7 ms·

I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

• tomtom1337 5mo ago
  This is extremely cool reading! I'm impressed that they actually fined Elkjøp (as they should!) but very surprised that they didn't keep you informed! Thank you for sharing!
  • AlexanderHanff 5mo ago
    It was not their responsibility to keep me informed, it was the responsibility of IMY (the Swedish Regulator) to keep me informed.
    • tomtom1337 5mo ago
      Sorry, I guess. There were no comments here after a couple of hours and I literally felt bad, so I commented without being very exact in my writing. Regardless, great job, and thank you.
• ryandrake 5mo ago
  Excellent outcome. I wish we had these rights in the USA! Too bad justice took 5 years though.
  • Mathnerd314 5mo ago
    There are some state laws - California, Virginia and Colorado, a bunch of others. And the SECURE Data Act currently in Congress. https://statescoop.com/house-subcommittee-secure-data-act-preempts-state-privacy-laws-2026/ https://statescoop.com/house-subcommittee-secure-data-act-pr...
    • AlexanderHanff 5mo ago
      There are currently 22 US States with comprehensive privacy laws with Louisiana being the latest (their Governor signed just last week iirc) and the 23rd is literally a Governor's signature away (just passed the state senate).
• peaseagee 5mo ago
  And how much did it make them over those 5 years?
  • Retric 5mo ago
    The fine is only part of the story. They likely spent more money than the fine fighting it over 5 years as fines increase next time if you don’t stop.
    • coldtea 5mo ago
      And how much did it make them over those 5 years?
      • aucisson_masque 5mo ago
        You don't know how much it did cost them. Why would you care about how much they gained ? You can't compare something when you have neither value.
        • anakaine 5mo ago
          Because if, as the regulator, you fail to benchmark what they gained then your laws can be ignored and your fines paid as simply a cost of doing business. Its why you find the Australian regulator for consumer affairs handing out $200m+ fines to telecommunications companies, for example.
          • Retric 5mo ago
            By that logic regulators should lower fines if the action wasn’t profitable. Which creates an expensive legal fight around the net profits of some action were after guilt is determined. Instead, it’s much better to scale fines based on the scale of the entity involved, which also results in huge fines, but it’s easier to measure revenue. Thus the fines are more broadly effective, and you can still escalate if they don’t stop.
• pixelpoet 5mo ago
  Love to see this, and love our privacy and data handling laws!
• pavel_lishin 5mo ago
  The image isn't loading for me, all I see is the prompt used to generate it - which is genuinely preferable.
  • QuantumNomad_ 5mo ago
    For me it was showing the image and the prompt, but the whole page was unstyled. But when I reloaded the page now, the css loaded also and the prompt is not shown. I guess the web server was temporarily overwhelmed by traffic resulting in images (like for you) and css files (like for me) not being consistently served to all visitors.
    • AlexanderHanff 5mo ago
      If you click the image, it flips to reveal the prompt and other metadata. The blog is running on a Mac Mini on a 1Gb/s uplink so when it gets hit with a front page HN post, it does creak a little but I try to be environmentally responsible with my technology (as much as possible) so I am not in a hurry to move it into a datacentre when currently it only pulls 15-25W from the wall during peak traffic.
  • kuboble 5mo ago
    Is it a prompt or accessibility description for screen readers?
    • cmeacham98 5mo ago
      The website labels it as a prompt, so probably a prompt
  • voidUpdate 5mo ago
    mildly amusing that the model was instructed to generate it in the style of a "wide angle film still" but it seems to have gone for a painting instead
• pixelneon 5mo ago
  Hahaha, the sticker looks really funny, but I like it.
• echoangle 5mo ago
  Good to know that this is illegal. One of my email providers also does this, maybe I’ll also have to try reporting them and see what happens.
  • VorpalWay 5mo ago
    Go for it! If nobody reports things they don't get fixed. I have found this to be true not just when it comes to companies breaking laws, but also to much more benign things. Such as reporting potholes in town or broken microwaves at work. Those can be in need of fixing for an extended period of time, yet when I report them, they usually get fixed within days. I suspect most people can't be bothered or think that surely someone else will report the issue. But that doesn't work if everyone thinks that way.
  • TurdF3rguson 5mo ago
    EU only though. You can get away with pretty much anything outside of EU.
    • Symbiote 5mo ago
      Or the UK, which is still in alignment for privacy regulation as far as I know.
