they are not technically right, because even being 99% right makes you 1% wrong, which in case of Google would affect 70M people.
> they're gonna loose big time because they're a foreign company and don't have much love with the public.
The love of the public doesn't have any legal influence, and being a foreign company doesn't mean that company can play by it's own or their home country rules.
By the same logic, one could argue that Volkswagen, Deutsche Bank and Monsanto got fined hefty only because they are foreign companies, and that they would be either not fined, or fined much less if they were US based. Oh, wait ...
Do this enough and you end up in Cambridge Analytica-town with portfolios on millions of email addresses that can then be sold independently of the advertiser’s knowledge.
Frankly laws like GDPR might actually be saving the industry, because the arms race to figure out how much information you can get about users is why users start using ad blockers.
I have access to one of these data feeds of bid requests, and for the most part, they're right. Pick a random entry and even after hours of searching and correlating with the other data we have on file, it's unlikely I'd be able to identify exactly who it was (ie. Their name and address) on that website.
Some requests totally are identify-able though, for example if the user goes on to click one of our ads, buy something, and give us their postal address. In the eyes of the law, we have broken the rules there by re-identifying previously anonymous data.
While I think Google is technically in the right here, they're gonna loose big time because they're a foreign company and don't have much love with the public.