CNIL makes Google Analytics almost illegal in France
cnil.fr
cnil.fr
"No."
So right now it is practically impossible to use Google Analytics in a legal way in France.
What matters is that the data is stored by - and accessible to - a company which submits to the US laws.
Ed. cleared up phrasing around new use, replaced meaning with use for .. meaning.
Which founding principles, exactly? Your comment seems to imply you think we should live in a world where we are only allowed to pick our actions from an enumerated list of approved actions. That world is extremely contrary to the kind of world I would like to live in, but also seems to contradict most of what I know about the history of the western world. Is that really what you mean?
I'm fairly certain that's not what OP meant, no.
What OP is getting at is that the common law tradition isn't to explicitly spell out all the nuances of when that action is actually disallowed, but rather to set out the general principles, and let case law define the precise limits of that boundary. In contrast, the civil law tradition is very much based on statutory law explicitly setting the boundaries, and case law serving only to disambiguate.
The "aggressive and putative new use" they're referring to is basically taking common law's fuzzy boundaries and pushing a civil law interpretation on top where all the grey areas are assumed to be allowed.
That is exactly how things work. Unless the government goes through the effort of passing a law to prohibit something (and getting approval of the people's elected representatives, and the courts), then the thing is legal. How else do you propose things should work?
Then there's the issue of marketing/propaganda (which the parent mentions as "hammered") whose sole purpose it's to change people's minds in an emotional way. I wish people would learn about Edward Bernays, nephew of Freud, who instituted this. In and of itself, propaganda has never been illegal, but no one likes to admit to being emotionally manipulated. (But when you begin to pay attention to your emotions, you can spot this stuff from a mile away).
Also, it's important to note that humans are actually quite bad at this sort of judgement. I'm sure if you showed everyone in Germany in 1980 a computer, and how it can instantly store and retrieve files and documents, and asked them 'is this moral?' they would be against it on the grounds that it would put hundreds of office workers out of a job.
It's the job of the judiciary to interpret the laws in these situations, and part of that is looking at the spirit of the law and create case law which may alter the powers of government.
This is very much part of the Western tradition of common law, as is a vigorous discussion over how far the judiciary should be able to go. It's fair to say popular sentiment has drifted in a libertine direction over the last 50 years, but the debate is far from settled.
(In fact we can speculate with some reliability about what the future may hold: via one mechanism or another, including the judiciary, governments usually trend more libertine in times of peace and more authoritarian in times of crisis.)
Computer programs suffer all of this as well :)
If you encrypt the data with your own key, they should not be able to access it.
This problem has to be solved on a political level. There is no technical fix and the legal workarounds appear to be exhausted.
[1] https://aws.amazon.com/blogs/database/securing-data-in-amazo...
It comes down to the details of the legal obligation they have under U.S law. Are there limits to what they have to do to help U.S law enforcement, and what exactly are those limits?
If GDPR makes all the cloud services provided by American companies illegal, what alternatives European companies have? Services like OVH and Hetzner are great as a low cost but they don't provide the same services at all.
How about Netsuite (Oracle), Netsuite, etc.?
My guess is that ~100% of European companies use some kind of US service and there are no realistic alternatives, are they going to rule all companies are doing something illegal?
I don't think it's a good idea to let the world (and the internet) fragment into ever smaller jurisdictions that can no longer find a way to trade with each other.
We need a legal agreement to sort this out or everyone will be worse off.
* They wouldn't actually have to compete at all if U.S services were banned.
You can process IP addresses without consent only if it is technically necessary: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph b)
But you always (!) need consent to transfer personal data to a non GDPR compliant entity: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph f)
"(1) Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)."
See also Schrems II: https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II
But from a legal point of view we, as a European company, are forbidden to use any US infrastructure provider. We can't ask for consent to transfer data to an US based entity if our consent form itself is already hosted by an US based entity. And even if we did find a solution, like hosting the main infrastructure with a European company and asking for consent for some later data transfer, we are most likely forbidden to transfer data to US based entities at all.
From what my lawyer told me the ruling from https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... applies to all services from AWS, Google Cloud, ...