• Telaneo 5mo ago
  Datatilsynet, the Norwegian DPA, from my experience, consistently has the user in mind. It (sadly) takes a long time for things to pass through the system, but they consistently come to good decisions.
• QuantumNomad_ 5mo ago
  > the only way to stop the marketing was to cancel my membership of the club altogether I have experienced this same thing with at least one other big company in Norway. I could opt out of either SMS or e-mail, but not both, or I would not be able to keep the membership. Unfortunately, I never made a note of which one that was exactly so I can’t name them and shame them on the spot. Despite half-hearted attempts at stopping marketing emails now and then by individually logging in and opting out, or clicking unsubscribe links embedded in the email, my email continues to be flooded with marketing both from domestic and foreign companies that I’ve done business with. There is so many companies that even going through a handful of them at a time and unsubscribing there is a seemingly endless amount of companies that remain to unsubscribe from. It is great to see that someone fights back, and that it is resulting in fines.
  • kristianrs 5mo ago
    komplett.no
• londons_explore 5mo ago
  If I did business in the EU, I would be banning this chap from my services on the basis that the risk he poses to the business is too great...
  • onli 5mo ago
    You would do no such thing, because if you tried, you wouldn't have a business in the EU anymore.
  • solid_fuel 5mo ago
    Frankly, this attitude is pathetic. Absolute loser behaviour. I don't think you should be doing business anywhere if customers being familiar with the law and knowing their rights scares you. Frankly if you are running a business, you should be familiar with the laws and regulations, doing otherwise - especially when someone points out that your behaviour is illegal - is negligence and punishment with a fine is completely appropriate. Welcome to living in a society.
  • Broken_Hippo 5mo ago
    In other words, you'd ban someone because they might notice that you are doing illegal stuff and you might get caught. Follow the laws and it isn't an issue. I'm pretty sure banning someone for that stuff is probably illegal, too.
  • throw9394494 5mo ago
    Just awoid some jurisdictions. Bulgaria is in EU, has all the same access, and has no time for this BS.
    • Symbiote 5mo ago
      You can see the fines the Bulgarian regulator has handed out here: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
  • dataflow 5mo ago
    The risk of getting caught doing business illegally? You really don't give a damn about the illegal part, just getting caught?
• engeljohnb 5mo ago
  I'm glad it all worked out for this individual. I hope more people live their lives like this as the dystopia progresses. Unfortunately, especially in the US, exercising your rights, or even just reading every paper you're expected to put your name to, not only constantly pisses people off for some reason, but also puts you at a significant disadvantage compared to the people that never push back in the interest of not making waves, or even because "whatever it's fine."
  • drstewart 5mo ago
    Can you cite the especially in the US part? Maybe use Bolivia, Kosovo, and Indonesia as some random global comparisons.
    • engeljohnb 5mo ago
      You're right, it would've been better to say "at least far as my experience in the US."
  • solid_fuel 5mo ago
    > Unfortunately, especially in the US, exercising your rights, or even just reading every paper you're expected to put your name to, not only constantly pisses people off for some reason Yup. It's particularly sad seeing other people in this very thread talking about how they would "ban this customer for life" just for knowing their rights. I think it's pathetic that this has become the culture amongst large swathes of Americans - especially ones who consider themselves patriotic. This country was founded in rebellion and the assertion of our rights, and somehow the exact opposite is now the ideal of many citizens now.
    • trhway 5mo ago
      >I think it's pathetic that this has become the culture amongst large swathes of Americans - especially ones who consider themselves patriotic. This country was founded in rebellion and the assertion of our rights, and somehow the exact opposite is now the ideal of many citizens now. DHS is putting on the domestic terrorists watch list those people who took parts in the protests. Or at minimum threatens to put. And if you google a bit more you'd see that it isn't limited to ICE. Any dissent is perceived by the current government in a similar "terrorism" way. For majority of population that would completely chill any desire to assert rights. https://www.markey.senate.gov/imo/media/doc/letter_to_dhs_on_domestic_terrorist_database.pdf https://www.markey.senate.gov/imo/media/doc/letter_to_dhs_on... "U.S. Immigrations and Customs Enforcement (ICE) officers and senior Trump administration officials have repeatedly suggested that the Department of Homeland Security (DHS) is building a “domestic terrorists” database comprising information on U.S. citizens protesting ICE’s actions in recent weeks. ... In recent weeks, DHS personnel and senior officials have repeatedly stated that the agency is engaged in efforts to monitor, catalog, and intimidate individuals engaged in peaceful protests"
• 0xfffafaCrash 5mo ago
  > The reply I received a few days later did me the favour of putting the violation on the record. Their position, in their own words, was that "in order to receive marketing / offers, it is a condition to be a member of the customer club." That one sentence is the whole case. They had taken a right I am entitled to exercise for free and turned it into the price of admission. I don’t understand… it would be one thing if it said “receiving marketing/offers is a condition of being a member of the customer club” but that’s not what is being stated above… rather that being a member of the club is required to receive marketing — perhaps something has been misworded or lost in translation?
