INSERT INTO `wp_posts` (`ID`, `post_author`, `post_date`, `post_date_gmt`, `post_content`, `post_title`, `post_excerpt`, `post_status`, `comment_status`, `ping_status`, `post_password`, `post_name`, `to_ping`, `pinged`, `post_modified`, `post_modified_gmt`, `post_content_filtered`, `post_parent`, `guid`, `menu_order`, `post_type`, `post_mime_type`, `comment_count`) VALUES (2146,1,'2021-07-31 10:26:20','2021-07-31 10:26:20','<!-- wp:paragraph -->\n<p>Réclamation contre<br>Amazon Europe<br>Réclamation introduite :<br>Par La Quadrature du Net, située au 60 rue des Orteaux, 75020<br>Paris, France ;<br>Contre Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL et Amazon Media EU SARL, situés au 5 rue Plaetis, L -2338 Luxembourg et Amazon Video Limited située 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci-après désignés<br>ensembles « Amazon »), en tant que responsables du traitement des<br>données personnelles traitées via les Services Amazon.<br>Une copie de la présente réclamation est accessible en ligne sur :<br>https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Procédure</li><li>L\'article 77, §1, du règlement 2016/679 du Parlement européen et du<br>Conseil de l\'Union Européenne, relatif à la protection des personnes<br>physiques à l\'égard du traitement des données à caractère personnel et<br>à la libre circulation de ces données, ci-après désigné « règlement général sur la protection des données » ou « RGPD », prévoit que « toute<br>personne concernée a le droit d\'introduire une réclamation auprès<br>d\'une autorité de contrôle, en particulier dans l\'État membre dans lequel se trouve sa résidence habituelle, son lieu de travail ou le lieu où<br>la violation aurait été commise, si elle considère que le traitement de<br>données à caractère personnel la concernant constitue une violation<br>du présent règlement »</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>L\'article 80, §1, du RGPD prévoit que « la personne concernée a le<br>droit de mandater un organisme, une organisation ou une association à but non lucratif, qui a été valablement constitué conformément<br>au droit d\'un État membre, dont les objectifs statutaires sont d\'intérêt<br>public et est actif dans le domaine de la protection des droits et libertés des personnes concernées dans le cadre de la protection des données à caractère personnel les concernant, pour qu\'il introduise une réclamation en son nom, exerce en son nom les droits visés aux articles<br>77, 78 et 79 et exerce en son nom le droit d\'obtenir réparation visé à<br>l\'article 82 lorsque le droit d\'un État membre le prévoit ».</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":3} -->\n<ol start=\"3\"><li>La Quadrature du Net est une association de loi 1901 déclarée en<br>préfecture le 5 février 2013. Elle prévoit dans ses statuts que « l’Association a pour objet désintéressé et non lucratif », notamment, « l’encouragement de l\'autonomie des usagers et leur prise de contrôle sur<br>les données les concernant » ainsi que « la défense des intérêts sociaux, culturels, d\'innovation et de développement humain des citoyens »1<br>.</li><li>Du 16 avril au 27 mai 2018, en application de l\'article 80 du RGPD, La<br>Quadrature du Net a invité tout individu résidant en France à la<br>mandater via son site https://gafam.laquadrature.net pour qu\'elle<br>exerce, en son nom, les droits que lui confère l\'article 77 du RGPD,<br>afin d\'introduire la présente réclamation devant la Commission<br>Nationale de l\'Informatique et des Libertés (CNIL).</li><li>10 065 personnes, se déclarant utiliser les services Amazon, ont mandaté La Quadrature du Net pour ce faire (la liste de leur nom est jointe<br>en Annexe II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Griefs</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":6} -->\n<ol start=\"6\"><li>Il est fait grief à Amazon d\'annoncer réaliser certains traitements de<br>données personnelles concernant les personnes au nom desquelles la<br>présente réclamation est introduite (2.2) sans toutefois fonder ces traitements sur l\'une des bases légales exigées par la loi (2.1), rendant<br>dès lors ceux-ci illicites (2.3).