There will be many rulings that follow. Everybody is just waiting for the Irish Data Protection Commission to actually do its work, but the Irish DPC does not seem to be much in favor of data protection: https://noyb.eu/en/irish-dpc-handles-9993-gdpr-complaints-wi... & https://bigbrotherawards.de/en/2022/lifetime-achievement-iri...
This will change soon. From what I heard work is underway to let national data protection offices handle cases without the Irish DPC or force the Irish CPC to work.
The idea with the SCC is that instead of all data transfers being covered by a single adequacy decision, each company adds SCCs to it's contracts with customers promising that data of EU citizens will be handled in a way that's compliant with GDPR.
Reading this piece from CNIL, I can't see how a US company is going to be able to use SCCs to protect EU citizens from data access by the US government. Non US citizens typically don't have a lot of rights in the eyes of the US gov and they've traditionally been pretty happy to rifle through the data of those people at will.
ed: the point by another commenter about using your own encryption key is a good one. However, the view of CNIL essentially seems to be that transferring any data to the US is risky so to me it feels like you'd be swimming against the tide.
Corporations such as google have legal and financial centers all over the world and these will be structured towards providing the best circumstances for the corporation (tax, legal).
On the other hand, don't all these corporations have data centers all over, that replicate data to provide a better service? Which is to say that pretty much most data is available to all legal jurisdictions. At least as I understand it..
And that’s exactly what it would be like, though the house in Paris would be owned by a company that has a legal entity in the United States.
https://en.wikipedia.org/wiki/CLOUD_Act
No problem at all with GDPR and third countries. They simply need to have a regulatory framework making compliance possible.
https://www.imy.se/en/organisations/data-protection/this-app...
Is there an issue with this technique? I've not managed to poke holes in it yet but have at it.
Keep in mind that the mere transfer of the IP address (which is inherent in a TCP connection and cannot be avoided in the default setup without proxying it yourself) is enough, regardless of whether Google will actually store said IP or anonymize it (not that you should trust them in any case).
My IP address hasn't changed in some time, so if someone was to connect various sources of information, he would be able to identify me personally
That something could potentially be correlated across time and space to link different facts about you, does not or should not make those things personally identifying. Otherwise there's a lot of obvious problems e.g. if you were in the habit of wearing unusually distinctive clothing, or had an interesting bumper sticker on your car, etc, then all those things would become "personally identifying" even if nobody who saw them had any idea who you are. There are also deep moral limits to how blind you can insist other people become.
I think the rules are usually though, that when those correlating things are put together, into one system, then the combination of those things are in sum personally identifying. That can actually happen very quickly and in non-obvious ways. You might add something inconspicuous and suddenly that makes users unique and allows to map in any theoretical way to real identities.
I think one also has to consider publicly available information sources. Just to make a silly example:
If there was some public register of favorite foods of people, and you asked your users about favorite foods, which you store in your database. Ooops, it is personally identifying, because anyone with that data in hand could map it to identities using publicly available data.
However, I am not so sure, that the publicly available data is considered for judging whether something is personally identifying information.
An IP address limits the location of a person significantly, unless they use VPN or so, which most people do not, so it cannot be assumed, but rather one must assume, that they do not use VPN.
Add one more attribute and through correlation you might already be able to map to an actual identity. It can happen very easily and you don't want to be an organization, which suddenly realizes, that some of their data has accidentally become personally identifying, when the next data protection audit happens.
Data also does not stay in one place only. It travels from department to department, often from organization to organization even. It has these tendencies, unfortunately. Each actor might have some data as non personally identifying, but when they sell and combine, suddenly it becomes personally identifying data.
An IP address is a very critical part in the data about users and ISPs are not to be trusted to never give their data to another actor. Many ISPs are shady businesses.
> Connect my login into my personal Google account with the same IP address over and over to all the script calls on other Google services.
That's it. That IP address is _pretty sure_ me and not somebody else and therefore a personal information.
lol
Connect my login into my personal Google account with the same IP address over and over to all the script calls on other Google services.
It's pretty easy to connect the dots once you have a far enough reach.