  • LearnYouALisp 5mo ago
    sounded exactly like translation error from a German-related lang. e.g. "to receive offers...is a condition to be in..."
  • drdaeman 5mo ago
    Yea, I don't get it either. Receiving being a condition on membership means (in my understanding) only that non-members can't (shouldn't) receive anything, not that members will or must receive something. Which sounds perfectly normal and sane to me.
  • mixdup 5mo ago
    I think the "marketing/offers" means discounts? To be eligible for the discounts or special offers, you have to be a member of the club, and if you are a member of the club you have to be willing to receive the email messages, and somehow under EU law you're entitled to all discounts I guess?
    • gruelsandwich 5mo ago
      Even if you opt out of marketing emails, they can still collect information about you, which is useful
    • subscribed 5mo ago
      That's pretty disingenuous thing to say. The company was also processing, transferring and selling private data without doing as much as informing their customers. It's perfectly possible to offer discounts to customers without egregious violations of law and privacy.
• throw9394494 5mo ago
  I wonder if anyone who are cheering this fine, actually read and tried to implement GDPR. It is a nightmare to be fully compliant for small companies. It is mostly just a theater (like endless cookie consent dialogs in anonymous browsing), to employ more experts and bureaucrats. EU is now pushing privacy laws that severely undermine privacy.
  • tverbeure 5mo ago
    > EU is now pushing privacy laws that severely undermine privacy. Even if it’s most just theater, you don’t make the case at all how it undermines privacy.
  • iliveinberlin 5mo ago
    I did, it is easy, you just don't spy on people and have a point of contact and you're good. It becomes hard when you want to spy on people and also remain compliant with the no spying law.
    • dgellow 5mo ago
      You can even spy if you want to, just ask for consent
      • CalRobert 5mo ago
        Getting consent in a truly compliant way is basically impossible (it should be opt IN, not opt OUT). Though we've trained people to just accept literally everything now.
        • BadBadJellyBean 5mo ago
          Why is opt in "basically impossible". That is the definition of consent. Ask BEFORE you do something. It might sound strange but most people really don't want their data gathered by everyone.
          • 5mo ago
• RobRivera 5mo ago
  Lol. Brookfield Place wifi had an OPT IN for their wifi to receive marketing. If you unclicked it, the 'connect to wifi' button greyed out and a notification appears saying that Opt In is required for wifi.
  • iliveinberlin 5mo ago
    Type the email address of somebody you dislike
    • Telaneo 5mo ago
      There's always a@a.com
      • plagiarist 5mo ago
        My go-to is always their domain, if it works.
    • josephg 5mo ago
      Yep this. They never make you verify your email address on a captive portals. (Since you can’t check your email without an internet connection in the first place).
      • what 5mo ago
        Then you could put in anything that looks like a valid email rather than the email of someone you dislike.
    • RobRivera 5mo ago
      THATS EXACTLY WHAT I DID mwahahaha
    • gorbachev 5mo ago
      yomomma@example.com works for me, most of the time. Some of the places that like to spam their users no matter what filter example.com out.
• kklisura 5mo ago
  GDPR is a godsend.
• sscaryterry 5mo ago
  This fills my heart with joy. If only ICO in the UK would do the same.
  • AlexanderHanff 5mo ago
    Well John Edwards just resigned yesterday so maybe you will get a real Commissioner this time - although that said, John was hired specifically as someone who would do nothing, so I guess he did what he was paid to do. He has largely been ostracised by the privacy and data protection community (even at regulatory events) I have seen him wandering around alone and aimlessly at a number of regulatory events, he didn't seem very comfortable and didn't really have a lot of interaction with his peers.
