4 ms·

This ruling will 100% be upheld in the higher courts. The website is arguing that they have a legitimate interest in downloading fonts from Google in client br

This ruling will 100% be upheld in the higher courts. The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis. BTW - The website could have used a different legal basis out of 6 available, like consent. See: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ > I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing? Unless there is another way to achieve the same purpose there is a legitimate interest in processing that data for the purposes expected by the client i.e. providing internet service.

marcus_cemes 5y ago
I'm not a layer (web dev in my spare time), but how far does "provide more directly" go? A private ISP? There's no limit, only what seems to be considered by the courts as "reasonable". Then again, that is how law is interpreted most of the time, no?
- Isinlor 5y ago
  When you do anything with personal data in the EU you have to have a legal basis. There are 6 and only 6 possible legal basis: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ But most businesses will be choosing from: - the data subject has given consent to the processing of his or her personal data for one or more specific purposes; - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; - processing is necessary for compliance with a legal obligation to which the controller is subject; - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. You can do basically anything with things like IP addresses as long as you have valid consent from the client i.e. they need to actually know, or at at least be able to learn, what you are doing with their data and decide that it is ok. So, no guessing here, just be transparent, and assume no consent by default. In case of ISP they have to process your personal data because it is necessary for the performance of a contract of providing the internet service. Also, no guessing here. The legitimate interest clause is a "catch all" clause for anything that legislator did not think about, so it is very vague by design. You do not want to choose this as a legal basis for data processing if you do not want to deal with legal uncertainty. But if you do choose it, you should have strong arguments that you really need this legal basis. If similar companies to yours are able to do exactly the same thing in a way that is less impactful on privacy then you can expect that courts will not grant you a legitimate interest. You can also do legal tests do determine whether you have a legitimate interest: - The purpose test (identify the legitimate interest); - The necessity test (consider if the processing is necessary); and - The balancing test (consider the individual’s interests). See more detail here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/how-do-we-apply-legitimate-interests-in-practice/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Also, based on my observation if you are not doing anything really egregious and you are willing to cooperate with data protection agencies (DPA) you do not have to worry about anything. If DPA decides you are doing something wrong they will tell you about it. And if you just adjust, like start to host fonts on your servers, they will let it slide or give you a small slap on the wrists. The really high fines are reserved for malicious conduct or gross incompetence with actual harm already done to people.
tzs 5y ago
> The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis. Would the same argument apply to using Strip or Paypal to accept credit card payments? The site could deal directly with a lower level payment processor which would reduce the number of third party entities that see the user's credit card.
- npteljes 5y ago
  I wouldn't say so, especially because the in the shops I encountered, they explicitly state that "Payment will be handled by XY provider. You'll be redirected etc etc". That's not exactly using a resource from a third party in the background.
- Isinlor 5y ago
  This clearly falls into Art. 6 GDPR paragraph 1, point b) : Processing shall be lawful only if and to the extent that at least one of the following applies: b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; This legal basis is a lot more clear and a lot less stringent than point f) legitimate interest as it does not explicitly require you to establish "legitimacy" and balance it against vague "interests or fundamental rights and freedoms of the data subject". f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. See: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

marcus_cemes 5y ago

I'm not a layer (web dev in my spare time), but how far does "provide more directly" go? A private ISP? There's no limit, only what seems to be considered by the courts as "reasonable". Then again, that is how law is interpreted most of the time, no?

Isinlor 5y ago
When you do anything with personal data in the EU you have to have a legal basis. There are 6 and only 6 possible legal basis: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ But most businesses will be choosing from: - the data subject has given consent to the processing of his or her personal data for one or more specific purposes; - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; - processing is necessary for compliance with a legal obligation to which the controller is subject; - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. You can do basically anything with things like IP addresses as long as you have valid consent from the client i.e. they need to actually know, or at at least be able to learn, what you are doing with their data and decide that it is ok. So, no guessing here, just be transparent, and assume no consent by default. In case of ISP they have to process your personal data because it is necessary for the performance of a contract of providing the internet service. Also, no guessing here. The legitimate interest clause is a "catch all" clause for anything that legislator did not think about, so it is very vague by design. You do not want to choose this as a legal basis for data processing if you do not want to deal with legal uncertainty. But if you do choose it, you should have strong arguments that you really need this legal basis. If similar companies to yours are able to do exactly the same thing in a way that is less impactful on privacy then you can expect that courts will not grant you a legitimate interest. You can also do legal tests do determine whether you have a legitimate interest: - The purpose test (identify the legitimate interest); - The necessity test (consider if the processing is necessary); and - The balancing test (consider the individual’s interests). See more detail here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/how-do-we-apply-legitimate-interests-in-practice/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Also, based on my observation if you are not doing anything really egregious and you are willing to cooperate with data protection agencies (DPA) you do not have to worry about anything. If DPA decides you are doing something wrong they will tell you about it. And if you just adjust, like start to host fonts on your servers, they will let it slide or give you a small slap on the wrists. The really high fines are reserved for malicious conduct or gross incompetence with actual harm already done to people.

tzs 5y ago

> The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis. Would the same argument apply to using Strip or Paypal to accept credit card payments? The site could deal directly with a lower level payment processor which would reduce the number of third party entities that see the user's credit card.

npteljes 5y ago
I wouldn't say so, especially because the in the shops I encountered, they explicitly state that "Payment will be handled by XY provider. You'll be redirected etc etc". That's not exactly using a resource from a third party in the background.
Isinlor 5y ago
This clearly falls into Art. 6 GDPR paragraph 1, point b) : Processing shall be lawful only if and to the extent that at least one of the following applies: b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; This legal basis is a lot more clear and a lot less stringent than point f) legitimate interest as it does not explicitly require you to establish "legitimacy" and balance it against vague "interests or fundamental rights and freedoms of the data subject". f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. See: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/