buzer

Looks like what I remembered was a bug.

> In addition, with Facebook it cannot be ruled out that placed photos may be distributed and may end up in the hands of third parties.

So court considered just that possibility as one of the aspects which led to household exemption being unavailable.

> What you're saying sounds insane. You're saying that a person taking a photo/video in public -- EVERY person doing so -- has to identify EVERY person in the photo/video, and inform EVERYONE of their rights, etc.... if they upload it to YouTube or Flickr?

They do not need to identify them, but they need to provide the sufficient Article 13 notice. That could be, for example, sufficiently clear sign that they wear. You can check C‑422/24 for what CJEU said about body worn cameras. One of the important points court highlighted is:

> If it were accepted that Article 14 of the GDPR applies where personal data are collected by means of a body camera, the data subject would not receive any information at the time of collection, even though he or she is the source of those data, which would allow the controller not to provide information to that data subject immediately. Therefore, such an interpretation would carry the risk of the collection of personal data escaping the knowledge of the data subject and giving rise to hidden surveillance practices.

And regarding:

> If the law were applied like you say it is, the only legal filming in public would be to CLOSE the area to the public and have no members of the public in public. Like a film set, where the only passers-by are paid extras who signed a release. That's completely untenable.

It can be legal to film in public, but it either requires using the derogations and applicable Member State laws (like artistic expression exemption) or making sure you actually give that Article 13 notice. Or truly just use it for household use.

Of course these things are not normally enforced unless someone actually files a complaint.

[EDIT] since I forgot to address this point

> My understanding is that when videos are uploaded to YouTube, the fact Google is publishing it makes Google the data processor, and Google's duties are fulfilled by not seeking to identify the people in the video, but offering them their rights nonetheless should the data subject be able to identify themselves.

Processing is evaluated per processing operation. YouTube itself is controller for many of these. These could, for example, include actually surfacing the video via algorithm. The important decisions here are C‑492/23 from last year and C-188/24 from this year.

For example CCTVs that point to public street are not within household exemption scope even if you are only doing it personal protection.

In the context of this app the video was taken and posted to YouTube for everyone to see. So it would no longer be within household exemption -> the original author would have needed to fulfill their GDPR obligations.

And in regards to Article 11, that does not give exemption for Article 13/14, only for 15-20.

Platforms tend to rely on Article 14(5)(b), but I don't think that it would often hold up if challenged. CJEU puts a lot weight on Article 13/14 since they the primary ways for data subject to even find out about the processing. And if they don't find out the processing they cannot effectively exercise their other rights.

Basically the only exceptions to this come from Article 23 (which is unlikely to apply) and Article 85. Article 85 covers "journalistic purposes or the purpose of academic artistic or literary expression", but it requires separate law in Member State and these then set out the requirements what actually qualifies under it. The standards for that tend to be much stricter than US' First Amendment (which allows essentially anyone to say that they are press).

In Finland prosecutors are not involved in most of the illegal things, they are only involved in criminal matters (and in some cases civil compensation claims which are linked to criminal case). Various regulators/authorities are the ones who enforce civil side.

In many cases the penalties that law allows those to authorities to issue are limited to ordering to stop doing that illegal thing, reprimands and conditional fines ("if you don't stop you need to pay fine"). Straight up fines tend to be more uncommon (unless individual is doing it, then fines tend to be very common). Targets of these can then file appeal in administrative court and usually behavior is allowed to continue while case is appealed (see e.g. various GDPR/ePD cases).

This is assuming the CT logs no longer issue SCTs for these CAs. If they do then you just need to the CT dance and publish that certificate there.

Of course this assumes the app/device isn't using certificate pinning.

One issue might be that from what I understand Android itself also enforces CT, but it has fail-open design if it cannot obtain the updated list of qualified CT operators for 70 days. So you would need to block the access to that endpoint.

This is assuming the CT logs will stop/stopped actually giving SCTs for those CAs.

That's what I noticed anyway, not a car or photo guy either.

Someone should make a complaint about ePD violation in relation to those. I doubt it's "strictly necessary" for those applications to read that information (if they even fulfill the "at distance" requirement).

It does. The current version says "storing of information, or the gaining of access to information already stored, in the terminal equipment". Reading e.g. navigator.userAgent is information already stored in the terminal equipment. If you then use that in any way that gets communicated to remote server (e.g. directly or calculating some fingerprint) you read that information in manner ePD describes.

The directive itself has been transposed incorrectly in many jurisdictions. For example from what I understand the Dutch law added an exception (roughly "for obtaining information about the quality or effectiveness of a supplied information-society service, provided this has no or only minor consequences for the user's privacy.") which is not permitted under ePD. ePD exception list is exhaustive and the only other exception can be done via Article 15. The exceptions done via that are related to things like national security and certain criminal prevention/investigation.

Of course that then raises the issue on how you get invalid exception invalidated. I don't know Dutch procedural law well enough to answer that.

Generally speaking JS code that makes request to server is covered by ePD while actually processing that request server side is covered by GDPR (there are some nuances to this).

It also limits the exception in relation to e.g. employment.

Honestly all these kinds of laws should take an example out of EU261 (the flight compensation regulation) book. Set statutory damages and allow private right of action. Air carriers certainly have started to follow law much harder than many other industries after people realized they could fairly easily get compensation when carriers didn't fulfill their obligations.

Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.

Of course there is also the GDPR layer on top of this.

I don't think you could get out of stalking charge by just being so good at stalking that person affected didn't detect it, assuming you get detected at some point for some reason.

This actually changed this year. Applicant gets 1-4 tickets depending on their pay relative to job/area. So $500k Google engineer has quite a bit higher chance than $100k WiPro one.

Of course it still has issues (Google probably has 1-2 possible applicants for that position and would prefer all of them, Wipro has 100 and cares more about what % of them pass).

> Specifically, the department’s investigation found that Apple did not advertise positions Apple sought to fill through the PERM program on its external job website, even though its standard practice was to post other job positions on this website. It also required all PERM position applicants to mail paper applications, even though the company permitted electronic applications for other positions.

Of course court itself could have arrived in different result.

Of course to enforce it you would need to complain to regulator in your country who then likely just tells them to stop it and that decision becomes effective years later after appeals. Many countries don't even fines for ePD violations.