8 ms·

Lessons from Google's Geographical GDPR Goof

143 points by CrankyBear 8y ago

josteink 8y ago
Things like this is why Microsoft is still retaining a lot of business-customers which Google will never touch. They care about addressing the customers need first and foremost, while Google’s #1 priority will always be tracking and ads. When the EU said processing needed to be done in the EU, Microsoft was fine with that, while Google has been playing nice only on paper. With rulings like this, guess which one will seem more reliable and dependable (from a business POV) for the EU market? Not Google. That’s for sure.
- amscanne 8y ago
  The article seems to relate only to data handling for Android, so I'm not sure your comparison and conclusions are relevant.
  - modzu 8y ago
    op only cites it as an example. but there is empirical evidence -- MS holds enterprise market-share even for products google is otherwise competitive in, and privacy impact is absolutely one of the reasons
    - hunta2097 8y ago
      But everything on GCP is encrypted? If you really want, you can use your own keys end-to-end. I'm satisfied that Google treats adwords and advertising areas of the business differently to business services. Apple, Twitter and many large banks use GCP - do you really think they would do that if Google was snooping at the data? Please back up any claims with evidence.
      - modzu 8y ago
        i should clarify: i dont think google is snooping at enterprise data when there are proper agreements in place -- my comment was only that there is a difference in privacy impact between MS and google i cant share the PIA of my own enterprise but specifically we needed certain guarantees about where data would be stored that MS could make and google could not. that's all.
- ipsum2 8y ago
  Pretty odd comment, considering Windows 10 does a lot of tracking and ads. > Windows 10 Collects Activity Data Even When Tracking Is Disabled, But You Can Block It https://lifehacker.com/windows-10-collects-activity-data-even-when-tracking-is-1831054394 https://lifehacker.com/windows-10-collects-activity-data-eve... > We also display advertising in some services, and we’d prefer to show you ads you find interesting. https://privacy.microsoft.com/en-us/windows10privacy https://privacy.microsoft.com/en-us/windows10privacy And the numerous steps you have to take to improve your privacy: https://github.com/adolfintel/Windows10-Privacy https://github.com/adolfintel/Windows10-Privacy
  - lubujackson 8y ago
    I don't see what's odd about the comment. For core philosophy, Google has always about using an algorithm instead of manual labor whenever possible. The mindset they push to developers is always to "think at Google scale". Customer service has 100% been crappy with Google from day 1, and on purpose. This GDPR situation is political and messy and hits them very much in their weak spot. Microsoft came from (and continued to focus on) the business market, which is all about big deals and playing ball. The entire concept of Windows was meant to bridge the business market with the home market and they've had split business/home pricing for most of their products forever. Yes, Microsoft also sucks at privacy and has been evil forever like all of these amorphous businesses that reach their tendrils as far and wide as profitable. But selling ads (and privacy) is just another revenue stream for Microsoft, not their core product. And don't forget that Hacker News' favorite search engine, DDG, is based on Bing. Microsoft doesn't really care about privacy but also doesn't really care about ads - they just want money.
  - emn13 8y ago
    As it pertains to this complaint though, those are all seem less relevant than the issue of well... plain non-compliance? I mean, if they didn't even have a DPO... Still, let's not overstate this "recordbreaking" fine. It's not large, at all. It's only of a fraction of profits (not revenue) in France alone. Even if google fully expected to take this hit, it might not have bothered to change its behavior. The fine, by itself, has no impact on google's business. The greater risk, really, is that they've got a record now: if they get caught again, they'll be more likely to suffer more punitive measures that really are relevant to its core business. Also, they come across as slightly incompetent, really: I'm kind of surprised such a huge organization didn't bother to prepare very well. I mean, for some the law might have come as a surprise, but it's not been unannounced, and it sure looks like google - amongst others might even count as the law's raison d'etre. How exactly did they miss that?
- VikingCoder 8y ago
  Bing operates in China, doesn't it?
- bad_user 8y ago
  Is this like a cheerleading competition?
- laurentl 8y ago