But the question is if the law says that any car that can go that speed is no longer street legal, then it is a problem because it is probably difficult to modify the car. Just as there are structural issues about Google Analytics where GDPR is concerned that makes altering it really difficult if not impossible, and if you can't fix GA to make it legal it is de facto illegal.
"Banning Google Analytics" actually downplays it. Even Google Fonts is actually illegal now; and it will continue to be illegal until the US does the smart thing and copypastes GDPR into local law.
1. I don't think ip address alone constitutes PII but needs to be combined with other data to be applicable
2. Even if it were, I would imagine it falls under article 6 provisions where ip is required information to fulfill a contract which in case of HN as an example means delivering the web page to the browser
According to courts just the IP is considered enough:
The decision says IP addresses represent personal data because it's theoretically possible to identify the person associated with an IP address, and that it's irrelevant whether the website or Google has actually done so.[1]
[1]https://www.theregister.com/2022/01/31/website_fine_google_f...
Of course this was a case where sending the IP to Google was not necessary to operate the site, as self hosting the fonts was an option.
Nope. Having the IP for making a TCP/IP connection is a technical requirement, one of the exceptions of GDPR (this also applies for logging, etc as long as you don't keep it forever, etc)
Let's not make up requirements where they don't exist
You are not allowed to send IP addresses (even if they are a technical requirement for connection set up) to companies under US government control before you get full consent from the EU user.
The "technical requirement" exception (to process data without consent) only applies to GDPR complaint data processors which US companies can't be because of the Cloud Act.
https://ec.europa.eu/info/law/law-topic/data-protection/refo...
"(1) Processing shall be lawful only if and to the extent that at least one of the following applies: (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;"
This is ok for GDPR complaint data processors. The reason why US companies can't be GDPR complaint is because of Article 5 and the conflict with the Cloud Act: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph f)
"(1) Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)."
See also Schrems II: https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II
It doesn't even matter if you asked for consent or have other reasons to process the data (Article 6) if you are not complying with Article 5.
Edit: you don't have to register with email, so I was wrong. My bad.
This details the changes Google Analytics users must make to be complient. After making all these changes is there any value left in using Google Analytics. Why bother. Honest questions.
> All data controllers using Google Analytics in a similar way to these organisations should now consider this use as unlawful under the GDPR.
If you use axe in a similar way to an axe murderer then that would make your use illegal. It wouldn't make axes "almost illegal".
I think that’s where that allegory is going.
[1] If you are governed by this ruling etc
Yep. Also, from the HN guidelines:
Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.
The fact that the title hasn't been edited even though the post is over 16 hours old seem to support the above hypothesis.
Drug smuggling isn't illegal, those smuggling drugs could all become legitimate export companies!
Yet everyone (including government entities) have been dragging their feet on and on hoping for some divine intervention to help them continue using Google, Amazon and Microsoft. And those companies have kept the hopes high by incorrectly claiming to be GDPR compliant.
It's been embarrassing to witnes how little willingness there's been shown towards protecting user data. Especially compared to the amount of whining over how difficult it is to comply.
Hopefully these - very predictable - rulings will finally start to get the ball rolling.
[1]: https://ec.europa.eu/eurostat/statistics-explained/index.php...
[2]: https://www.fiercetelecom.com/platforms/european-cloud-provi...
Now is the time to start enforcing the law enough to make them actually care.
Why would those cloud services be required to run a business?
We're doing just fine without them, hosting fonts locally, using Matomo, saving data on servers from EU companies.
Its's possible, although Google etc. will of course tell you otherwise.
Do they have S3-style or Pub/Sub-style features or do you have to build those in-house or maintain something off-the-shelf?
If you're a small website maybe you can get by but if you get large you'll probably find you don't have many other options.
- https://www.ovhcloud.com/en/datacenters-ovhcloud/
and others. The european cloud providers clearly don’t have as many features or market share as the GAFAM (they also tend to be more specialized), but contrary to what a lot of people here seem to believe, they have enough for most uses
With Cloudflare R2, this will cost roughly $16. With upcloud, this will cost roughly $10,000.
You see how this can easily be the difference between a business being viable and... not?