    • SomeUserName432 5mo ago
      Someone sent me https://e24.no/norsk-oekonomi/i/OkEMRb/433-millioner-i-mistenkelige-transaksjoner-ikke-rapportert https://e24.no/norsk-oekonomi/i/OkEMRb/433-millioner-i-miste... and I immediate thought of this post. On e24, opting out of cookies is a paid service.
  • subscribed 5mo ago
    ICO bothers to whine and plead sometimes! But usually even the extensive evidence is indeed met with "eh, mate, can't you just ask them again?"
    • sscaryterry 5mo ago
      Yep, pretty much the definition of a toothless regulator.
• buzer 5mo ago
  Actual decision (Norwegian): https://www.datatilsynet.no/contentassets/c8d0551d2a64403285e006f76170b8b6/elkjop---vedtak-om-overtredelsesgebyr---kundeklubb-og-de-registrertes-rettigheter.pdf https://www.datatilsynet.no/contentassets/c8d0551d2a64403285... Machine translation of overview & 5.1 which is what the blog post is about (covers some other things as well): https://chatgpt.com/share/6a34732c-0fa4-83e8-aae1-95c25dd117c9 https://chatgpt.com/share/6a34732c-0fa4-83e8-aae1-95c25dd117... [EDIT] Oh, there was actually official English decision available as well: https://www.datatilsynet.no/contentassets/59addbef9c1b48a28fbb8193d0bbfb2f/22_00049-28-22_00049-22-final-decision---elkjop-nordic-as.pdf https://www.datatilsynet.no/contentassets/59addbef9c1b48a28f...
• aaron695 5mo ago
  [dead]
• jazz9k 5mo ago
  I'm so glad the GDPR never took hold in the US. Little Karens getting companies fined millions of dollars over what amounts to nothing. You can always not use their service. Plenty of alternatives out there.
  • wredcoll 5mo ago
    How depressingly unamerican.
    • solid_fuel 5mo ago
      It's really pathetic, isn't it? These guys hate their fellow Americans so much that they think it's better to allow companies to abuse people instead of stepping in to protect them.
  • wafflemaker 5mo ago
    I for one was signed up for Elkjøp kundeklubb membership unbeknownst to me. It happened when I was picking up a water cooker. Seller asked if I would like an electronic receipt and asked me for my email. That was in Elkjøp at Solsiden in Trondheim. The more annoying is that I gave him my regular email address and not a generated alias that I always give to companies. Was super pissed when spam started landing on my main address. So no, not plenty alternatives here.
    • Symbiote 5mo ago
      If I need to buy something at El Giganten (Danish version) I speak English when paying, and tell them I'm a tourist and don't want to give them a phone number or email. They can print a paper receipt. But I only buy from there if it's the only option. (Other than Amazon, which I refuse to use at all.)
  • gruelsandwich 5mo ago
    Norway has in practice only two big box electronics chains. Not always "pleny of alternatives out there"
• arjie 5mo ago
  It's an interesting story, but I could not help but have my mind skip over it because of the LLMisms. Acts like one of those taboola reels to me. If even just there was a tutorial to get people to write in such a way that it's not obviously LLM text it would be nice because the story is interesting. I know, it's like complaining about JS etc. but it's like walking into an elevator and smelling very strong perfume. It's hard not to go "whew!"
  • cwillu 5mo ago
    > LLMisms The word is “cliches”, and they existed long before LLMs.
    • arjie 5mo ago
      Haha they are cliches, yes. But a specific type of cliche that is unique to current language models. > That one sentence is the whole case This example, for instance, is more uniquely LLM than mere common cliche.
      • Terr_ 5mo ago
        > cliche that is unique to current language models If it's something humans don't do and unique to certain programs, then "cliche" is probably not the correct term. "I read the article, but it was full of improperly-escaped HTML entity references, how cliche."
      • cwillu 5mo ago
        Gonna need you to expand on that, because I don't see how that sentence is “uniquely LLM” at all. It feels pretty typical for legal people speaking informally.
        • berege 5mo ago
          Lmao at the absolute ego behind that wording >Gonna need you to expend on that Sure boss everyone here is just waiting for your commands to meet your every need
• alexhans 5mo ago
  It's always satisfying when customer rights stories have a known positive outcome. The timeline is unfortunately quite slow and bureocractic but I'm glad OP managed to find out about it.