  Just to highlight that OP was (rightly) talking about business consumers. As a business, under GDPR I am responsible for the compliance of my subcontractors (which includes Google Cloud or Azure for instance). I read about this Google blunder and I think that I have other sh*t to worry about than how Google is screwing around with my data. On the other hand, Microsoft has demonstrated time and again that they care about their customers’ data. 2 examples: the fight with the DoJ over access to emails stored in Ireland and the fact they subcontract Azure’s operations in Germany to a German company (to avoid having to hand over the keys to the data center to a 3-letter agency: they literally don’t have them).
  - tpetry 8y ago
    The german azure location is a joke. Only the most basic services are available, there are so many missing in germany...
    - etaioinshrdlu 8y ago
      Maybe they aren't competing on technical competency but regulatory competency? It's a valid strategy.
Animats 8y ago
"Goof"? "The EU figured out our fraud scheme! Waah!"
twunde 8y ago
I don't think I had understood the why behind Google's GDPR fine prior to this. It's also illustrative of the challenges of running a worldwide business with GDPR. Google knew it had a target on its back, is organized and spent a lot of time becoming GDPR compliant and STILL screwed up in a significant way.
- icebraining 8y ago
  I disagree. It only displays the challenges when you're trying to comply with the letter of the law while doing everything you can to evade its purpose. Stuff like pre-selected consent boxes are not just mistakes or misunderstandings.
  - saulrh 8y ago
    The only guaranteed way to avoid regulatory attention is to shut down everything and stop operations. There is fundamentally no decision you can make other than "comply with the law while continuing to operate as effectively as possible". Even more unfortunately, bureaucracies, including every modern corporation and government, are UnFriendly AIs. You must comply with the letter of the law because not a single agent involved, not the regulators writing the law nor the courts that will interpret the law nor your competitors that will bring complaints against you nor even the users of the products involved, knows or cares what the spirit is. They don't have the correct value systems, experiences, philosophical frameworks, or cognitive architectures to execute the "comprehend human values" step that would be required to interpret the "spirit" of the law. That incapability is why an even minimally functional justice system needs things like checks and balances and case law and jurisprudence and rules of evidence and all of those things. But we do need those things, because history has proven universally that the letter of the law is the only thing that matters. On the one hand, this means we literally can't trust any organization composed of more than approximately two people. You often can't even trust organizations with one person, simply because bureaucracy is a force-multiplier even for single humans; think about things like bug trackers and source-control systems and apply them to other workflows. On the other hand, this means that it's pretty much worthless to try to do anything about any individual corporation. Up to the point where you entirely obliterate their industry you're stuck. Which is, coincidentally, what an antitrust action really is - antitrust actions happen exactly when a single agent has taken over an entire industry, and making sure that that an identical bad actor doesn't reappear requires not just breaking it up but also obliterating its industry and introducing a new one with similar features but substantially different (non-agglutinative) dynamics. Standard disclaimers: Views don't represent employer, etc.
amenod 8y ago
I have a very difficult time understanding any of this. I mean, yes, for most of the SME 50 mio dollars would be some money, but for Google? Peanuts. Who cares if they messed up? If this is the penalty for it, bring it on... It was cheap school for them (not on how to do GDPR properly, but how to get better at avoiding penalties in the future). Seriously, I hope EU can do better than that. We could really use some real privacy protections, especially from the likes of Google, Facebook, Microsoft, Apple, Amazon,...
- jiveturkey 8y ago
  It's not the size of the fine. It's that there's a fine at all. It's a warning shot across the bow. Also, this isn't a fine as "cost of doing business". Google still has to address the issues. If they don't, you can be sure the next fine will be 10x.
- Macha 8y ago