Though I agree that neither ovh nor upcloud have an offer tailored to that use (I think in that case using a CDN instead may be the more adapted). That offer may or may not exist on the EU market but I'm too lazy to search for it
On a sidenote, I didn't know about r2, thanks for the tip
The closest you can get is renting servers with unmetered 1-10gbit connections and serving it yourself, but because you don't have the economy of scale that Cloudflare does, it will still be much more expensive than R2. You can't balance out your costs against those of hundreds of other customers that don't serve as much data, or against customers serving data at different times where your unmetered bandwidth would be wasted.
Starting up a service with pricing like R2 is only really possible at Cloudflare scale too, so it's not like it's possible for someone like us to see this gap in the market and... fix it?
1. Everyone is using US based web browsers and operating systems.
2. Those systems do a variety of "phone home" tasks like phishing checks, OCSP checks, translations, search auto predictions etc.
What happens when CNIL follows its own logic further and bans Chrome, Android, iOS, Windows and macOS?
Regarding browsers and operating systems, the companies selling them will be fined until they either comply with the law (ie. either by removing any "phone american home" task, or by using any of the alternatives provided by article 6 paragraph 1) or stop doing business in the EU.
it's far from 'required for the operation' it's just convenient.
i.e. dumping waste enywhere is convenient and cheap, but if your business cannot survive otherwise, it's hard to argue for it's right to exist.
So while you could theoretically migrate from US cloud services (although where to is the question. Hertzner for cloud compute? Open Office for Office 365?), there’s no search engine or social network controlled in a country with a data adequacy decision.
That means effectively no online advertising. If a company followed that route while all their competitors did not, their demand generation would have plummeted and they'd be out-of-business.
Wat.
You can't sell out your users to google ads, that doesn't mean you can't advertise on google.
Edit: To be clear, most European enterprise companies would happily dump Google Analytics if not for Google Ads and the Search Console integration. Almost all will be already be using another tool for user analytics, but most online B2C companies are reliant on Google for demand generation, and Google Ads is only effective with conversion tracking.
And even then, advertising without tracking worked just fine without internet.
If you get consent, you can also set a longer-lived cookie to determine if a user converts in a future visit.
> And even then, advertising without tracking worked just fine without internet.
There is even now a form of online advertising without any tracking (except in the most opt-in form of a discount code) which is sponsorships of videos, podcasts, articles, etc.
However, for search and display ads, which drives a huge amount of traffic to EU businesses, there's no effective way to run ads without conversion tracking. Obviously you can just throw money at Google/Facebook, but without conversion tracking, the average return on advertising spend will be 1-10% of what it would be otherwise and you will pay for a lot of junk traffic.
It's not unusual for B2C companies in the EU to make 80%+ of their online revenue from forms of ads that require conversion tracking, so it's impossible to expect businesses to refrain from online advertising unless all their competitors are required to also.
This all relies on getting consent as a lawful basis for processing, and is currently acceptable under the GDPR except that the major networks are all US companies who could be compelled to transfer the data to US authorities.
Even now, it is much more likely that a US CLOUD carve-out or other work-around for an adequacy decision with the US will be made than the CNIL interpretation will be followed to its logical conclusion, which is that EU businesses process personal data with any US-controlled vendor, even if it occurs in the EU.
> However, for search and display ads, which drives a huge amount of traffic to EU businesses, there's no effective way to run ads without conversion tracking. Obviously you can just throw money at Google/Facebook, but without conversion tracking, the average return on advertising spend will be 1-10% of what it would be otherwise and you will pay for a lot of junk traffic.
1. Can you not track conversion in aggregate by running X number of ads and checking how much extra traffic you got? It's obviously noisy and you can't run multiple campaigns at the same time, but conceptually I don't see why it wouldn't work?
2. I'm assuming you put links in your ads, so if you run ads for lander.example.com, can you not put the URL in google/facebook as lander.example.com?src=g and src=fb? Or, if you can't use query params, g.lander.example.com and fb.lander.example.com? Tracking stats for those and seeing how much ads you ran should give you conversion, similar to 1. but better?