• yieldcrv 5mo ago
  I’m imagining an agentic solution in everyone’s inbox that automates GDPR fines and updates
• angry_octet 5mo ago
  I don’t know who you are. I don’t know what you want. If you are looking for ransom I can tell you I don’t have money, but what I do have are a very particular set of skills. Skills I have acquired over a very long career. Skills that make me a nightmare for people like you.
• Insimwytim 5mo ago
  There's also issue with EU companies forcing candidates to agree to their anti-privacy policies (confusingly named "privacy policies") as a requirement before the job interview. Those anti-privacy policies will state, that you grant the company and third-parties (so, anyone) permissions to use your data (including voice and image) for any purpose. (Of course, it is stated in a slightly obscure fashion, so a layman may not comprehend it.) I wonder if there has been any similar action taken against those.
  • buzer 5mo ago
    I haven't personally encountered that, but you are free to lodge complaint with your local DPA about it. That exact language is unlikely to be compliant. If you want to maximize your effect you could make Article 15 request to the company in question, get the list of actual recipients of data (make sure to be ask for this specifically) and then make another request to all of those companies. That will then allow you to possibly make further complaints (e.g. why exactly they didn't send Article 14 information to you, are the legal basis they use actually proper in your case especially if the original one was consent and it was not freely given).
    • Insimwytim 5mo ago
      Wouldn't you have to "consent" first? What if you didn't and did not proceed with the process? Can you complain still? As in - if you didn't give your consent there's no violation has occurred and they don't have your data, so nothing to ask for?
      • buzer 5mo ago
        That's a bit more complex. Everyone is free to make a tip to DPA. However DPA is free to decide if they want to start their own investigation based on that unlike when you make Article 77 complaint. There isn't a lot of case law around the threshold of Article 77. The text says "if the data subject considers that the processing of personal data relating to him or her infringes this Regulation". If read completely alone one could make argument that since you didn't consent no processing occurred -> you do not have right to make an Article 77 complaint. However when taking the in account the goals and purpose of GDPR as well as recital 141 I would argue otherwise. To be specific recital 141 says "if the data subject considers that his or her rights under this Regulation". CJEU also often refers to GDPR's objective of ensuring high level of protection of fundamental rights and freedoms of natural persons. I feel that ex post requirement would be quite contrary to that. Due to this my personal stance would be that just offering invalid consent choice where refusal has negative consequences is something that violates data subject's rights even if processing didn't occur and would be eligible for actual Article 77 complaint rather than just tip to DPA. [EDIT] Also, there is Article 82 path via damages. In your case you could potentially argue that you suffered damages (like lost wages) due to company's invalid consent requirement. This, however, is generally a lot harder and more expensive path. Depending on how legal costs are allocated in your jurisdiction you could also end up with judgement where you need to pay your opponent's legal costs if you lose. For Article 82 claim you almost definitely will need a lawyer.
• josefritzishere 5mo ago
  I wish America had real privacy laws like Norway.
• ambicapter 5mo ago
  I understand where he's coming from, but it is still hilarious that he sued the legal entity that won the case for him, after they found the case in his favor.
  • buzer 5mo ago
    What do you mean? It sounds like he is planning to sue company in question and possibly lodging complaint against Swedish DPA. Norwegian DPA is the one who found case in his favor.
    • LtdJorge 5mo ago
      Yes, he doesn't have a problem with the Norwegian DPA but with the Swedish DPA which are the ones that should be in contact with him.
  • intended 5mo ago
    Seeing that he influenced the creation of the GDPR, the general sense of hopelessness in the rest of the populace, and the failure of the governing body to do it’s jobs - I suppose he is the only person who would be taking people to account.
  • TonyStr 5mo ago
    Looking at the report from datatilsynet (Norwegian Data Protection Agency), they cite "multiple reports and tips" as the background. I suspect what happened here is that IMY concluded that this laid outside of their authority, submitted the complaint to datatilsynet and either closed the case and forgot to inform Hanff, or they may have never gotten any response from datatilsynet.
    • AlexanderHanff 5mo ago
      I have had several direct discussion with the Norwegian DPA throughout the case, the inspection and investigation were triggered by the IMY cross border case and I have not "sued" the regulator (neither do I say I have) I have filed a complaint against IMY (the Swedish Regulator) for failure to meet their legal obligations under Article 77(2) but then I have already had to file multiple legal complaints against IMY because they are an absolutely terrible supervisory authority that do literally nothing (they send out postcards to Data Controllers for violations saying "Hey do you know what GDPR is?"). So no, I have not sued the Norwegian DPA and actually have a very good relationship with them along with most of the other EU DPAs (I am an advisor to them, I sit in the pool of experts for law and new technologies at the EDPB which includes ALL EU data protection authorities).
• NooneAtAll3 5mo ago
  how was 1.8M calculated? has any calculations been made on how much actual profit was made by these unlawful actions?
  • u1hcw9nx 5mo ago
    Page 33. Fine is calculated from annual worldwide revenue from previous year for the company. https://www.datatilsynet.no/contentassets/59addbef9c1b48a28fbb8193d0bbfb2f/22_00049-28-22_00049-22-final-decision---elkjop-nordic-as.pdf https://www.datatilsynet.no/contentassets/59addbef9c1b48a28f...
    • NooneAtAll3 5mo ago
      "guidelines say we should apply fine of 0.4% yearly revenue (400M NOK) at the least, but for whatever reason we decided punishment to be 20x less than that" okay then...
• matheusmoreira 5mo ago
  Badass. Hope this keeps happening to all of those abusive "take it or leave it" corporations.
• setgree 5mo ago
  The part about this that's amazing to me is that they still are doing nothing after he noted another GDPR violation [0]. He's obviously both competent and litigious. What does the company expect to happen next?? [0] "Under Article 77(2) of the GDPR a supervisory authority is under a binding legal obligation to keep a complainant informed of the progress and the outcome of their complaint. It is not a courtesy and it is not discretionary - it is written into the law. I filed my complaint with IMY, IMY passed it on, the case ended in a multi-million euro enforcement action, and not one of the authorities involved thought to tell the person who started it."
  • XelNika 5mo ago
    As I understand it, this second complaint is not against the original company, but against the government authority that handled his case.
    • gpm 5mo ago
      There's two government authorities here, the one he reported it to (Swedish), and the one that the first one forwarded it to (Norwegian). The former is the one he seems to be currently taking to task for failing to follow the law, the latter is the one that meaningfully handled the case.
      • buzer 5mo ago
        It's also worth noting that it's not the first time Swedish DPA has been criticized regarding GDPR complaint handling: https://noyb.eu/en/gdpr-rights-sweden https://noyb.eu/en/gdpr-rights-sweden "GDPR Rights in Sweden: Court confirms that authority must investigate complaints. So far, the Swedish IMY has taken the view that users don’t have party rights in GDPR procedures." https://noyb.eu/en/noyb-takes-swedish-dpa-court-refusing-properly-deal-complaints https://noyb.eu/en/noyb-takes-swedish-dpa-court-refusing-pro... "IMY frequently just forwards a complaint to the company that illegally processes personal data - and then immediately closes the case without investigating." (no decision on this as far as I know. A bit surprising since it has been almost 2 years)
    • 5mo ago
• N_Lens 5mo ago
  This article reads like “jurisprudence fetishist gets off on technicality!” How refreshingly European.
  • Terr_ 5mo ago
    How is "you must let customers opt-out of marketing spam" a technicality?
  • actionfromafar 5mo ago
    Tell me it’s raining, huh? America is used to yellow rain.
• spl757 5mo ago
  The term "forced consent" is an oxymoron. It shouldn't take much more critical thinking than reading that term to know it makes no sense.
  • ozozozd 5mo ago
    Agreed. It’s an idiotic euphemism.
  • patates 5mo ago
    It's one of those situations that the words lose their meanings but the expression makes you understand a situation better. This is like a manufactured consent that comes with a threat. A similar example would be "coerced confession" or maybe even "forced smile".
• gib444 5mo ago
  Eveyone getting very excited but on what date did the company actually pay the fine to the EU? > This decision can nevertheless be challenged before Norwegian courts in accordance with Article 78(1) of the GDPR. [0] Time will tell I guess? [0] https://www.datatilsynet.no/contentassets/59addbef9c1b48a28fbb8193d0bbfb2f/22_00049-28-22_00049-22-final-decision---elkjop-nordic-as.pdf https://www.datatilsynet.no/contentassets/59addbef9c1b48a28f...