  If you look at some of the GDPR fearmongering (Particularly stuff like "Oh no my designated DPO left and it took us a week to find a replacement." or "Oh no, my 1 person company with no automated process got a GDPR request while I was on holiday in the bahamas and I took too long" leading to 4% of revenue fines, one of the points made is that the EU tends to not apply the maximum penalty immediately based on the severity of the offence and whether it's a repeat offender. So this is (a) Google's first offence and (b) it seems the finding is about a technicality that could be a genuine mistake (1 day after GDPR Google's TOS didn't mention Google Ireland yet), so it's understandable that they didn't pull out the 4% of global revenue fine. Even though ultimately the Google behavior is the target of the legislation, not giving Google the same "first time's a warning" type behavior of local SMEs sounds like a good way to start a trade war. The next GDPR violation Google is accused of, they will now be a repeat offender and more likely to get a higher fine, until they either become compliant or end up at the 4% of revenue fine.
  - laurentl 8y ago
    > it seems the finding is about a technicality that could be a genuine mistake (1 day after GDPR Google's TOS didn't mention Google Ireland yet) To clarify, the fine is due to the consent mechanism in Android. The fact that the action was led by the French regulator rather than the Irish one is due to this technicality and others (no DPO in Google Ireland for instance)
theyinwhy 8y ago
We are currently struggling with firebase cloud messaging as the instance id has been deemed personally identifying by our laywers which google clearly does not think is the case (they don't even offer a data processing contract for firebase). So, if you are currently using Firebase cloud messaging, there is a big chance you are in violation of gdpr.
- dantiberian 8y ago
  Google Cloud has a DPA if I remember correctly, that would cover Firebase usage?
  - theyinwhy 8y ago
    The google cloud DPA unfortunately does not cover Firebase.
- ogeidix 8y ago
  Are you familiar with [1] and [2]? 1. https://firebase.google.com/support/privacy/ https://firebase.google.com/support/privacy/ 2. https://firebase.google.com/support/privacy/manage-iids https://firebase.google.com/support/privacy/manage-iids
  - theyinwhy 8y ago
    I was told the main problem is that google's view on things is not en par with gdpr. Google claims that "Data associated with Instance IDs is generally not personally-identifying" (see 2.) which our lawyers say they clearly are. In that regard, google does not talk about instance ids or, worse, data processing in between APNs and the sending backend (see 1). The current legal situation does not allow us to use firebase cloud messaging.
erickj 8y ago
GDPR enforced this way is a fucking disaster. Good luck being a globally distributed team with VPSs around the globe doing any modicum of data processing.
- badrequest 8y ago
  The mindset that having a globally distributed team with global VPS coverage is more desirable than ensuring people's private data is handled with care is way more of a fucking disaster.
ggm 8y ago
We (staffers) wanted to consider google g suite for integrated mail/calendar. We couldn't because as an Asia-Pacific entity, we felt we wanted a guarantee our data was in Asia-Pacific (preferably Australian) DC and under local law. What we found, is that only the US State and federal governments can demand US located data from Google. All other economies and agencies can ask for local, but cannot have it a checkbox requirement: Google retain the right to host you wherever they decide, subject to laws they decide. Somebody else has noted that Microsoft, for all their faults, actually looked at customers in Europe and said "you know what: we can declare hosting in ireland is subject to EU laws and we will (at the right price) guarantee your data is in the EU, subject to EU law" and for that, I salute them. I think Google got this wrong. I think microsoft got this right. We didn't go with G Suite. We went another direction with mail and calendar.
- eitally 8y ago
  This is not true anymore, at least not the second part. It's not possible to select JAPAC data location (yet). https://support.google.com/a/answer/7630496?hl=en&ref_topic=7631290 https://support.google.com/a/answer/7630496?hl=en&ref_topic=...
  - ggm 8y ago
    You can select US or Europe or no preference. So, you cannot select LatAM or Asia. Google are getting better, sure. EU feels like they did a reaction to GDPR extra-territoriality issues. The thing is there is either zero selectivity, or there is n+ because nobody codes a two value toggle for this: They clearly have intent to add more. How many more?
- dmurray 8y ago
  > as an Asia-Pacific entity, we felt we wanted a guarantee our data was in Asia-Pacific (preferably Australian) DC and under local law. I don't understand why you would want a generic Asia/Pacific location. It makes sense that you might want it to be in a particular jurisdiction for legal purposes, so I understand specifying Australia, in the same way other businesses specify EU or US or China. But why would you ever want to say "put our data somewhere in this hemisphere, Australia or Malaysia or Korea are all OK but don't let it be in Ireland or the USA"?