> 1. Can you not track conversion in aggregate by running X number of ads and checking how much extra traffic you got? It's obviously noisy and you can't run multiple campaigns at the same time, but conceptually I don't see why it wouldn't work?
You can and many companies will have a first-party (or partly first-party, feeding into PowerBI or Tableau or something) system for this kind of reporting completely independent of the ad networks (to independently verify the numbers the ad networks claim, to include other data that a company would never share with Google, and for fraud detection).
However, without conversion tracking, Google Ads' "Smart Bidding" and "Remarketing" targeting features don't work. For a lot of businesses, being unable to, for example, stop advertising to existing customers or to use a certain bidding strategy means that the Return On Advertising Spend (ROAS - the big metric for enterprise marketing departments) goes below 1.
> 2. I'm assuming you put links in your ads, so if you run ads for lander.example.com, can you not put the URL in google/facebook as lander.example.com?src=g and src=fb? Or, if you can't use query params, g.lander.example.com and fb.lander.example.com? Tracking stats for those and seeing how much ads you ran should give you conversion, similar to 1. but better?
Companies often do this, with Google Analytics-compatible UTM parameters, custom source IDs, and very often unique marketing landing pages for each ad campaign.
As above, though, reliable reporting of conversions/revenue isn't the difficult part. It's being able to reliably target the ads/campaigns without conversion tracking.
Right now, targeted search and display advertising can be 10-100x more effective (in terms of Return On Advertising Spend) than keyword- or context-only targeting. That's not an advantage a company can forgo unless the entire market is forced to simultaneously.
What does it say about the credibility of the EU that it passes laws it doesn’t even enforce?
Almost exactly 2. The last agreement between the US and EU was nuked by Schrems II mid 2020.
> What does it say about the credibility of the EU that it passes laws it doesn’t even enforce?
Companies have already been successfully sued over it.
And refused to engage on why that might be a bad idea, because hey, we find it useful, and Google pinky-swear they anonymise everything.
Your own IP address?
What's the point of having personal data if you aren't allowed to make decisions about it
Your body for instance is probably better protected in terms of chemical additives, healthcare and now pregnancy choices, but you can't easily sell body parts or be a surrogate.
If a service operator decides they don't want you using their service, they don't have to let you use it. That only gets murky around protected characteristics (race, sex, gender, orientation, etc) which "privacy" is not.
They could make access contingent on being allowed to process your data.
Besides, the CNIL ruling already applies to server-side GTM implementations.
Might be better to shame any website caught using it with some crowd-sourced list of some kind - then at least we'd know who the bad actors are and force their content through an isolated container / proxy / VPN, or simply stop using them altogether.
But happily, in the EU - the market I operate in - server-side analytics is seen as an avenue towards compliance.
Obviously server-side GTM will be abused in the absence of regulation, but that was also true of the existing technologies. Strong and consistent enforcement can and is bringing companies into compliance.
However, if you just want to avoid tracking, uBlock Origin will do the job or simply reject the tracking on the cookie pop-up. Reputable companies in the EU almost always respect those choices because no-one wants to face the wrath of a DPA (at least not without plausible deniability - hence all the dark patterns).
uBlock can only defeat client-side tracking - which has so far been _the_ tracking, sure, but I believe it is in the process of being replaced by server-side, which can't be defeated this way.
Do you mean by replaying the HTTP requests of other humans? You can only do this against the most naive analytics tools. Most modern analytics will use nonces and unique event IDs to deduplicate/trash any junk. Already in competitive markets/industries (looking at you, travel) it's common for 95%+ of analytics data to be junk/fraud/poison.
I can assure you that, except in the very rare cases of people stupid enough to launch poisoning attacks from Western countries, the law has not stopped or slowed junk analytics data. It is purely a technical defence, and it works very well.
> uBlock can only defeat client-side tracking - which has so far been _the_ tracking, sure, but I believe it is in the process of being replaced by server-side, which can't be defeated this way.
For the most part, the current form of server-side analytics just means relaying data through a proxy you control so that you can control exactly what the downstream services get and they never see the user's IP address, user-agent, etc. The most popular service by far, Google Tag Manager, still uses a very obvious and blockable client-side Google Analytics tag (that you serve via the same proxy) to actually collect the data in the browser.