<br>2.1. Bases légales exigées par le RGPD</li><li>L\'article 6, §1, du RGPD liste les six cas dans lesquels des données personnelles peuvent être légalement traitées. Trois de ces six cas sont : le<br>consentement de la personne concernée (2.1.1), l\'exécution d\'un<br>contrat avec la personne concernée (2.1.2) ; l\'intérêt légitime du responsable de traitement ou d\'un tiers (2.1.3).<br>2.1.1. Consentement</li><li>L\'article 6, §1, a, du RGPD prévoit qu\'un traitement peut être licite si<br>« la personne concernée a consenti au traitement de ses données à caractère personnel pour une ou plusieurs finalités spécifiques ».</li><li>Pour être valide, ce consentement doit être donné de façon explicite<br>et libre et demandé de façon loyale.<br>2.1.1.1. Consentement explicite</li><li>L\'article 4, §11, du RGPD exige que, pour être valide, le consentement<br>soit une « manifestation de volonté » exprimée « par une déclaration<br>ou par un acte positif clair ».</li><li>Le considérant 32 du RGPD précise que, le consentement étant un<br>« acte positif », « il ne saurait dès lors y avoir de consentement en cas<br>de silence, de cases cochées par défaut ou d\'inactivité ».<br>3/19</li><li>Le « groupe de l\'article 29 » (G29) a précisé le sens de ces dispositions dans ses lignes directrices sur la notion de consentement dans le<br>RGPD, adoptées le 10 avril 2018 (lignes directrices WP2592<br>).</li><li>Il indique que « le RGPD n\'autorise pas les responsables de traitement<br>à prévoir des cases pré-cochées ou des mécanismes d\'opt-out qui demandent à la personne concernée d’intervenir pour empêcher l’accord »<br>3<br>.</li><li>Le G29 ajoute que « le simple fait de poursuivre l’utilisation ordinaire<br>d’un site internet n\'est pas un comportement dont on peut déduire<br>une manifestation de volonté exprimant un accord au traitement proposé »4<br>.<br>2.1.1.2. Consentement libre</li><li>L\'article 4, §11, du RGPD exige que, pour être valide, le consentement<br>soit une « manifestation de volonté, libre, spécifique, éclairée et univoque ».</li><li>L\'article 7, §4, du RGPD précise que, « au moment de déterminer si le<br>consentement est donné librement, il y a lieu de tenir le plus grand<br>compte de la question de savoir, entre autres, si l\'exécution d\'un<br>contrat, y compris la fourniture d\'un service, est subordonnée au<br>consentement au traitement de données à caractère personnel qui<br>n\'est pas nécessaire à l\'exécution dudit contrat ».</li><li>Le considérant 42 du RGPD précise que « le consentement ne devrait<br>pas être considéré comme ayant été donné librement si la personne<br>2 Les lignes directrices WP259 du G29 son disponibles sur :<br>http://ec.europa.eu/newsroom/article29/document.cfm?<br>action=display&amp;doc_id=51030<br>3 p. 16, traduction libre de « the GDPR does not allow controllers to offer pre-ticked<br>boxes or opt-out constructions that require an intervention from the data subject to<br>prevent agreement ».<br>4 p. 17, traduction libre de « merely continuing the ordinary use of a website is not<br>conduct from which one can infer an indication of wishes by the data subject to signify<br>his or her agreement to a proposed processing operation ».</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>concernée ne dispose pas d\'une véritable liberté de choix ou n\'est pas<br>en mesure de refuser ou de retirer son consentement sans subir de<br>préjudice ».</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":18} -->\n<ol start=\"18\"><li>Dans le même sens, le considérant 43 du RGPD prévoit que « le<br>consentement est présumé ne pas avoir été donné librement si un<br>consentement distinct ne peut pas être donné à différentes opérations<br>de traitement des données à caractère personnel bien que cela soit approprié dans le cas d\'espèce, ou si l\'exécution d\'un contrat, y compris<br>la prestation d\'un service, est subordonnée au consentement même<br>si celui-ci n\'est pas nécessaire à une telle exécution ».</li><li>Le G29 a clairement précisé le sens de ces dispositions dans ses lignes<br>directrices (WP259, précitées), expliquant que « le RGPD prévoit que<br>si la personne concernée n\'a pas un véritable choix, se sent contrainte<br>de consentir ou subira des conséquences négatives si elle ne consent<br>pas, alors son consentement n\'est pas valide »5<br>.