Google accused of GDPR privacy violations by seven countries
theverge.com
theverge.com
The title of the Reuters article this is sourced from is more accurate, "European consumer groups want regulators to act against Google tracking". The article can be found at https://www.reuters.com/article/us-eu-google-privacy/europea...
> In our opinion, the scale in which Google tracks the location of its users breaches the GDPR. Users have not given free, specific, informed and unambiguous consent to the collection and use of location data, particularly considering the scale of tracking going on, says Gro Mette Moen.
https://www.forbrukerradet.no/side/google-manipulates-users-...
Most people just use Internet services to get things done, rather than experimenting with them enough to know how they work. And they believe rumors.
1) Simple cost/benefit. The EU has very little to lose and very much to gain by making rules favoring internet users. The US has very little to gain and very much to lose by making rules harming internet companies.
2) Trust. Europeans trust their governments to do good for them compared to internet companies. Americans trust their governments to do worse to them compared to internet companies. It's quite possible both are right. Similarly, Europeans implicitly trust this is not the beginning of a slippery slope of internet legislation whereas Americans very much fear that giving lawmakers an inch encourages them to take a mile. Same goes for willingness to repeal.
3) Enforcement. Europeans know, based on previous incarnations and regulator statements, that enforcement will be lax and/or subjective and/or limited in scope. Americans fear large-scoped laws since they expect enforcement and court battles once on the books.
4) Perceived harm. Europeans see many more harms from these internet companies than do Americans (HN notwithstanding). Americans simply don't believe tracking and data collection of public data is that big of a deal, especially for the tradeoff they get in services they or others choose to use. It's apathy, not ignorance as many here would have you believe.
5) Scope. Kinda the same as trust, Europeans aren't bothered by large-scoped legislation against businesses and Americans are. I suspect you'll see transparency/disclosure requirements one day in very limited form, but I doubt it'll become so expansive as allowing user requests, requiring certain forms/figureheads, and forcing businesses to do business with the user after opting out of tracking.
6) Freedoms. Europeans see a clear separation between consumers and companies wrt freedoms. Americans see companies, especially small ones, as just collections of citizens. Small business and entrepreneur compliance burdens are very much considered by American lawmakers on new law areas like the open internet.
There are exceptions to all of this of course, but I gather these are the general climate differences.
Whether political activists, art critics, family members, next-door neighbors, school boards, building code inspectors, whatever it is. It's our core prejudice. The French are racist, the English classist, Americans hate busy-bodies.
It is core to Americans that people should think and act locally, as a rule. Basically -- mind your own business.
Applied to GDPR, this philosophy goes; "Unless you or someone you know has been concretely hurt by these businesses tracking them, why are you trying to make a law about it?"
To an American, when we hear someone trying to fix something that they have not themselves been a victim of, it sets off our busy-body radar, and we prepare to defend ourselves.
Americans are nosy and paranoid; we distrust our neighbors to the point of societal breakdown on the regular and we just get inordinately mad when somebody cares about our stuff. It's not a "don't scream until you get shot," it's a "fuck you, got mine." There's a real difference here.
Second, you're mistaking your own partisan lens for what constitutes busybodyness with the American Public's lens. Americans are radically middle, rebelliously centrist, and hate changes when they come from either side of the political aisle.
And so the busybody thing cuts both ways --
- It blocks your liberal attempts at busybodyness (trans bathroom laws, trigger warnings, political correctness)
and
-It blocks our conservative attempts at busybodyness (additional censorship in media, stop and frisk, morality laws).
Americans are/were against laws to forcibly open up bathrooms to everyone and marriages to same sex couples specifically because those things appear/appeared busybodyish. Both of those things are/were changes to the law. That makes them inherently busybody.
Taking the gay marriage debate: it was only when gay folks were finally able to convince America that new laws blocking them would be more busybody than letting the laws die in court, did gay folks win the public argument.
But changes are coming that are great for conservatives, as the left is starting to lose their title of the anti-busybody;
The university social justice wing has taken on the role that the Westboro Baptist Church played in 1990's American politics, the supreme busybody, and Americans are turning against them.
This is deadly to liberal politics, since being the busybody is the worst thing you can be in American politics.
Last time I checked people are free to marry whoever they please.
> substances you are allowed to make or put in your body
Marijuana is legal in the majority of states.
Sure these developments are recent but the reason they happened is because as the parent said, American's hate busy bodies.
Untrue, though closer to true than it was five years ago. I mean, gender restrictions are gone, but consanguinity restrictions remain (most people may agree with them, but that doesn't mean they aren't restrictions beyond mutual consent of the parties.)
> Marijuana is legal in the majority of states.
