AlexanderHanff

I wrote this 5 years ago, hopefully it will clear up some of the misconceptions around cookie banners:

https://www.linkedin.com/pulse/truth-behind-cookie-banners-a...

Absolute nonsense. Any company that was complying with the old Data Protection Directive should have had zero issues upgrading their processes and policies to comply with GDPR there are very few material differences between the two and the previous law existed since 1995 - most of the changes are around accountability (record keeping).

Also cookies literally have nothing to do with GDPR other than the definition of consent - Cookies are governed under and entirely different law which has existed since 2002 (Directive 2002/58/EC).

It bugs me when I see people criticising the law when they actually havent even bothered to research and understand it or even look at the correct law.

It can be appealed but because it is cross border it has to be appealed directly at the Oslo Court (rather than the privacy claims board) and also the fact they had the fine reduced for co-operation usually includes a clause that they will not appeal (otherwise they lose the discount which is normally around 30%).

It is not just the fine - they are no longer permitted to conduct the processing activities - so no they don't continue to profit from it, one of the reasons the fine was reduced was specifically because they made changes to bring themselves into compliance during the investigation. This is stated in the Regulator's press release directly.

You are making assumptions, I have a very good relationship with the Norwegian DPA and discussed the case with them several times over the past 4 years.

Well John Edwards just resigned yesterday so maybe you will get a real Commissioner this time - although that said, John was hired specifically as someone who would do nothing, so I guess he did what he was paid to do.

He has largely been ostracised by the privacy and data protection community (even at regulatory events) I have seen him wandering around alone and aimlessly at a number of regulatory events, he didn't seem very comfortable and didn't really have a lot of interaction with his peers.

There are currently 22 US States with comprehensive privacy laws with Louisiana being the latest (their Governor signed just last week iirc) and the 23rd is literally a Governor's signature away (just passed the state senate).

The fine is largely irrelevant, now they have faced enforcement we have a decision to file a Representative Actions Directive (equivalent of a US class action) claim with - the cost of that will be 100-1000x more than the fine and will likely lead to shareholder revolt as well (institutional shareholders will likely sue the parent Currys PLC for breach of fiduciary duty and not disclosing these issues during earnings calls and annual reports.)

So the fine is the first step to a much wider legal action.

The fine also puts other loyalty clubs on notice that if they do this, they are going to face consequences - so it has a much wider impact than simply monetary.

It was not their responsibility to keep me informed, it was the responsibility of IMY (the Swedish Regulator) to keep me informed.

If you click the image, it flips to reveal the prompt and other metadata.

The blog is running on a Mac Mini on a 1Gb/s uplink so when it gets hit with a front page HN post, it does creak a little but I try to be environmentally responsible with my technology (as much as possible) so I am not in a hurry to move it into a datacentre when currently it only pulls 15-25W from the wall during peak traffic.

I have had several direct discussion with the Norwegian DPA throughout the case, the inspection and investigation were triggered by the IMY cross border case and I have not "sued" the regulator (neither do I say I have) I have filed a complaint against IMY (the Swedish Regulator) for failure to meet their legal obligations under Article 77(2) but then I have already had to file multiple legal complaints against IMY because they are an absolutely terrible supervisory authority that do literally nothing (they send out postcards to Data Controllers for violations saying "Hey do you know what GDPR is?").

So no, I have not sued the Norwegian DPA and actually have a very good relationship with them along with most of the other EU DPAs (I am an advisor to them, I sit in the pool of experts for law and new technologies at the EDPB which includes ALL EU data protection authorities).

You might well think it is reasonable, but the law doesn't permit this, it is explicit that the person has an absolute right not to be subjected to direct marketing activities (Article 21 of the GDPR) and Article 5 of the GDPR requires that any processing of personal data must comply with all other relevant laws in order to be lawful under the GDPR - ePrivacy Directive (Article 13) governs Direct Marketing in the EU and requires consent - but that consent must meet the requirements of Article 7 under the GDPR in order to be valid (freely given) and any consent which is bundled and is a condition of access to a service where such processing is not necessary to provide that service - is not considered as freely given.

This is not new, we have a lot of case law and regulatory guidance on this.

