3 ms·

There are a lot of different viewpoints regarding GDPR. But the one thing which grinds my gears the most is the fact that somehow people using tools like Google

by V__ 5y ago

There are a lot of different viewpoints regarding GDPR. But the one thing which grinds my gears the most is the fact that somehow people using tools like Google Analytics take on legal risk, but not Google itself for providing it. Google has offices in Europe. Why, if it isn't possible to use it in compliance with the law (as a customer), isn't Google forced to shut it down or change it? The same goes for Facebook and all other companies offering tracking etc. They should be responsible for offering compliant products.

HPsquared 5y ago
If I was defending them, I'd use an argument along the lines of "trackers don't track people". In other words, "improper" use of the tools is the crime, not the creation of the tools themselves.
- V__ 5y ago
  The thing about GDPR is, the intention (in most cases) doesn't matter. If Google is using servers outside Europe or using the data for anything not officially disclosed (and disclosures hidden in eulas etc. don't count) then they are in breach of GDPR.
  - j_not_j 5y ago
    Nah, I don't think so. Google is a subcontractor. The owner of the website is using a service to track browser behaviour, and, perhaps erroneously, user identities. The service is famous, but not unique. What the subcontractor does with the data is the responsibility of the website owner -- if they allow Google to abuse the data owner (that is, misuse the PII of people visiting the website), then the website owner should be held responsible.
    - V__ 5y ago
      > What the subcontractor does with the data is the responsibility of the website owner That's my issue. Since Google has legal entities in Europe they should be held accountable as well. Right now they are offering and marketing a service which is more or less illegal to use. If it were some company outside Europe, then yes by all means the website owner should make sure the 'subcontractor' is in compliance.
    - pessimizer 5y ago
      > Google is a subcontractor. Are they though, if Google is providing the analytics and the ads? Seems more like the content provider is the subcontractor.
    - talideon 5y ago
      I think you miss the point: Google are the data processor in this case. (In fact, as the body collecting the data, they also have shades of a data controller.) Doesn't matter if they're a subcontractor: they have responsibilities under the GDPR, because they're the ones holding onto that data. It's not like they're holding it in some form, passing it on to the website owner, and obliterating it. I would recommend searching for the terms "data processor" and "data controller" on the European Commission website. They have very clear explanations of the responsibilities for both.
- drcongo 5y ago
  Is it actually possible to use it in a not improper way though? That's the issue I think, if Google are going to offer the tool for use in EU, then their tool should not put its customers at legal risk.
denton-scratch 5y ago
> Why, if it isn't possible to use it in compliance with the law As far as I can see, the problem was the way a specific site was using analytics. I.e. it's possible to use anaytics in compliance with GDPR. Have I misread it? [Edit] The website operator seems to have failed to scrub IP addresses from data uploaded to analytics. This stuff about "EU Users can't use US cloud services" seems overcooked.
- V__ 5y ago
  You are right regarding the IP, the question would be however, why this isn't deactivated by default. Regarding the cloud: > In 2020, the EU Court of Justice struck down the so-called Privacy Shield data protection arrangements between the bloc and the US in what is now known as the Schrems II ruling, which has ramifications for US cloud providers, social media sites, and providers of online tools. > "This is a very detailed and sound decision. The bottom line is: companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced.
  - denton-scratch 5y ago
    That's some kind of summary (and it looks a bit partisan). It's perfectly permissible to use "cloud" services that are in the USA. It's just forbidden to use cloud services in the USA to store PII.
  - aliswe 5y ago
    enabling IP anonymization to my knowledge breaks geo-related features in GA.

by V__ 5y ago

HPsquared 5y ago

If I was defending them, I'd use an argument along the lines of "trackers don't track people". In other words, "improper" use of the tools is the crime, not the creation of the tools themselves.

V__ 5y ago
The thing about GDPR is, the intention (in most cases) doesn't matter. If Google is using servers outside Europe or using the data for anything not officially disclosed (and disclosures hidden in eulas etc. don't count) then they are in breach of GDPR.
- j_not_j 5y ago
  Nah, I don't think so. Google is a subcontractor. The owner of the website is using a service to track browser behaviour, and, perhaps erroneously, user identities. The service is famous, but not unique. What the subcontractor does with the data is the responsibility of the website owner -- if they allow Google to abuse the data owner (that is, misuse the PII of people visiting the website), then the website owner should be held responsible.
  - V__ 5y ago
    > What the subcontractor does with the data is the responsibility of the website owner That's my issue. Since Google has legal entities in Europe they should be held accountable as well. Right now they are offering and marketing a service which is more or less illegal to use. If it were some company outside Europe, then yes by all means the website owner should make sure the 'subcontractor' is in compliance.
  - pessimizer 5y ago
    > Google is a subcontractor. Are they though, if Google is providing the analytics and the ads? Seems more like the content provider is the subcontractor.
  - talideon 5y ago
    I think you miss the point: Google are the data processor in this case. (In fact, as the body collecting the data, they also have shades of a data controller.) Doesn't matter if they're a subcontractor: they have responsibilities under the GDPR, because they're the ones holding onto that data. It's not like they're holding it in some form, passing it on to the website owner, and obliterating it. I would recommend searching for the terms "data processor" and "data controller" on the European Commission website. They have very clear explanations of the responsibilities for both.
drcongo 5y ago
Is it actually possible to use it in a not improper way though? That's the issue I think, if Google are going to offer the tool for use in EU, then their tool should not put its customers at legal risk.

denton-scratch 5y ago

> Why, if it isn't possible to use it in compliance with the law As far as I can see, the problem was the way a specific site was using analytics. I.e. it's possible to use anaytics in compliance with GDPR. Have I misread it? [Edit] The website operator seems to have failed to scrub IP addresses from data uploaded to analytics. This stuff about "EU Users can't use US cloud services" seems overcooked.

V__ 5y ago
You are right regarding the IP, the question would be however, why this isn't deactivated by default. Regarding the cloud: > In 2020, the EU Court of Justice struck down the so-called Privacy Shield data protection arrangements between the bloc and the US in what is now known as the Schrems II ruling, which has ramifications for US cloud providers, social media sites, and providers of online tools. > "This is a very detailed and sound decision. The bottom line is: companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced.
- denton-scratch 5y ago
  That's some kind of summary (and it looks a bit partisan). It's perfectly permissible to use "cloud" services that are in the USA. It's just forbidden to use cloud services in the USA to store PII.
- aliswe 5y ago
  enabling IP anonymization to my knowledge breaks geo-related features in GA.