</li><li>Parmi les conséquences négatives que le refus de consentir ne doit pas<br>causer, le G29 vise le cas où « l\'utilisation d\'un service serait détériorée au détriment de l\'utilisateur »6<br>. Il donne comme exemple<br>concret une application mobile à laquelle l\'utilisateur refuserait de<br>donner accès à l’accéléromètre du téléphone (pour des raisons d\'analyse comportementale) et qui, pour cette raison, ne fonctionnerait plus<br>que de façon limitée (voir l\'exemple 8, donné p.11). Pour le G29, il<br>s\'agirait d\'une conséquence négative incompatible avec l\'obtention<br>d\'un consentement libre.</li><li>De façon générale, le G29 résume ces exigences en expliquant que « le<br>RGPD garantit que le traitement de données personnelles pour lequel<br>5 p.5, traduction libre de « the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not<br>consent, then consent will not be valid »<br>6 p. 11, traduction libre de « the performance of the service being downgraded to the<br>detriment of the user »<br>5/19<br>le consentement est demandé ne peut pas devenir, directement ou indirectement, la contrepartie d\'un contrat »7<br>.</li><li>Cette interprétation est d’ailleurs conforme à la volonté que le Parlement européen a clairement exprimée récemment, par deux fois :<br>• « Nul utilisateur ne peut se voir refuser l’accès à un service […]<br>au motif qu’il n’a pas consenti […] à un traitement de ses données<br>à caractère personnel […] non nécessaire à la fourniture du service. » (article 8, §1 bis, de la version du règlement « ePrivacy »<br>adoptée le 23 octobre 2017) ;<br>• Il ne faut pas que le droit européen « légitimise ou encourage une<br>pratique consistant à monétiser les données à caractère personnel,<br>celles-ci ne pouvant être comparées à un prix, ni considérées<br>comme une marchandise » (considérant 13 de la version de la directive « contenus numériques » adoptée le 21 novembre 2017).</li><li>Enfin, il doit être souligné que ces exigences existaient déjà dans le<br>droit antérieur au RGPD, ce dernier s\'étant ici contenté de codifier. Par<br>exemple, en France, le 18 décembre 2017, la CNIL a annoncé mettre<br>Whatsapp en demeure d\'arrêter de transmettre à Facebook diverses<br>données sur ses utilisateurs, au motif que cette transmission se fondait<br>sur un consentement non-libre des utilisateurs, car « le refus de la personne concernée de donner son consentement à la transmission de ses<br>données s’accompagne nécessairement d’une conséquence négative<br>importante puisqu’elle sera contrainte de supprimer son compte et ne<br>pourra utiliser l’application WhatsApp »8<br>.<br>7 p. 8, traduction libre de « the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract ».<br>8 Décision n° MED-2017- 075 du 27 novembre 2017 mettant en demeure la société<br>WHATSAPP<br>6/19<br>2.1.1.3. Loyauté de la demande de consentement</li><li>L\'article 5, §1, a, du RGPD prévoit que « les données à caractère personnel doivent être […] traitées de manière licite, loyale et transparente au regard de la personne concernée ».</li><li>Le considérant 39 du RGPD précise que « le principe de transparence<br>exige que toute information et communication relatives au traitement<br>de ces données à caractère personnel soient aisément accessibles, faciles à comprendre, et formulées en des termes clairs et simples » et<br>que « les personnes physiques devraient être informées des risques,<br>règles, garanties et droits liés au traitement des données à caractère<br>personnel et des modalités d\'exercice de leurs droits en ce qui<br>concerne ce traitement ».</li><li>L\'article 7, §3, du RGPD prévoit que « la personne concernée a le droit<br>de retirer son consentement à tout moment » et, en application du<br>principe de loyauté et de transparence, que « la personne concernée<br>en est informée avant de donner son consentement ».</li><li>Dès lors, un traitement ne serait ni loyal ni transparent (ni donc licite)<br>s\'il se fondait sur le consentement de la personne concernée alors que,<br>dans le même temps, le responsable de traitement se laisserait l\'opportunité de fonder le traitement sur une autre base légale (par exemple,<br>pour anticiper le cas où la personne concernée retirerait son consentement). En effet, dans de telles circonstances, l\'information donnée à la<br>personne concernée quant au droit qu\'elle aurait de retirer son consentement serait parfaitement trompeuse : ce « droit » ne produirait juridiquement aucun effet, le traitement pouvant se fonder sur une autre<br>base légale.