6 ms·

I'm not surprised by this. It's pretty clear that having a pre-ticked checkbox is not allowed under GDPR. It's also against the intent of the law to require 6 c

by MarkMc 8y ago

I'm not surprised by this. It's pretty clear that having a pre-ticked checkbox is not allowed under GDPR. It's also against the intent of the law to require 6 clicks to deny consent but only 1 click to grant it.

CorvusCrypto 8y ago
What's not allowed is pre-checked opt-in. As France mentioned that's not the case for google. Only a default configuration is pre-checked. The opt-in is a separate immediately seen checkbox saying you agree to data usage for personalization etc. Along with a link explaining how to adjust. Edit: I should say that this approach was deemed acceptable by Swedens dataskyddsmyndighet which is the government regulatory agency and is a common approach in many sites.
- MarkMc 8y ago
  Perhaps I misunderstood and was relying too much on my memory of the Google UI when I was in the UK. Is there a youtube video or series of screenshots showing exactly how to grant or deny consent with Google?
- gamma-male 8y ago
  Bless you
ahje 8y ago
This is going to be one helluva ride; there's thousands of web site using the same kind of implementation, and a 50M fine does send quite a message.
- easytiger 8y ago
  > and a 50M fine does send quite a message. Yes it sends the message that France is going to keep trying to attack google & facebook until they relent and exit Ireland
  - simias 8y ago
    The CNIL is independent regulatory body, I'm doubt Google's tax situation was a big factor in the decision. Or are you arguing that they were unjustly fined for purely political reasons?
    - easytiger 8y ago
      Yes I'm sure they are very independent and certainly aren't informed by the culture of political hatred for these companies. Even their personnel belay that thought. They state the first tests of this complaint were performed in Sept 2018. There is no evidence that they worked constructively with google to resolve the technical and nuanced issue (a breach of predictably vague and complex laws). This seems to specifically relate to "create account" on a reset android device when it gets to the google services section. That's a long walk for a short drink of water. Which version of android is not compliant? Is it universal? In enforcing regulations changed just months before there has to be reasonableness. Issuing a EUR50m fine 2 months after discovering an edge case like this is not reasonable. Helping the company comply is the right behaviour. Then seek punitive measures if they fail to. It states 10k people made a complaint about this. No they didn't. They even take a swipe at the Irish government in their release. I'm all for bashing google and have numerous issues with them, but this is nonsense. If you run a business and are not remotely concerned about the abuse of this legislation you have lost your mind
      - puzzle 8y ago
        I have no idea if the CNIL acted also out of tax reasons, something which is hard to prove, but they haven't been exactly friendly to Google for the past decade. Among other actions, they're the ones that have been taking Google all the way up to the EU Court of Justice to enforce worldwide the right to be forgotten. The advocate general just sided with Google less than two weeks ago, which makes for an interesting coincidence. They, and IFP in particular, have been itching in public interviews for the power to levy higher fines. Now they are simply following up on past statements.
paulddraper 8y ago
CNIL itself has "pre-ticked" consent.
- natch 8y ago
  Cute observation, but the difference is Google gets consent for many different personal-data-collecting services without sufficient granularity in how it asks for the consent. And a myriad of other intertwined problems described at length in the fine article. The difference in nature was fundamental to their determination, as is well explained.
  - paulddraper 8y ago
    > a myriad of other intertwined problems described at length in the fine article Then let's not make blanket statements about whether "pre-checked consent" is permissible or not.
  - sdenton4 8y ago
    I dunno, man. I read this stuff as France collecting taxes vindictively, while not really caring how the regulations play out in the larger ecosystem. At some point French regulators we pushing for a rule that any processing of French citizens had to be done in France... Which is a great combination of untenable and an obvious jobs program. Likewise, this comes across as incredibly arbitrary, with enforcement driven by fines rather than actual clear regulations. Non compliance on their own website just hammers it home.
    - heavenlyblue 8y ago
      >> At some point French regulators we pushing for a rule that any processing of French citizens had to be done in France... Which is a great combination of untenable and an obvious jobs program. Why not, though? If Trump is promising the leave NATO without the military support from the US, then EU has every reason to create the laws that enforce that commitment. The fact is that as of now, the larger ecosystem is not in a balanced state at all.
  - 8y ago

