Top EU data protection agency under pressure to act against Internet giants as GDPR turns 2 years old

A few weeks ago, this blog noted that there were questions hanging over the GDPR, not least the fact that no major fines had been issued against top Internet companies. The GDPR has just passed the two-year mark, and many have taken the opportunity to weigh in on this issue. For example, the data protection agency in Ireland, which would be responsible for issuing fines against the main online players, has just written a post on its GDPR enforcement plans. It says that the country’s Data Protection Commissioner (DPC) has submitted a draft decision about a Twitter data breach to the other data protection authorities in the EU, as it is required to do under the GDPR. This means a public statement on the case should follow fairly soon.

Perhaps more interesting are some other cases involving well-known Internet names. One concerns WhatsApp, and how information about its users is shared with Facebook, which bought WhatsApp for $19 billion in 2014. Three others are cases brought by the privacy expert Max Schrems, discussed on this blog two years ago. Schrems says that top Internet services like Facebook, WhatsApp and Instagram are guilty of “forced consent”. This is the practice of offering two basic choices to users of an online service: agree to be tracked for the purposes of serving up ads, or be thrown off the service. It’s a crucially important issue, since many Web sites adopt the same approach. If the DPC rules against it, the impact on the digital sector in the EU would be huge.

👉🏼 Read more:
https://www.privateinternetaccess.com/blog/top-eu-data-protection-agency-under-pressure-to-act-against-internet-giants-as-gdpr-turns-2-years-old/

#eu #GDPR #DPC #data #protection
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv

Web sites shared over 100 trillion pieces of our personal data last year: time to stop real-time bidding’s blatant disregard of privacy

Last week Privacy News Online wrote about developments in the long-running battle between the privacy campaigner Max Schrems and Facebook. One of the key issues there is the failure by the Irish Data Protection Commission (DPC) to act on the initial complaint made by Schrems seven years ago.

That matters, because under EU law, Ireland is effectively the data protection agency for the whole of the European Union. Like Facebook, Google too has its European headquarters in Dublin. That means complaints against the company must also be dealt with by Ireland’s DPC. As this blog reported two years ago, just such a complaint was submitted to both the UK and Irish data protection authorities, regarding the use of real-time bidding systems (RTB) by Google. The problem of RTB, and how it goes against core requirements of the EU’s GDPR legislation, was first discussed here three years ago, with updates noting the serious implication for privacy.

The UK’s Information Commission Office published the preliminary results of its investigation into RTB (since paused because of Covid-19) last year, and they didn’t look good for Google. The Irish DPC has been very slow to take action. As a result, one of the people involved in the initial complaint, Johnny Ryan, has released new evidence of how serious the problem is:

👀 👉🏼 https://www.privateinternetaccess.com/blog/web-sites-shared-over-100-trillion-pieces-of-our-personal-data-last-year-time-to-stop-real-time-biddings-blatant-disregard-of-privacy/

👀 👉🏼 https://www.iccl.ie/news/dr-johnny-ryan-takes-up-new-privacy-role-at-iccl/

#privacy #data #ourdata #urdata #rtb #dpc #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag