After two years coming down the pipe at tech giants, Europe’s new privacy framework, the General Data Protection Regulation( GDPR ), is now being applied — and long time Facebook privacy critic, Max Schrems, has wasted no time in filing four grievances relating to( certain) companies” take it or leave it’ posture when it comes to consent.
The complaints have been filed on behalf of( unnamed) individual users — with one filed against Facebook; one against Facebook-owned Instagram; one against Facebook-owned WhatsApp; and one against Google’s Android.
Schrems argues that the companies are using a strategy of” forced consent” to continue processing the individuals’ personal data — when in fact the law requires that users be given a free choice unless a consent is strictly necessary for provision of the service.( And, well, Facebook claims its core product is social networking — rather than farming people’s personal data for ad targeting .)
” It’s simple: Anything strictly necessary for a service does not require consent boxes anymore. For everything else users must have a real option to tell’ yes’ or’ no’ ,” Schrems writes in a statement.
” Facebook has even blocked accounts of users who have not given consent ,” he adds.” In the end users merely had the choice to delete the account or hit the “agree”-button — that’s not a free choice, it more reminds of a North Korean election process .”
We’ve reached out to all the companies involved for comment and will update this story with any response. Update: Facebook has now sent the following statement, attributed to its chief privacy policeman, Erin Egan:” We have prepared for the past 18 months to ensure we gratify the requirements of the GDPR. We have induced our policies clearer, our privacy decideds easier to find and introduced better tools for people to access, download, and delete their datum. Our work to improve people’s privacy doesn’t stop on May 25 th. For example, we’re building Clear History: a way for everyone to see the websites and apps that send us datum when you use them, clear this information from your account, and turn off our ability to store it associated with your account going forward .”
Schrems most recently founded a not-for-profit digital rights organization to focus on strategic litigation around the bloc’s updated privacy framework, and the complaints have been filed via this crowdfunded NGO — which is called noyb( aka’ none of your business ‘).
As we pointed out in our GDPR explainer, the provision in the regulation may be required for collective enforcement of individuals’ data rights is an important one, with the health risks to strengthen the implementation of the law by enabling non-profit organisations such as noyb to file complaints on behalf of individuals — thereby helping to redress the power imbalance between corporate giants and consumer rights.
That told, the GDPR’s collective redress provision is a component that Member Country can choose to derogate from, which helps explain why the first four complaints have been filed with data protection bureaux in Austria, Belgium, France and Hamburg in Germany — regions that also have data protection agencies with a strong record of defending privacy rights.
Given that the Facebook companies involved in these complaints have their European headquarters in Ireland it’s likely the Irish data protection bureau will get involved too. And it’s fair to say that, within Europe, Ireland does not have a strong reputation as a data protection rights champion.
But the GDPR allows for DPAs in different jurisdictions to work together in instances where they have joint subjects of concern and where a service crosses perimeters — so noyb’s action seems are aiming to exam this element of the new framework too.
Under the penalty structure of GDPR, major violations of the law can attract penalties as large as 4% of a company’s global revenue which, in the case of Facebook or Google, connotes they could be on the hook for more than a billion euros apiece — if they are deemed to have violated the law, as the complaints argue.
That told, devoted how freshly fixed in place the regulation is, some EU regulators may well tread softly on the enforcement front — at least in the first instances, to give companies some benefit of the doubt and/ or a chance to make amends to come into compliance if they are deemed to be falling short of the new standards.
However, in instances where companies themselves appear to be attempting to deform the law with a willfully self-serving interpretation of the rules, regulators may feel they need to act swiftly to nip any disingenuousness in the bud.
” We likely will not immediately have billions of penalty payments, but the corporations have intentionally contravened the GDPR, so we expect a corresponding penalty under GDPR ,” writes Schrems.
Only yesterday, for example, Facebook founder Mark Zuckerberg — speaking in an on stage interview at the VivaTech conference in Paris — claimed his company hasn’t had to make any radical changes to comply with GDPR, and further claimed that a “vast majority” of Facebook users are willingly opting in to targeted advertising via its new permission flow.
” We’ve been rolling out the GDPR flows for a number of weeks now in order to make sure that we were doing this in a good way and that we could take into account everyone’s feedback before the May 25 deadline. And one of the things that I’ve found interesting is that the great majority of people choose to opt in to make it so that we can use the data from other apps and websites that they’re using to make ads better. Because the reality is if you’re willing to see ads in a service you want them to be relevant and good ads ,” said Zuckerberg.
He did not mention that the dominant social network does not offer people a free choice on accepting or declining targeted advertising. The new permission flow Facebook uncovered ahead of GDPR only offers the’ choice’ of ceasing Facebook solely if a person does not want to accept targeting advertising. Which, well, isn’t much of a option dedicated how powerful the network is.( Additionally, it’s worth pointing out that Facebook continues tracking non-users — so even deleting a Facebook account does not guarantee that Facebook will stop processing your personal data .)
Asked about how Facebook’s business model will be affected by the new rules, Zuckerberg essentially claimed nothing significant will change –” because dedicating people control of how their data is employed has been a core principle of Facebook since the beginning “.
” The GDPR adds some new controls and then there’s some areas that we need to comply with but overall it isn’t such a massive departure from how we’ve approached this in the past ,” he claimed.” I mean I don’t want to downplay it — there are strong new rules that we’ve needed to set a bunch of work into making sure that we complied with — but as a whole the philosophy behind this is not completely different from how we’ve approached things.
” In order to be able to give people the tools to connect in all the ways they want and build community a lot of doctrine that is encoded in a regulation like GDPR is really how we’ve was just thinking about all this stuff for a long time. So I don’t want to understate the areas where there are new rules that we’ve had to go and enforce but I also don’t want to make it seem like this is a massive deviation in how we’ve was just thinking about this stuff .”
Zuckerberg faced a range of tough questions on these points from the EU parliament earlier this week. But he avoided answering them in any meaningful detail.
So EU regulators are essentially facing a first exam of their mettle — i.e. whether they are willing to step up and defend the line of the law against big tech’s attempts to reshape it in their business model’s image.
Privacy statutes are nothing new in Europe but robust enforcement of them would certainly be a breath of fresh air. And now at the least, thanks to GDPR, there’s a penalties structure in place to provide incentives as well as teeth, and spin up a market around strategic litigation — with Schrems and noyb in the vanguard.
Schrems also stimulates the point that small startups and local companies are less likely to be able to use the kind of strong-arm’ take it or leave it’ tactics on users that big tech is able to unilaterally apply and extract’ consent’ as a consequence of the reach and power of their platforms — arguing there’s an underlying competition concern that GDPR has the potential to help to redress.
” The fight against forced consent ensures that the corporations cannot force users to consent ,” he writes.” This is especially important so that monopolies have no advantage over small and medium-sized companies .”