  • AlexanderHanff 5mo ago
    It can be appealed but because it is cross border it has to be appealed directly at the Oslo Court (rather than the privacy claims board) and also the fact they had the fine reduced for co-operation usually includes a clause that they will not appeal (otherwise they lose the discount which is normally around 30%).
• vinni2 5mo ago
  I am glad this was resolved. It’s annoying when companies take things for granted. It’s not just Elkjøp doing it. There are other e commerce companies and some online pharmacies doing it too.
• petterroea 5mo ago
  I personally know other people who have filed similar complaints, and the Norwegian Datatilsynet explicitly stated they acted based on many complaints. I don't think they care about a single person's voice in this, even if they "helped create the law". It's a shame, but it probably says more about Datatilsynet's capacity. Frankly it would be great if you could simply say "this company did something dodgy", provide proof, and immediately get results. But that's not the world we live in.
  • whilenot-dev 5mo ago
    That's where I put a lot of hope into LLMs, as this is all about natural language that is difficult to parse. It'd be great if LLMs could accelerate enforcements in the digital world, so single individuals with valid claims can finally be heard.
  • AlexanderHanff 5mo ago
    You are making assumptions, I have a very good relationship with the Norwegian DPA and discussed the case with them several times over the past 4 years.
• d--b 5mo ago
  Idk about that particular company but the benefit of cheating may be much higher than the 1.8m fine they got. I personally never specifically consent to anything, yet get a ton of marketing emails. To most companies that send me those emails 1.8m would be a slap on the wrist.
  • AlexanderHanff 5mo ago
    It is not just the fine - they are no longer permitted to conduct the processing activities - so no they don't continue to profit from it, one of the reasons the fine was reduced was specifically because they made changes to bring themselves into compliance during the investigation. This is stated in the Regulator's press release directly.
• HeartStrings 5mo ago
  "Integritetsskyddsmyndighetensffsf" Bro, you alright?
• PeterStuer 5mo ago
  I'm sure I am wrong somewhere. But can someone explain to me how this same reasoning would not apply to every advertizing 'supported' business? You can't opt-out off ads on many websites or streaming services and still hsve access.
  • jjbinx007 5mo ago
    It's my understanding that those websites are in violation of the gdpr for doing so.
  • anygivnthursday 5mo ago
    On most platforms you can usually opt out of targeted/personalized ads that require tracking or collecting personal data, if you do you still get general ads, but that isnt subject to GDPR if they dont use your data for it, I guess.
  • buzer 5mo ago
    It's called "pay-or-okay" and there hasn't been many decisions on it yet which has led noyb to sue German DPAs: https://noyb.eu/en/years-inactivity-pay-or-ok-cases-noyb-sues-german-dpas https://noyb.eu/en/years-inactivity-pay-or-ok-cases-noyb-sue... There is one case where DPA ruled in favor of the company, but it's currently being appealed: https://noyb.eu/en/pay-or-ok-der-spiegel-noyb-sues-hamburg-dpa https://noyb.eu/en/pay-or-ok-der-spiegel-noyb-sues-hamburg-d... Another one ruled against company and court agreed: https://noyb.eu/en/court-decides-pay-or-okay-derstandardat-illegal https://noyb.eu/en/court-decides-pay-or-okay-derstandardat-i...
  • mrweasel 5mo ago
    It's not the ads that are the problem, it's the tracking. If you install something like Privacy Badger it will block all tracking, but not necessarily ads. However, because so many of the ads come bundled with a shit ton of tracking, they are effectively blocked. There's nothing problematic about having Stihl advertise chainsaws on a page for lumberjack. There is a problem when you collect data from across the internet, conclude that a person might be a lumberjack and serve the chainsaw ads based on that information on a news site. Sadly the advertising industry is mostly dead, at least online. We're left with online marketing experts that are basically just clicking around in Google and Meta ad-management interfaces. They know nothing about the sites or content, nor do they care. The magical box will find the customers... and if it gets it wrong, no worries, it wasn't their money anyway and you can always just go "Well, advertising isn't an exact science, some of your spending was always going to be wasted, you just don't know which part". Now we're left with an online advertising industry that can't tell advertising and tracking apart, and it doesn't have the skills or the network to go directly to sites and buy ad-space.
