It seems like that's what's happening here though. The IAB appears to take all the blame while everyone else gets away.

They lose all the data though. They may have avoided some name smearing but it's the data that they really want.

I'd argue that the data has already been integrated into ML models or mixed in such a way that there's no way to even tell where the data originated from. While the logical conclusion would be to just delete any data they can't prove a legitimate origin for, I very much doubt this is going to happen.

Most importantly, tens of billions have already been made using this ill-gotten data.

Or just force all models to be deleted that had any input of that data in the first place. If they don't do that in practice let the whistleblowers do their job in exposing the companies.

Good luck identifying these models. By now what caused what is so muddled, it could get a small army of lawyers to even start detangling

According to the GDPR the burden of proving compliance is on the controller by keeping paper trails and documentation. So technically they would already need to be able to prove were all data has come from, or else they can't have it. So either they start untangling or they delete it. :)

The models aren't the data and aren't regulated under GDPR. It would be crazy to try to do so tbh.

The models aren't subject to GDPR, but which data went to which model is: every data treatment must be documented.

The GDPR doesn't apply to data that can't be related to a natural person. Those models would therefore no longer be under the scope.

Another example: You get consent from me, count your distinct visitors for January and I revoke my consent tomorrow. You do not have to change your visitor count retroactively.

> The GDPR doesn't apply to data that can't be related to a natural person. Those models would therefore no longer be under the scope.

Give me the models and a week, and I'll dox some people with them.

I don't think that's a fair example, because the issue is not about inaccurate data (the view count), but illegally gathered data.

An analog example would be stealing paint and painting your car with it. Should the paint be stripped off the car and given back? I don't know, but the victims are entitled to compensation, which isn't happening in the Google/Amazon case.

With your paint analogy, it feels like a "you wouldn't download car paint" situation.

I wonder if these models would become inaccurate over time without the data inflow.

I'm not sure to what extent this should be classified as a data breach, since the data was in effect illegally harvested and processed.

In case of a data breach, the controllers (i.e. the 1000+ companies) would be required to provide notification to the respective supervisory authorities of the affected users [33] -- although due to the one-stop-shop mechanism, that notification will be considered already done. But on top of that they would also be obligated to inform the affected users themselves [34].

Article 34 also includes this stipulation: The communication to the data subject [..] shall not be required if [..] it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

Note that these requirements are on the controllers, not the processor. IAB in this case is the processor. So if the data authority were to consider this a data breach, the controllers would not get away scot-free.

[33] https://gdpr-info.eu/art-33-gdpr/

[34] https://gdpr-info.eu/art-34-gdpr/