</li><li>Ainsi, un traitement de données personnelles ne peut jamais être licite<br>s\'il se fonde à la fois sur le consentement de la personne concernée<br>et sur une autre base légale, car ceci rendrait systématiquement<br>trompeuse l\'information obligatoirement donnée à la personne quant<br>au droit de retirer son consentement.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>C\'est bien la conclusion à laquelle est parvenu le G29, expliquant que,<br>« si un responsable de traitement choisit de fonder une partie du traitement sur le consentement, il doit être prêt à respecter ce choix et à<br>mettre fin à cette partie du traitement si un individu retire son consentement. Donner l\'impression que des données seront traitées sur la<br>base du consentement, alors qu\'elles le seront en fait sur une autre<br>base légale, serait fondamentalement déloyal pour les individus. Autrement dit, le responsable de traitement ne peut pas échanger le<br>consentement avec d\'autres bases légales. Par exemple, il n\'est pas<br>permis d\'utiliser rétrospectivement l\'intérêt légitime afin de justifier un<br>traitement lorsque des difficultés sont apparues concernant la validité<br>du consentement »9<br>(p.23 des lignes directrices WP259 précitées).<br>2.1.2. Contrat</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":30} -->\n<ol start=\"30\"><li>L\'article 6, §1, b, du RGPD prévoit qu\'un traitement peut être licite s\'il<br>« est nécessaire à l\'exécution d\'un contrat auquel la personne concernée est partie ».</li><li>Cette disposition reprend à l\'identique celle déjà prévue à l\'article 7, b,<br>de la directive 95/46/CE, que le RGPD a remplacée. Elle a ainsi déjà<br>été détaillée par le G29 dans son avis 06/2014, rendu le 25 novembre<br>201410, comme « devant être interprétée strictement et ne couvrant<br>pas des cas où le traitement ne serait pas véritablement nécessaire à<br>l\'exécution d\'un contrat, mais plutôt imposé unilatéralement à la personne concernée par le responsable de traitement »11<br>.<br>9 Traduction libre de « if a controller chooses to rely on consent for any part of the<br>processing, they must be prepared to respect that choice and stop that part of the<br>processing if an individual withdraws consent. Sending out the message that data will<br>be processed on the basis of consent, while actually some other lawful basis is relied on,<br>would be fundamentally unfair to individuals. In other words, the controller cannot<br>swap from consent to other lawful bases. For example, it is not allowed to<br>retrospectively utilise the legitimate interest basis in order to justify processing, where<br>problems have been encountered with the validity of consent ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf<br>8/19</li><li>Le G29 rajoutait que « le fait que certains traitements de données<br>soient couverts par un contrat ne signifie pas automatiquement que<br>ces traitements soient nécessaires à son exécution. Par exemple, l\'article 7, b, n\'est pas une base légale adaptée pour faire un profil des<br>goûts et modes de vie d’un utilisateur à partir de son parcours de navigation sur un site internet et des produits qu’il a achetés. En effet, le<br>contrat n’a pas été conclu pour réaliser un profil, mais pour fournir<br>certains biens ou certains services, par exemple. Quand bien même ces<br>traitements seraient spécifiquement mentionnés dans les détails du<br>contrat, ce seul fait ne les rendrait pas ‘nécessaires’ à l’exécution du<br>contrat »12<br>.</li><li>Ces exigences reflètent parfaitement celles imposées en matière de<br>consentement libre, pour atteindre le même résultat : la finalité que<br>poursuit la personne concernée en entrant en relation avec le responsable de traitement ne doit pas conduire à autoriser une autre finalité,<br>indépendante, que la personne concernée ne souhaite pas poursuivre.