143 points by CrankyBear 8y ago

Things like this is why Microsoft is still retaining a lot of business-customers which Google will never touch. They care about addressing the customers need first and foremost, while Google’s #1 priority will always be tracking and ads. When the EU said processing needed to be done in the EU, Microsoft was fine with that, while Google has been playing nice only on paper. With rulings like this, guess which one will seem more reliable and dependable (from a business POV) for the EU market? Not Google. That’s for sure.

amscanne 8y ago
The article seems to relate only to data handling for Android, so I'm not sure your comparison and conclusions are relevant.
- modzu 8y ago
  op only cites it as an example. but there is empirical evidence -- MS holds enterprise market-share even for products google is otherwise competitive in, and privacy impact is absolutely one of the reasons
  - hunta2097 8y ago
    But everything on GCP is encrypted? If you really want, you can use your own keys end-to-end. I'm satisfied that Google treats adwords and advertising areas of the business differently to business services. Apple, Twitter and many large banks use GCP - do you really think they would do that if Google was snooping at the data? Please back up any claims with evidence.
    - modzu 8y ago
      i should clarify: i dont think google is snooping at enterprise data when there are proper agreements in place -- my comment was only that there is a difference in privacy impact between MS and google i cant share the PIA of my own enterprise but specifically we needed certain guarantees about where data would be stored that MS could make and google could not. that's all.
ipsum2 8y ago
Pretty odd comment, considering Windows 10 does a lot of tracking and ads. > Windows 10 Collects Activity Data Even When Tracking Is Disabled, But You Can Block It https://lifehacker.com/windows-10-collects-activity-data-even-when-tracking-is-1831054394 https://lifehacker.com/windows-10-collects-activity-data-eve... > We also display advertising in some services, and we’d prefer to show you ads you find interesting. https://privacy.microsoft.com/en-us/windows10privacy https://privacy.microsoft.com/en-us/windows10privacy And the numerous steps you have to take to improve your privacy: https://github.com/adolfintel/Windows10-Privacy https://github.com/adolfintel/Windows10-Privacy
- lubujackson 8y ago
  I don't see what's odd about the comment. For core philosophy, Google has always about using an algorithm instead of manual labor whenever possible. The mindset they push to developers is always to "think at Google scale". Customer service has 100% been crappy with Google from day 1, and on purpose. This GDPR situation is political and messy and hits them very much in their weak spot. Microsoft came from (and continued to focus on) the business market, which is all about big deals and playing ball. The entire concept of Windows was meant to bridge the business market with the home market and they've had split business/home pricing for most of their products forever. Yes, Microsoft also sucks at privacy and has been evil forever like all of these amorphous businesses that reach their tendrils as far and wide as profitable. But selling ads (and privacy) is just another revenue stream for Microsoft, not their core product. And don't forget that Hacker News' favorite search engine, DDG, is based on Bing. Microsoft doesn't really care about privacy but also doesn't really care about ads - they just want money.
- emn13 8y ago
  As it pertains to this complaint though, those are all seem less relevant than the issue of well... plain non-compliance? I mean, if they didn't even have a DPO... Still, let's not overstate this "recordbreaking" fine. It's not large, at all. It's only of a fraction of profits (not revenue) in France alone. Even if google fully expected to take this hit, it might not have bothered to change its behavior. The fine, by itself, has no impact on google's business. The greater risk, really, is that they've got a record now: if they get caught again, they'll be more likely to suffer more punitive measures that really are relevant to its core business. Also, they come across as slightly incompetent, really: I'm kind of surprised such a huge organization didn't bother to prepare very well. I mean, for some the law might have come as a surprise, but it's not been unannounced, and it sure looks like google - amongst others might even count as the law's raison d'etre. How exactly did they miss that?
VikingCoder 8y ago
Bing operates in China, doesn't it?
bad_user 8y ago
Is this like a cheerleading competition?
laurentl 8y ago
Just to highlight that OP was (rightly) talking about business consumers. As a business, under GDPR I am responsible for the compliance of my subcontractors (which includes Google Cloud or Azure for instance). I read about this Google blunder and I think that I have other sh*t to worry about than how Google is screwing around with my data. On the other hand, Microsoft has demonstrated time and again that they care about their customers’ data. 2 examples: the fight with the DoJ over access to emails stored in Ireland and the fact they subcontract Azure’s operations in Germany to a German company (to avoid having to hand over the keys to the data center to a 3-letter agency: they literally don’t have them).
- tpetry 8y ago
  The german azure location is a joke. Only the most basic services are available, there are so many missing in germany...
  - etaioinshrdlu 8y ago
    Maybe they aren't competing on technical competency but regulatory competency? It's a valid strategy.

