5 ms·

This is a couple of years old, but look at the data transfer notifications for Life360, which are required under GDPR: > https://twitter.com/alexbremora/status

This is a couple of years old, but look at the data transfer notifications for Life360, which are required under GDPR: > https://twitter.com/alexbremora/status/1211336821747179527 https://twitter.com/alexbremora/status/1211336821747179527

egberts1 5y ago
where is the current list?
- colinhb 5y ago
  Easiest way to discover would probably be going through the signup flow in the EU
- bennyp101 5y ago
  According to the current privacy policy[1] they are Cubiq[2] and Cubiq's trusted partners[3], and then if you are in the UK/EEA then they have (interestingly) images that list who they share with right at the bottom - not searchable text ... [1] https://support.life360.com/hc/en-us/articles/360043228154 https://support.life360.com/hc/en-us/articles/360043228154 [2] https://www.cuebiq.com/privacypolicy/ https://www.cuebiq.com/privacypolicy/ [3] https://www.cuebiq.com/trusted-partners/ https://www.cuebiq.com/trusted-partners/ Edit: https://support.life360.com/hc/article_attachments/1500000496802/Annex_1-2.png https://support.life360.com/hc/article_attachments/150000049... is the one about precise location data
  - colinhb 5y ago
    Applaud you working to track this down! For others following this trail: 1. The linked Life360 privacy policy has two parts, the first part is non-EEA, the second part is EEA: https://support.life360.com/hc/en-us/articles/360043228154 https://support.life360.com/hc/en-us/articles/360043228154 2. Cuebiq is not mentioned in the Part 2/EEA section of the privacy policy. Instead, as parent points out and according to non-searchable Annex 2, "precise location" data may be disclosed to: Arity 875 LLC, Foursquare Labs UK Limited, Google Inc., Placer Labs Inc., AvantGuard Monitoring Centers LLC, OnCall International LLC, Sontiq Inc. I have decoded many privacy policies in my life, but unfortunately don't have time to work on this one. :D
theptip 5y ago
This is confusing. By my read (IANAL, but had to implement GDPR for a startup), under the GDPR selling location data like this is obviously illegal; why bother to gesture at GDPR compliance by listing all of the companies that you're illegally selling data to? Maybe this list is very out of data, but even at the time this should have raised a big flag. ("Datenschutzrichtlinie" seems to be "data protection guideline"? You need to say what the subprocessor is doing with your data, this is not sufficient explanation, unless this actually translates to something meaningful.) > 5)1): Personal data shall be: ... a) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; This is exactly the sort of thing that GDPR was designed to prohibit. You simply cannot use data for a hidden purpose that isn't core to your product. Simply saying "we also sell your Personal Data" in the EULA is not compliant with GDPR. You have to clearly ask customers to opt in to non-essential processing. I suspect that this processing is just for US customers - as far as I can tell, data brokers like SafeGraph are fundamentally not compatible with the GDPR, since approximately nobody would knowingly opt in to giving away their data to these companies. (Anyone in the industry know more about how the EU data broker industry has evolved in the last few years? It's been a little while since I have been directly in contact with the EU regulatory system.)
- x0x0 5y ago
  Per GDPR, nearly anything you for which you get consent is legal. As your quote shows: a purpose must relate to a legal basis, and one of the legal bases is consent. Was there actual consent? Unlikely, but I can't read the German in that clip explaining what's going on with these companies.
  - theptip 5y ago
    > Per GDPR, nearly anything you for which you get consent is legal. I think this requires qualification. There are a bunch of cases where consent is not considered valid, and there are requirements on being explicit about what you're getting consent for. See Article 7: https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ > If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. In other words, burying consent in a 10-page EULA probably doesn't float. The subject can withdraw consent at any time. This must be easy to do. And more importantly, see Article 6 - you can't just get consent for "monitoring your children" and then use the data for unrelated things that you claim are part of that task. In this case the only way you could be compliant is if you had a pop-up that says "we'd like to sell your location data to other companies (listed here). This isn't required to offer you our location tracking service. Do you give consent? Y/N". In which case the story would not be news, as everybody would be aware that this is what the app does.