<br>En effet, ne pas refléter ces exigences en matière de contrat reviendrait à vider de toute portée les conditions de validité du consentement (vues plus tôt), puisque celles-ci pourraient être entièrement<br>contournées en se basant sur cette autre base légale (le contrat).</li><li>Ce reflet entre « contrat » et « consentement » se retrouve dans les récentes lignes directrices WP259 dédiées au consentement (citées plus<br>tôt), où le G29 intègre sa position de 2014 au RGPD : « Conformément à l’avis 06/2014 du G29, l’expression \"nécessaire à l’exécution<br>11 p. 16, traduction libre de « the provision must be interpreted strictly and does not<br>cover situations where the processing is not genuinely necessary for the performance of<br>a contract, but rather unilaterally imposed on the data subject by the controller »<br>12 p. 17, traduction libre de « also the fact that some data processing is covered by a<br>contract does not automatically mean that the processing is necessary for its<br>performance. For example, Article 7(b) is not a suitable legal ground for building a<br>profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to<br>carry out profiling, but rather to deliver particular goods and services, for example.<br>Even if these processing activities are specifically mentioned in the small print of the<br>contract, this fact alone does not make them ‘necessary’ for the performance of the<br>contract »</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>d’un contrat\" doit être interprétée strictement. Le traitement doit être<br>nécessaire pour satisfaire le contrat individuellement avec chacune des<br>personnes concernées […] Il doit y avoir un lien direct et objectif<br>entre le traitement de données et la finalité de l’exécution du contrat »<br>13<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":35} -->\n<ol start=\"35\"><li>En pratique, ces exigences ont par exemple trouvé application dans la<br>sanction rendue, en France, par la CNIL contre Facebook, le 27 avril</li><li>La CNIL considère alors que « l’objet principal du service est<br>la fourniture d’un réseau social […], que la combinaison des données des utilisateurs à des fins de ciblage publicitaire ne correspond ni<br>à l’objet principal du contrat ni aux attentes raisonnables des utilisateurs [et, ainsi,] que les sociétés ne peuvent [pas] se prévaloir de la<br>nécessité liée à l’exécution d’un contrat ».<br>2.1.3. Intérêt légitime</li><li>L’article 6, §1, f du RGPD prévoit qu’un traitement peut être licite s’il<br>« est nécessaire aux fins des intérêts légitimes poursuivis par le responsable du traitement ou par un tiers, à moins que ne prévalent les<br>intérêts ou les libertés et droits fondamentaux de la personne concernée ».</li><li>Le considérant 47 du RGPD prévoit que « le traitement de données à<br>caractère personnel à des fins de prospection peut être considéré<br>comme étant réalisé pour répondre à un intérêt légitime ».</li><li>Sans directement définir les critères faisant que la prospection puisse<br>ou non répondre à un intérêt légitime, le RGPD fait ici écho à l’enca13 p. 8, traduction libre de « According to Opinion 06/2014 of WP29, the term<br>“necessary for the performance of a contract” needs to be interpreted strictly. The<br>processing must be necessary to fulfil the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ».<br>14 Délibération de la formation restreinte SAN-2017-006 du 27 Avril 2017 prononçant<br>une sanction pécuniaire à l\'encontre des sociétés FACEBOOK INC. et FACEBOOK<br>IRELAND<br>10/19<br>drement spécifique qu’a reçu la prospection commerciale en droit européen au cours des différentes évolutions technologiques. Le G29,<br>dans son avis 06/2014 dédié à la notion d’intérêt légitime15 prend précisément l’évolution de cet encadrement comme exemple pédagogique<br>illustrant l’équilibre à rechercher pour fonder un traitement sur cette<br>base légale (p. 51 et suivantes).</li><li>En 1995, la directive 95/46/CE prévoyait, via son article 14, b, qu’un<br>traitement à des fins de prospection était licite si la personne concernée était informée et pouvait s’y opposer. Au regard de ces deux seules<br>conditions, le G29 comprend que la base légale donnée à ce traitement était l’intérêt légitime (aucun consentement préalable n’étant<br>requis).