by MarkMc 8y ago

CorvusCrypto 8y ago

What's not allowed is pre-checked opt-in. As France mentioned that's not the case for google. Only a default configuration is pre-checked. The opt-in is a separate immediately seen checkbox saying you agree to data usage for personalization etc. Along with a link explaining how to adjust. Edit: I should say that this approach was deemed acceptable by Swedens dataskyddsmyndighet which is the government regulatory agency and is a common approach in many sites.

MarkMc 8y ago
Perhaps I misunderstood and was relying too much on my memory of the Google UI when I was in the UK. Is there a youtube video or series of screenshots showing exactly how to grant or deny consent with Google?
gamma-male 8y ago
Bless you

ahje 8y ago

This is going to be one helluva ride; there's thousands of web site using the same kind of implementation, and a 50M fine does send quite a message.

easytiger 8y ago
> and a 50M fine does send quite a message. Yes it sends the message that France is going to keep trying to attack google & facebook until they relent and exit Ireland
- simias 8y ago
  The CNIL is independent regulatory body, I'm doubt Google's tax situation was a big factor in the decision. Or are you arguing that they were unjustly fined for purely political reasons?
  - easytiger 8y ago
    Yes I'm sure they are very independent and certainly aren't informed by the culture of political hatred for these companies. Even their personnel belay that thought. They state the first tests of this complaint were performed in Sept 2018. There is no evidence that they worked constructively with google to resolve the technical and nuanced issue (a breach of predictably vague and complex laws). This seems to specifically relate to "create account" on a reset android device when it gets to the google services section. That's a long walk for a short drink of water. Which version of android is not compliant? Is it universal? In enforcing regulations changed just months before there has to be reasonableness. Issuing a EUR50m fine 2 months after discovering an edge case like this is not reasonable. Helping the company comply is the right behaviour. Then seek punitive measures if they fail to. It states 10k people made a complaint about this. No they didn't. They even take a swipe at the Irish government in their release. I'm all for bashing google and have numerous issues with them, but this is nonsense. If you run a business and are not remotely concerned about the abuse of this legislation you have lost your mind
    - puzzle 8y ago
      I have no idea if the CNIL acted also out of tax reasons, something which is hard to prove, but they haven't been exactly friendly to Google for the past decade. Among other actions, they're the ones that have been taking Google all the way up to the EU Court of Justice to enforce worldwide the right to be forgotten. The advocate general just sided with Google less than two weeks ago, which makes for an interesting coincidence. They, and IFP in particular, have been itching in public interviews for the power to levy higher fines. Now they are simply following up on past statements.

paulddraper 8y ago

CNIL itself has "pre-ticked" consent.

natch 8y ago
Cute observation, but the difference is Google gets consent for many different personal-data-collecting services without sufficient granularity in how it asks for the consent. And a myriad of other intertwined problems described at length in the fine article. The difference in nature was fundamental to their determination, as is well explained.
- paulddraper 8y ago
  > a myriad of other intertwined problems described at length in the fine article Then let's not make blanket statements about whether "pre-checked consent" is permissible or not.
- sdenton4 8y ago
  I dunno, man. I read this stuff as France collecting taxes vindictively, while not really caring how the regulations play out in the larger ecosystem. At some point French regulators we pushing for a rule that any processing of French citizens had to be done in France... Which is a great combination of untenable and an obvious jobs program. Likewise, this comes across as incredibly arbitrary, with enforcement driven by fines rather than actual clear regulations. Non compliance on their own website just hammers it home.
  - heavenlyblue 8y ago
    >> At some point French regulators we pushing for a rule that any processing of French citizens had to be done in France... Which is a great combination of untenable and an obvious jobs program. Why not, though? If Trump is promising the leave NATO without the military support from the US, then EU has every reason to create the laws that enforce that commitment. The fact is that as of now, the larger ecosystem is not in a balanced state at all.
- 8y ago