egberts1 5y ago

where is the current list?

colinhb 5y ago
Easiest way to discover would probably be going through the signup flow in the EU
bennyp101 5y ago
According to the current privacy policy[1] they are Cubiq[2] and Cubiq's trusted partners[3], and then if you are in the UK/EEA then they have (interestingly) images that list who they share with right at the bottom - not searchable text ... [1] https://support.life360.com/hc/en-us/articles/360043228154 https://support.life360.com/hc/en-us/articles/360043228154 [2] https://www.cuebiq.com/privacypolicy/ https://www.cuebiq.com/privacypolicy/ [3] https://www.cuebiq.com/trusted-partners/ https://www.cuebiq.com/trusted-partners/ Edit: https://support.life360.com/hc/article_attachments/1500000496802/Annex_1-2.png https://support.life360.com/hc/article_attachments/150000049... is the one about precise location data
- colinhb 5y ago
  Applaud you working to track this down! For others following this trail: 1. The linked Life360 privacy policy has two parts, the first part is non-EEA, the second part is EEA: https://support.life360.com/hc/en-us/articles/360043228154 https://support.life360.com/hc/en-us/articles/360043228154 2. Cuebiq is not mentioned in the Part 2/EEA section of the privacy policy. Instead, as parent points out and according to non-searchable Annex 2, "precise location" data may be disclosed to: Arity 875 LLC, Foursquare Labs UK Limited, Google Inc., Placer Labs Inc., AvantGuard Monitoring Centers LLC, OnCall International LLC, Sontiq Inc. I have decoded many privacy policies in my life, but unfortunately don't have time to work on this one. :D

theptip 5y ago

This is confusing. By my read (IANAL, but had to implement GDPR for a startup), under the GDPR selling location data like this is obviously illegal; why bother to gesture at GDPR compliance by listing all of the companies that you're illegally selling data to? Maybe this list is very out of data, but even at the time this should have raised a big flag. ("Datenschutzrichtlinie" seems to be "data protection guideline"? You need to say what the subprocessor is doing with your data, this is not sufficient explanation, unless this actually translates to something meaningful.) > 5)1): Personal data shall be: ... a) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; This is exactly the sort of thing that GDPR was designed to prohibit. You simply cannot use data for a hidden purpose that isn't core to your product. Simply saying "we also sell your Personal Data" in the EULA is not compliant with GDPR. You have to clearly ask customers to opt in to non-essential processing. I suspect that this processing is just for US customers - as far as I can tell, data brokers like SafeGraph are fundamentally not compatible with the GDPR, since approximately nobody would knowingly opt in to giving away their data to these companies. (Anyone in the industry know more about how the EU data broker industry has evolved in the last few years? It's been a little while since I have been directly in contact with the EU regulatory system.)

x0x0 5y ago
Per GDPR, nearly anything you for which you get consent is legal. As your quote shows: a purpose must relate to a legal basis, and one of the legal bases is consent. Was there actual consent? Unlikely, but I can't read the German in that clip explaining what's going on with these companies.
- theptip 5y ago
  > Per GDPR, nearly anything you for which you get consent is legal. I think this requires qualification. There are a bunch of cases where consent is not considered valid, and there are requirements on being explicit about what you're getting consent for. See Article 7: https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ > If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. In other words, burying consent in a 10-page EULA probably doesn't float. The subject can withdraw consent at any time. This must be easy to do. And more importantly, see Article 6 - you can't just get consent for "monitoring your children" and then use the data for unrelated things that you claim are part of that task. In this case the only way you could be compliant is if you had a pop-up that says "we'd like to sell your location data to other companies (listed here). This isn't required to offer you our location tracking service. Do you give consent? Y/N". In which case the story would not be news, as everybody would be aware that this is what the app does.