No, that would be too obvious. I’m thinking more of replaying human interactions with a browser within a VM, or perhaps replaying them using some sort of hidden tabs, so the user session cookies stay as they were, but the behavior that can be associated with them would be jammed.
As for server analytics - it’s not very relevant now, because there’s no need, but once google is prevented from exploiting it they will inevitably switch to tracking all the client details on the (google’s) server side.
How do you know for sure that the requests are "not obfuscated in any way"?
There are instructions out there to also modify the path of the requests[1]. Consider this paragraph in the Summary section:
> Cynics could say that this is an improved way to circumvent ad blockers. And they’d be right! This does make it easier to circumvent ad blockers, as their heuristics target not just the googletagmanager.com domain but also the gtm.js file and the GTM-... container ID.
* * *
[1] https://www.simoahava.com/analytics/custom-gtm-loader-server...
In practice - in the EU, at least - I haven't seen any examples of this, and it would be unlawful without consent anyway, thanks to the GDPR.
It's also still fairly easy to classify requests (if you have access to the unencrypted request in the browser) based on heuristics. That's partly what the company I work for does.
Separately, thank you for your contribution to the Internet - it's as big and important as all the behemoths, but unfortunately will never be rewarded in the same way.
This editorializing by the OP is a bit too far.
... We need stronger privacy protection;
... be it corporations, governments, or individuals.
The emphasis on only one/some of these is a matter of country culture. Some countries have more reasons to distrust corporations far more than the government, some distrust the government and idolize corporations and individuals, and others have had bad experiences with all three.
I don't understand the "almost." The title is editorialized -- as commented elsewhere. There is no almost. It is illegal the way they act and store data. That nobody is going to come and place you on handcuffs doesn't make something legal...
Mainly though this is old news -- https://iapp.org/news/a/cnil-is-latest-authority-to-rule-goo... -- CNIL and the Austrian one did so in the beginning of the year.
I would add a February 2022 tag on the post.
I hope the whole EU agency pool does the same and start applying fines and every tooth they can.
Let’s look at a similar situation by changing the country names. Right now, most advanced microchips used in the US are made in Taiwan.
Imagine for two seconds what would happen if Taiwan passed a bill that all produced microchip must contain a non-removable tracker that sends all data processed by that chip to the Taiwanese intelligence agency (pretend it’s technically possible)
Do you think the US would continue importing chips from Taiwan? Sure banning them might hurt the tech industry and all, but if they don’t, in a strategic standpoint, it’s hybris at best, stupidity at worst.
Well that’s pretty much what the US is doing with cloud act. Of course their products are going to get forbidden. You just don’t engage in overt mass spying on your allies, that’s in bad taste.
I don't know why anyone besides company owners would disagree with data practices laws.
But the thing is these laws keep escalating. Now it's apparently illegal for EU companies to use any American services _at all_ because your IP must be protected? Even though that's required for basic operation of any web based service? Even though there is little to nothing dangerous the other side can actually do with this information?
For example, Cloudflare services are absolutely essential for cost-effective delivery of content. As far as I'm aware, there are no EU based competitors with pricing in the same order of magnitude. It'd make my company non-viable if I couldn't use it.
> processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
So you can use the IP address to serve a webpage, operate a proxy, etc. You just can't use the IP address for any other purpose unless there's a lawful basis for it (ie, you can't send it to Google Analytics without first getting user consent).
It does force a change in mindset, but it's not the burden you might think.
Ironically, the legislative problem we're facing now is not the GDPR, it's the US CLOUD Act, which allows the US Government to be able to force US-controlled companies to transfer data from anywhere in the world.
The "trans-atlantic data privacy framework" can't come soon enough to finally end this farce. In the mean time, it seems like the most useful thing to do is just ignore all this.
Ain't nobody got time for all this uncertainty. And chance of any of these regulators suddenly caring about your particular company before it's solved for good is quite low.
At worst unlawful, not illegal, but even then, there's subtlety. Most transfers to the US rely on Standard Contractual Clauses, which are being invalidated, but on a case-by-case basis.