Animats 8y ago

"Goof"? "The EU figured out our fraud scheme! Waah!"

twunde 8y ago

I don't think I had understood the why behind Google's GDPR fine prior to this. It's also illustrative of the challenges of running a worldwide business with GDPR. Google knew it had a target on its back, is organized and spent a lot of time becoming GDPR compliant and STILL screwed up in a significant way.

icebraining 8y ago
I disagree. It only displays the challenges when you're trying to comply with the letter of the law while doing everything you can to evade its purpose. Stuff like pre-selected consent boxes are not just mistakes or misunderstandings.
- saulrh 8y ago
  The only guaranteed way to avoid regulatory attention is to shut down everything and stop operations. There is fundamentally no decision you can make other than "comply with the law while continuing to operate as effectively as possible". Even more unfortunately, bureaucracies, including every modern corporation and government, are UnFriendly AIs. You must comply with the letter of the law because not a single agent involved, not the regulators writing the law nor the courts that will interpret the law nor your competitors that will bring complaints against you nor even the users of the products involved, knows or cares what the spirit is. They don't have the correct value systems, experiences, philosophical frameworks, or cognitive architectures to execute the "comprehend human values" step that would be required to interpret the "spirit" of the law. That incapability is why an even minimally functional justice system needs things like checks and balances and case law and jurisprudence and rules of evidence and all of those things. But we do need those things, because history has proven universally that the letter of the law is the only thing that matters. On the one hand, this means we literally can't trust any organization composed of more than approximately two people. You often can't even trust organizations with one person, simply because bureaucracy is a force-multiplier even for single humans; think about things like bug trackers and source-control systems and apply them to other workflows. On the other hand, this means that it's pretty much worthless to try to do anything about any individual corporation. Up to the point where you entirely obliterate their industry you're stuck. Which is, coincidentally, what an antitrust action really is - antitrust actions happen exactly when a single agent has taken over an entire industry, and making sure that that an identical bad actor doesn't reappear requires not just breaking it up but also obliterating its industry and introducing a new one with similar features but substantially different (non-agglutinative) dynamics. Standard disclaimers: Views don't represent employer, etc.

amenod 8y ago

I have a very difficult time understanding any of this. I mean, yes, for most of the SME 50 mio dollars would be some money, but for Google? Peanuts. Who cares if they messed up? If this is the penalty for it, bring it on... It was cheap school for them (not on how to do GDPR properly, but how to get better at avoiding penalties in the future). Seriously, I hope EU can do better than that. We could really use some real privacy protections, especially from the likes of Google, Facebook, Microsoft, Apple, Amazon,...

jiveturkey 8y ago
It's not the size of the fine. It's that there's a fine at all. It's a warning shot across the bow. Also, this isn't a fine as "cost of doing business". Google still has to address the issues. If they don't, you can be sure the next fine will be 10x.
Macha 8y ago
If you look at some of the GDPR fearmongering (Particularly stuff like "Oh no my designated DPO left and it took us a week to find a replacement." or "Oh no, my 1 person company with no automated process got a GDPR request while I was on holiday in the bahamas and I took too long" leading to 4% of revenue fines, one of the points made is that the EU tends to not apply the maximum penalty immediately based on the severity of the offence and whether it's a repeat offender. So this is (a) Google's first offence and (b) it seems the finding is about a technicality that could be a genuine mistake (1 day after GDPR Google's TOS didn't mention Google Ireland yet), so it's understandable that they didn't pull out the 4% of global revenue fine. Even though ultimately the Google behavior is the target of the legislation, not giving Google the same "first time's a warning" type behavior of local SMEs sounds like a good way to start a trade war. The next GDPR violation Google is accused of, they will now be a repeat offender and more likely to get a higher fine, until they either become compliant or end up at the 4% of revenue fine.
- laurentl 8y ago
  > it seems the finding is about a technicality that could be a genuine mistake (1 day after GDPR Google's TOS didn't mention Google Ireland yet) To clarify, the fine is due to the consent mechanism in Android. The fact that the action was led by the French regulator rather than the Irish one is due to this technicality and others (no DPO in Google Ireland for instance)