• fifilura 5mo ago
  I am a EU citizen, I bought a (Chinese) robotic lawn mower. One day, end of April when the grass is growing very rapidly, they presented me with a dialog in the app that basically said. "We updated the EULA with the explanation "optimized wordings". Please accept." There was no reference to the new or old EULA, and if I didn't accept I could not start the app and use my new mower. It was bricked. I am now checking their compliance with GDPR. It is a tedious process because they keep stalling, but I still feel I have all the rights. And I get a lot of help from chatgpt who works as a patient secretary that translates my "f-fck sake give me my stuff" into formal/friendly legalese with counter questions designed to be difficult to duck. As of now, 2 months later, they have finally pointed me to "download personal data" in the application which gives me back a PDF with mower model, my email address and some push notification history. But I know they store much more than that. And I think they know that I know. If nothing else my customer support history. But also for example a map of my garden.
  • actionfromafar 5mo ago
    Sounds like a clear case.
    • fifilura 5mo ago
      Yeah, doesn't always help of course. But EU countries have authorities for this that helps filing issues they find legitimate. e.g. https://www.imy.se/en/news/administrative-fee-against-spotify/ https://www.imy.se/en/news/administrative-fee-against-spotif... But also the Norwegian twin mentioned in TFA. As of now I am mostly collecting data to probe their compliance.
• VBprogrammer 5mo ago
  I've often wondered what basis companies are using for the "opt-in to tracking or pay to opt out model". It has spread now to even fairly reputable organisations. This, at least to my understanding, runs contrary to the spirit of the GDPR regulations. Permission has to be freely given which, when the alternative is paying a subscription, it quite obviously isn't.
  • roelschroeven 5mo ago
    The only basis they have is the low chance of enforcement. It is absolutely contrary not only to the spirit but also the letter of the law.
    • VBprogrammer 5mo ago
      I have a vague memory of there being some case law or interpretation here. But certainly doesn't bare much resemblance to what the original law makers had in mind.
• 3vo-ai 5mo ago
  [flagged]
• infinite_spin 5mo ago
  I would like to see these regulations in place here. I have always felt very uncomfortable with companies like TurnItIn.com getting to train their models off of my work, without compensation, where my consent is assumed and there is no opt-out. I've brought this up before, and the general consensus was that my college enrollment is optional, and therefore my consent is freely given. I should have a right to attend a school I pay for and qualified for, without requiring me to give up other rights.
  • lixtra 5mo ago
    Hand in your paper when you’re on vacation or even better on a conference in Europe. GDPR will apply. Of course it will take so long that you won’t benefit from a decision for your studies. And one possible outcome is that your college won’t allow submitting from EU and won’t admit EU citizens (similar to US citizens having difficulties opening accounts in EU banks).
    • deleted 5mo ago
      [deleted]
• pembrook 5mo ago
  Thankfully inbox providers are now mandating unsubscribe headers (so the unsubscribe button now sits at email client level, not within the body of the email, as it always should have). Making this entire thing irrelevant. Going through the hassle of policing individual company behavior is beyond silly and a giant waste of resources when you can literally just force the behavior at client level. This is also basically the story of why GDPR popups are stupid. Set it at the client (browser) level, not on 100,000,000 individual websites done slightly differently every time and try to setup an enforcement dragnet to have expensive fights over misplaced commas. This should have always been a browser setting and not a multi-billion dollar Kafka-esque nightmare of lawyers and regulators policing every company on earth, wasting Europe's productivity and resources. It's like how the US makes you file your own taxes when for 99% of people they already know the amount you owe, and then randomly will decide to fine you if your calculated number doesn't line up with their number. It's giant waste of everyones time.
• abc123abc123 5mo ago
  5 years?! That's a f*cking joke. Democracy and rule of law does not exist any longer. The politicians get richer, no one challenges them, they pass their offices down within their family, taxes get higher and higher, and services worse and worse. On the other hand, it is fascinating to be able to watch the destruction of europe and western democracy while it is happening! I imagine that this painful slide is what must have happened during the end of the roman empire. Now we're seeing the end of the european/US empire.
• Someone 5mo ago
  FTA: The reply I received a few days later did me the favour of putting the violation on the record. Their position, in their own words, was that "in order to receive marketing / offers, it is a condition to be a member of the customer club." I don’t see how that implies “if you’re a member of the club, you must receive marketing / offers”. It only says “only members receive marketing / offers”
• crest 5mo ago
  Fuck them with a rusty chainsaw dipped in manure.