While this is frequently stated, it is sloppy and inaccurate; marijuana is legal in zero states. Many states do not have additional state level criminalization of some subset of cultivation, sale, use, and possession of marijuana on top of the federal prohibition, but that doesn't make it legal in those states in th same way that states not having additional state-level criminalization of lying to a federal officer doesn't make that legal in those states.
(And, in any case, marijuana isn't the only substance prohibited to adults in the US.)
Yes, as of 2015. What about before then? For all those years, "free to marry whoever" was not the law
> Marijuana is legal in the majority of states
Only 11 states actually have marijuana legal for recreational use. See http://www.governing.com/gov-data/safety-justice/state-marij...
The USA (generally) believes in negative liberty which is based around the individual being able to do whatever they want unless it actually harms another person.
Both positive and negative liberty are valid views but generally positive liberty leads towards trouble in the form of authoritarian issues.
Also, we definitely do not have a constitutional right to privacy in the public sphere for services that we elect to use.
Courts and legislatures in the US regumate limits to corporate behavior in ways that are the complete opposite to what you're saying.
It is. I don't even understand how it couldn't be unless you are trying to state that doctors themselves are somehow not individuals.
I work for a company that operates on HIPPA-protected data; if I leaked any of that, I wouldn't face any legal punishment but the company I work for would be on the hook for some seriously large fines.
Be careful believing that; it's true that direct liability under HIPAA is almost exclusively for be covered entity as such, but individuals may be criminally liable for HIPAA violations in two ways:
(1) Certain directors, officers, and employees may be liable under general principles of corporate criminal liability, and
(2) Individual employees (and other inbividuals) not criminally liable under (1) for direct HIPAA violations that have a role in it may be liable for conspiracy or aiding and abetting (the latter of which has identical punishment to the crime it relates to) related to the underlying crime committed by the covered entity that is their employer.
So, yes, actually knowingly leaking PHI that subjects the company to crimination penalties under HIPAA would likely also subject you to criminal penalties tied to that HIPAA violation.
Hence: Is your argument that it would be unconstitutional to apply SOX or HIPAA to non-profits, teachers unions, churches? If not, my original argument still stands. Businesses are forms of assembly, and thus protected by the first amendment.
also, businesses are groups of persons
https://en.wikipedia.org/wiki/John_Stuart_Mill.
So it's really not a US/Europe thing at all - both very much value negative liberty, although it is probably fair to say that Europe also values positive liberty a bit more. It's more about the role of corporations. The US seems to view corporations as almost equivalent to people, whereas in Europe more often they are viewed as quite separate. And Europe has a broader definition of harm around monopolies than the US does currently at least, especially around the importance of data protection (but again both in respect to negative liberty).
I'm inclined to believe that our politicians don't fancy to get their reach to the public(therefore, their careers) being controlled by an American organization that would sell that reach to the highest bidder or to US interests.
Also, I think that companies or governments knowing too much about you and then doing bad things with that information is not a fiction but a memory or a lesson from the history books and this helps with the public support.
I think they want to have a rule book in place so that they know how these internet media giants operate and make sure that Facebook is making their money by showing chocolate ads but not selling information to 3rd parties who want to shape the political landscape in Europe.
They wouldn't want, for example, have Bulgaria being targeted by Russia or Turkey and start another civil war in the Balkans through acquiring detailed profile information of the few million people there.
True, in the US consumer rights are largely a joke, but on the same token doing business in the EU seems to be a huge regulatory mess for corporations both abroad and internal and it's quite hard to imagine any company in the EU reaching the heights of Microsoft or Apple, or even seeing more adventurous and risky endeavors like Tesla.
Pros and cons to both sides of having such rules. I'm certainly on the side of believing pro-consumer rights, but the lack of them may not be entirely a bad thing from a macro economic standpoint either.
I have seen in my third world nation we have worst vehicle/ industrial pollution in the world, but govt will rain on cigarette smokers like ton of bricks as if it is the biggest issue in public health. But in reality govt act such way because it is easy to legislate while showing people they care.
https://en.wikipedia.org/wiki/Political_groups_of_the_Europe...
Former Soviet states now EU members have fresh memories of surveillance running amok.
The US is starting to lean towards the realization big tech needs to be regulated, but it's going to take us longer to get there.
In the first half of the 1940s, the state not being fully informed about what you are doing could mean the difference between life and death. In the four and a half decades following that half the continent was living under an oppressive regime that was carefully monitoring every citizen, and people had to be careful to not disappear.
As a consequence, the potential consequences of a lack of privacy are fresh on everyone's mind. Compare that to the US, which in the same time was dismantling privacy protections on the hunt for Communists.