</li><li>En 2002, le G29 explique que, « pour tenir compte des nouvelles<br>avancées technologiques, cette disposition a été complétée ultérieurement par des dispositions spécifiques de la directive \"vie privée et<br>communications électroniques\" ». L’article 13, §1, de cette directive<br>(directive 2002/58/CE) prévoit désormais que, par principe, l’utilisation « de courrier électronique à des fins de prospection directe ne<br>peut être autorisée que si elle vise des abonnés ayant donné leur<br>consentement préalable ». Le droit d’opposition ne suffit plus : la base<br>légale de la prospection est ici passée de l’intérêt légitime au consentement.</li><li>Ce n’est plus que par exception que l’article 13, §2, de la directive<br>2002/58/CE prévoit encore un cas précis où l’intérêt légitime reste valide (et où le simple droit d’opposition, sans consentement préalable,<br>suffit) : s’agissant de la « prospection directe pour des produits ou services analogues qu\'elle-même fournit ».</li><li>Dans le même temps, cette même directive a d\'abord prévu, à son article 5, §3, que le stockage et l’accès à des informations sur le termi15 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_fr.pdf<br>11/19<br>nal d’un utilisateur étaient autorisés si la personne concernée en était<br>informée et pouvait s’y opposer. Encore une fois, c’est ici l’intérêt légitime qui a été initialement choisi comme base légale.</li><li>Le G29 retrace l’évolution qui a suivi : « Les technologies ont évolué,<br>nécessitant des solutions similaires, relativement simples, qui<br>obéissent à une logique analogue pour les nouvelles pratiques de prospection. Premièrement, la façon dont le matériel de prospection est<br>diffusé a évolué: au lieu de simples courriers électroniques arrivant<br>dans les boîtes aux lettres, des publicités comportementales ciblées<br>apparaissent aussi désormais sur les écrans de smartphones et d’ordinateurs. Dans un proche avenir, la publicité pourrait être intégrée<br>dans des objets intelligents connectés à l’internet des objets. Deuxièmement, les publicités deviennent toujours plus spécifiquement ciblées: au lieu de se fonder sur de simples profils de clients, elles tirent<br>parti du traçage des activités des consommateurs qui sont de plus en<br>plus souvent conservées en ligne et hors ligne et analysées au moyen<br>de méthodes automatisées plus élaborées. »</li><li>Le G29 conclut ainsi que « ce changement de modèle d’entreprise dominant et la valorisation des données à caractère personnel en tant<br>qu’actif pour les sociétés commerciales expliquent l’exigence récente<br>d’un consentement dans ce contexte ».</li><li>En 2009, en effet, l’article 5, §3, de la directive 2002/58/CE a été modifiée par la directive 2009/136/CE de sorte que l’accès et le dépôt<br>d’information sur le terminal de l’utilisateur ne peuvent désormais<br>plus se fonder sur l’intérêt légitime, mais uniquement sur le consentement. Une fois encore, pour encadrer l’évolution de la prospection<br>commerciale, la base légale est passée de l’intérêt légitime au consentement.</li><li>Au regard de ces évolutions, il apparaît manifeste qu’aucune autre<br>forme d’analyse comportementale à des fins publicitaires ne saurait<br>connaître un sort différent de celui des « cookies » : n’être licite<br>qu’avec le consentement préalable des personnes concernées.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>C’est la voie que prend le G29 dans l’annexe II de son avis 03/201316<br>,<br>sur le Big Data et l’Open Data : « un consentement préalable libre,<br>spécifique, informé et indubitable devrait presque toujours être requis » dès lors qu’une « organisation souhaite spécifiquement analyser<br>ou prédire les préférences personnelles, le comportement et les attitudes de clients individuels, qui serviront ensuite à guider des “mesures ou décisions” prises à l’égard de ces clients »17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":48} -->\n<ol start=\"48\"><li>Le G29 précise que ces « ‘mesures ou décisions’ ne couvrent pas que<br>des décisions formelles et des mesures prises dans une procédure formelle. En d’autres mots : n’importe quel effet pertinent sur des individus en particuliers – qu’il soit positif ou négatif – devrait être évité »18<br>.