It is a translation thing - what they said in Norwegian was that it is required to accept marketing activities if you want to be part of the loyalty club - but the machine translation did it literally instead of changing the structure to match common English.

That simply isn't possible - you might like to think you read everything but research has shown that simply reading the terms and conditions of the top 100 websites amounts to a colossal amount of time (if you look at Prof. Lorie Cranor's research on this from around 2008, even back then the cost to the US in lost time was to the tune of trillions of dollars - now, they are much much worse than they were 18 years ago.

The terms and conditions for Tetris on Android were longer than the entire works of Tolkien when combined.

So yes, it would be nice to read all of these things, but we simply do not have the time available to do so.

Which is exactly the point - under Article 21 of the GDPR every person has a legal right not to be subjected to direct marketing so any forced direct marketing is unlawful and consent cannot be bundled (it must be specific under the GDPR) so bundling consent to direct marketing along with consent to join the Club is not lawful.

Which is why my next step is litigation.

In my latest article I discuss the legal issues spanning Privacy, Data Protection, Consumer Protection, Unfair Contract Terms and the EU's Environmental Crime Directive with Amazon's "Familiar Faces" feature in high end Ring devices and subscriptions.

Amazon could have done this the right way - but they decided to do it the wrong way and now will likely face the legal consequences.

My apologies I wasnt aware, I just had an email in my inbox this morning alerting me to the Reddit post so decided to write up a followup article and given the interest in the topic here, wanted to post the update.

That said, i do go in to more legal woes that this creates for Google, so there is some important information in the new article and I have already passed this on to 2 State AGs I am connected to.

It seems that Google have decided it was not enough to breach the GDPR, ePrivacy Directive and Crminal Statutes relating to unauthorised access and use of computing devices - they have now decided to open themselves up to Consumer Protection regulations and the FTC Act... I have already passed this on to 2 State AGs

I am a computer scientist and have studied AI for over 30 years, I use AI every single day and I speak all over the world about the responsible and ethical use of AI... not sure how that makes me anti-ai?

I am a privacy activist and I strongly object to corporations reaching in to my device, changing the configuration and installing things I never asked for without telling me or requesting my permission. If that makes me anti-ai, then it is a hat I will wear with pride, thanks.

If you don't like that the law protects my position as opposed to your's, perhaps you could lobby to have the law changed, just as I have done for the last 20 years to make these laws stronger?

First of all I want to thank you for your intelligent and reasoned post. As the author of the article in question, I have been mostly shocked at how many people are excusing this behaviour and playing Google Apologist.

Now to answer your question on the remedies. I didn't put them in this article because I covered them in another article that went viral a week or so earlier (the first reference in the Google article). The Google article was already a long read, I didn't want to repeat information I had already posted elsewhere.

As for my actions - well I will take the same actions I took against Anthropic.

I am currently preparing two legal complaints:

The first is under the GDPR and ePrivacy Directive here in the EU and will be sent to the IDPC (Information and Data Protection Commissioner) who will then initiate a Cross Border investigation with the Irish Data Protection Commissioner (Google is "established" in Ireland for the purpose of GDPR) for the GDPR aspects and conduct their own investigation on the ePrivacy violations.

The second will be a criminal complaint against Google under Chapter 9 of the Maltese Criminal Code for alteration of the configuration of my device (Google remotely flipped a profile flag to enable the download which I witnessed in real time and have logs for) and for unauthorised access and use of my computer (to download and redownload the model) under computer misuse and access statutes (think CFAA in the US and how it was used against Aaron Swartz if you are looking for a way to file a criminal complaint against Google for this - the arguments used against Swartz are just as applicable to Google here).

So again, thanks for the post, it was nice to read someone actually understanding (unlike Reddit where it seems they do anything but read what they are talking about despite being called Reddit).

I also want to take this opportunity to thank everyone else in this thread for their time and comments and to YC for hosting the discussion.

Also my apologies for the 503's some people got yesterday (and thanks for posting mirrors) my blog runs on my home server and I had the rate limit set too low (I increased it once I saw the messages on here and it seemed to have fixed it).

Now that said - wait until you see what I am publishing next week (the project I was working on when I discovered this), it makes this look like child's play...