It has been a slow evolution from my perspective. I came to the European Union around 2006. Facebook started to become popular, myspace was starting to collapse. Smartphones were rare at that time and not really recognizable as such. The internet giants were not so giant at that time. In Eastern Europe during the cold war, spy networks caused a lot of problems for people, and most people in Western Europe were and are still keenly aware of these problems. Note that a right to data protection and privacy existed in the EU since 1995, well before I arrived.
Around that time, a big scandal in the country I was living in was the knowledge that telephone records had been leaked to the security services without a warrant. Bear in mind that such a thing doesn't require a warrant in the USA and you can already see a difference between US and EU culture on data protection. On the other hand, legislation was proposed which would eliminate the warrant requirements... sadly I'm not sure what became of it.
The next big things that happened were extreme popularization of facebook, google creating search bubbles and android and iphone launching. People started to realize that these companies knew a lot of information about them. A sort of right was created in Europe (ostensibly it already existed via the 1995 directive?) to be able to access one's data. A large fight against Facebook was started to gain access to one's data.
That triggered two things. People were astounded at the extent of the information that they had willingly submitted, and people noticed that they were not given access to the information that they had not willingly submitted. As in, Facebook showed you the posts you made, but didn't show you the log of websites you had visited while logged into facebook and a like button was shown. This brought a lot of focus onto tracking cookies.
Enter the tracking cookie law. Most people just refer to it as the "cookie law", but what the law actually does is distinguish between necessary cookies like session cookies and long lived, permanent cookies or short lived cookies for tracking purposes. The intention behind this law was, drive companies towards the use of short lived session cookies and away from tracking cookies. It was light touch in that there were no real fines. It failed miserably; you can blame the legislators, but companies showed no willingness to abide by the spirit of the law and just put blanket consent banners in front of users with only a Hobson's choice.
The GDPR added teeth. With fines proportional to revenue. With definitions about what consent needs to look like to avoid the cookie loopholes. Moreover, the right to delete your data.
TL,DR: privacy concerns eroded in the USA in the telephone era while Europe was at that time keenly aware of the dangers of spy organizations and friends and family spying on you. As technology evolved, Europe has tried to keep pace and define what the right to privacy means in regards to the newer technology.
These are my opinions as a tech savvy, privacy aware, resident of the union.
It's in effect since 2016. I wish there was better research in these articles...
Google stores your personal data in order to serve it back to you in one form or another. If you no longer want Google to serve that data back to you, if you're no longer happy with Google having a copy of that data, then it immediately becomes a liability rather than an asset. It's like poison in the sugar bowl, nothing good comes from it. Google does not want that kind of data, and there are lots of people whose job is to ensure that no data of that category is ever collected or retained.
You probably want to tell me that advertising targeting is just as effective if data is unwanted, or something similar about hypothetical incentives. But no, the costs outweigh the returns in the long game. This is a dead end.
In this particular case, there is a feature called Location History. It collects and allows you to query you location history. You can turn the feature on or off. But because of its clever name, some privacy wathdog organizations felt like turning this feature off should be expected cause all information relating to locations to be scrubbed from all the history from all the other products and features. That sounds absurd when you say it like that. But when you're dying for a reason to sue Google, you take what you can get.
The irony is that this level of scrutiny is only possible because Google is exceptionally careful about making available to users all the information that they have relating to those users, and allowing users to delete or edit it. They've been doing it long before the GDPR was even a concept, in fact for the most part the GDPR was just a codification of Google's existing (and often unique) practices as law.
I mostly have Dating Adds now.but a few month ago, I use to have a lot of wedding related stuff.
Assuming that they properly stop personalizing ads, there should be little reason for them to continue collecting as much data.
It would especially also be a very clear violation of the law in many countries, if they did.
And since it's opt-out without a direct path to opting out, the number of users that will opt out is probably below 0.1%. So, it would likely be more damaging reputation-wise and in legal fees for them to not stop collecting this data, than to just let those <0.1% get away.
That's what I consider logical and is giving Google the benefit of the doubt. But it's your privacy. You don't need to give anyone any benefit. If you prefer, you absolutely should choose a doubt-free solution instead.
Looks like EU might put the brakes on a lot of this creepy crap. As much 4% of revenue or close to $5 billion fine....$5 billion for this, $4b for another...and all of the sudden we're talking real money.
Google, FB, LinkedIn etc engage in super creepy procedures and suck as much data as they can. Some to be used today and directly, other data to be used indirectly...or just to be there just in case. Plus, if you read it again, it's clear I was saying what I believe it to be likely.
>>By law, If they say they do not, they do not.
Ummm, no. Justice system isn't based on what the accused says. That's only part of it, called (more or less) the defense. Others chime in too
They could fine Google $1 trillion, wouldn't make a difference.
It's a bit of a hypothetical since that won't be the only other option, but that was the thought experiment.