I quite like the spirit of the original GDPR, but some of the more recent execution is just bad.
If they store and process PII, then this has been the case since the CLOUD Act.
They can be compliant by not dealing with PII.
> I quite like the spirit of the original GDPR, but some of the more recent execution is just bad.
This particular bit of it is fantastic IMO. I'm still waiting for big fines or other punishments to happen though. Hopefully soon but I'm not holding my breath.
> even though there are no EU based competitors that are viable to use
Hopefully this will open up the market for companies based everywhere to compete against the US giants. Not just in the EU -- like I said, this is not about where the company is based, except in the case of the US where the CLOUD Act exists. That would be very healthy for the Internet.
Sure, if your company provides no web services, and doesn't actually have any customers, this is possible. For everyone else however, that is a ridiculous suggestion.
In this case, 3 things can happen:
- Company goes bust due to lack of customers; - Company moves out of the USA; - Government changes the law.
This is just speculation though. Right now the situation is as it is.
And for European economy, let’s be honest
As a technology user, I'm happy to have those protections. I wish that GDPR had stronger enforcement.
Every single country engages in some sort of protectionism, including USA the mecca of "free market", it's called corporate subsidies.
We know that we will never be as strong as US majors in cinema, music, arts, … so what this exception is trying to achieve is to preserve the French culture and values (including moral values) through arts. While implementation is falling apart those days and the rules are clearly abused by a lot of companies, I truly think it was a great idea when it was imagined.
For instance, Hollywoodian cinema (and don’t get me wrong, we love most of it as an art) naturally promotes US values such as paid education, paid healthcare, free carrying of weapons, strong Christian values, neoliberalism, the idea that US is the center of the civilized world … (I randomly chose those ideas with no judgment whatsoever, just because we have different visions on those topics, so don’t blame me). Those ideas are clearly infusing into young generation as the normality so I do think the idea of this exception was genius. The idea was not to ban anything US (we love US arts) but to keep it in the context of « this is US art, so that’s why [insert_something_different] » instead of « this is mainstream art depicting the world as is should be ».
Maybe it’s hard to see it from the US side because you are in the powerful side but imagine if China invested billions in (good) arts and surpassed Hollywood with (really good) movies promoting the Chinese system moral values. I’m pretty sure the US would react immediately and I think it would be normal.
But this is just … an exception. And don’t be afraid, our current government is really happy to play the free markets game, including in healthcare.
HEY! Why is everything being centralized to just a few services? Why is the web dying?!
Assume the user is well informed and agreed to it and everyone is acting in good faith - I don’t see where any government has the legit power to contravene a private contract
Maybe I’m looking at it weirdly
The scenario that you posit, the most troublesome part is AWS because Amazon is also subject to US law enforcement. It depends on a few specifics, most significantly 1) does the user connect directly to an AWS service, exposing their IP address? 2) does AWS manage the keys to your database?
If you were to instead self-host your DB or use an EU-located hosting provider, then the problems would not apply. You still have some homework to achieve GDPR compliance, but the tools don't require obtuse work-arounds.
Or lobby to rescind the CLOUD act.
There is essentially a level of control over its citizens that the US government would need to cede to ever become compliant, but that it certainly never would.
This is similar to the FATCA situation, where it’s extremely difficult for US citizens to get bank accounts in Europe.
(Edit: if you’re not aware: FATCA is a US law that forces non-US banks to provide info about US citizens banking with them on request to US authorities. The threat is the removal of US banking licenses for any subsidiaries of the bank’s owners. Rather than providing info to the US, most banks are taking the safer route of asking if a person is a US citizen up front, and refusing to open an account if they say yes.)
...
Pathetic.
> the data of European Internet users is therefore illegally transferred through this tool.
This isn't a devilish situation to me. We're talking about a tracking pixel, not healthcare records or trade secrets.
All that is because we aren't capable of fighting US big tech with innovation. Only with regulation. Appalling. Hopefully, Google finds a legal way around it.
You know where these tracking pixels are? Everywhere, doctors websites, ecommerce checkout pages,... - you can get a lot of very private information about someone by correlating these data points.