theyinwhy 8y ago

We are currently struggling with firebase cloud messaging as the instance id has been deemed personally identifying by our laywers which google clearly does not think is the case (they don't even offer a data processing contract for firebase). So, if you are currently using Firebase cloud messaging, there is a big chance you are in violation of gdpr.

dantiberian 8y ago
Google Cloud has a DPA if I remember correctly, that would cover Firebase usage?
- theyinwhy 8y ago
  The google cloud DPA unfortunately does not cover Firebase.
ogeidix 8y ago
Are you familiar with [1] and [2]? 1. https://firebase.google.com/support/privacy/ https://firebase.google.com/support/privacy/ 2. https://firebase.google.com/support/privacy/manage-iids https://firebase.google.com/support/privacy/manage-iids
- theyinwhy 8y ago
  I was told the main problem is that google's view on things is not en par with gdpr. Google claims that "Data associated with Instance IDs is generally not personally-identifying" (see 2.) which our lawyers say they clearly are. In that regard, google does not talk about instance ids or, worse, data processing in between APNs and the sending backend (see 1). The current legal situation does not allow us to use firebase cloud messaging.

erickj 8y ago

GDPR enforced this way is a fucking disaster. Good luck being a globally distributed team with VPSs around the globe doing any modicum of data processing.

badrequest 8y ago
The mindset that having a globally distributed team with global VPS coverage is more desirable than ensuring people's private data is handled with care is way more of a fucking disaster.

ggm 8y ago

We (staffers) wanted to consider google g suite for integrated mail/calendar. We couldn't because as an Asia-Pacific entity, we felt we wanted a guarantee our data was in Asia-Pacific (preferably Australian) DC and under local law. What we found, is that only the US State and federal governments can demand US located data from Google. All other economies and agencies can ask for local, but cannot have it a checkbox requirement: Google retain the right to host you wherever they decide, subject to laws they decide. Somebody else has noted that Microsoft, for all their faults, actually looked at customers in Europe and said "you know what: we can declare hosting in ireland is subject to EU laws and we will (at the right price) guarantee your data is in the EU, subject to EU law" and for that, I salute them. I think Google got this wrong. I think microsoft got this right. We didn't go with G Suite. We went another direction with mail and calendar.

eitally 8y ago
This is not true anymore, at least not the second part. It's not possible to select JAPAC data location (yet). https://support.google.com/a/answer/7630496?hl=en&ref_topic=7631290 https://support.google.com/a/answer/7630496?hl=en&ref_topic=...
- ggm 8y ago
  You can select US or Europe or no preference. So, you cannot select LatAM or Asia. Google are getting better, sure. EU feels like they did a reaction to GDPR extra-territoriality issues. The thing is there is either zero selectivity, or there is n+ because nobody codes a two value toggle for this: They clearly have intent to add more. How many more?
dmurray 8y ago
> as an Asia-Pacific entity, we felt we wanted a guarantee our data was in Asia-Pacific (preferably Australian) DC and under local law. I don't understand why you would want a generic Asia/Pacific location. It makes sense that you might want it to be in a particular jurisdiction for legal purposes, so I understand specifying Australia, in the same way other businesses specify EU or US or China. But why would you ever want to say "put our data somewhere in this hemisphere, Australia or Malaysia or Korea are all OK but don't let it be in Ireland or the USA"?