</li><li>Il donne comme exemple de telles « mesures et décisions » la diffusion<br>« de réductions personnalisées, d’offres spéciales et de publicités ciblées à partir du profil du client »19<br>.</li><li>Le G29 conclut clairement que le « consentement devrait surtout être<br>requis, par exemple, pour le traçage et le profilage à des fins de<br>prospection directe, de publicité comportementale, de courtage en<br>informations, de publicités fondées sur la localisation ou d’étude de<br>marché numérique fondée sur le traçage »20<br>.<br>16 L’avis 03/2013 du G29 est accessible sur : accessible sur<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p. 46, traduction donnée dans l\'avis 06/2014 du G29, p. 52<br>18 p. 28, traduction libre de « \'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure. In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p. 45, traduction libre de « personalised discounts, special offers and targeted<br>advertisements based on the customer\'s profile »<br>20 p. 46, traduction donnée dans l\'avis 06/2014 du G29, p. 52<br>13/19<br>2.2. Traitements réalisés<br>2.2.1. Données traitées</li><li>Amazon décrit dans sa Notice « Protection de vos informations personnelles21 » les données qu’il traite lorsqu\'il fournit ses services.</li><li>Sans être exhaustif quant aux données traitées, qui sont toutes pertinentes pour établir les griefs invoqués, il est utile de souligner<br>qu’Amazon déclare traiter, au sujet de ses utilisateurs :<br>• les produits, contenus ou services recherchés ou consultés ;<br>• les commandes passées ;<br>• des informations et documents relatifs à l\'identité et au statut ;<br>• les images, vidéos ou tout autre fichier téléchargés vers un service Amazon ;<br>• les Playlists, listes de favoris, listes d\'envies, listes de cadeaux ;<br>• l\'adresse IP (Internet Protocol) de l’appareil ;<br>• les données de connexion, les adresses e-mail et mots de passe ;<br>• les informations sur l’ordinateur, l’appareil et la connexion Internet comme par exemple, les applications de l\'appareil, le type et la<br>version du navigateur, les catégories et versions de plug-ins du navigateur, le système d\'exploitation ou le réglage des fuseaux horaires ;<br>• la localisation de l’appareil ou de l’ordinateur ;<br>• les informations relatives aux interactions avec le contenu, telles<br>que les téléchargements de contenus, le streaming de contenus et<br>les détails de visualisation, incluant la durée et le nombre de streaming et téléchargements simultanés, les détails relatifs au réseau<br>21 La notice « Protection de vos informations personnelles » d’Amazon est publiée sur<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie=UTF8&amp;nodeId=201909010 ainsi que jointe en Annexe III de la présente<br>réclamation, où elle est décrite en date du 28 mai 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>pour le streaming, et la qualité du téléchargement, incluant des informations relatives au fournisseur d\'accès internet ;<br>• les informations concernant les interactions sur une page (« scrolling »(défilement sur une page), clics, mouvements de souris) ;<br>• des informations sur les interactions avec des entreprises tierces<br>à qui Amazon fournit des services techniques, logistiques, de paiement, de publicité ou autres.<br>2.2.2. Traitements réalisés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":53} -->\n<ol start=\"53\"><li>Dans cette même notice, Amazon déclare : « Nous utilisons vos informations personnelles afin de vous présenter des publicités basées sur<br>vos centres d\'intérêt relatives à des fonctions, des produits et des services qui pourraient vous intéresser ». Il renvoie ensuite vers sa Notice<br>« Annonces publicitaires basées sur vos centres d\'intérêt<br>22 ».</li><li>Cette notice précise : « Afin de vous présenter des annonces basées sur<br>vos centres d\'intérêt, nous utilisons des informations comme celles<br>portant sur votre utilisation des sites, du contenu ou des services<br>d\'Amazon ». Par ailleurs, sur la page https://www.amazon.fr/adprefs,<br>Amazon permet à ses utilisateurs de « Ne pas afficher de publicités de<br>la part d’Amazon basées sur mes centres d’intérêt », cette option étant<br>décochée par défaut.</li><li>De ces différentes informations, il apparaît que Amazon traite des<br>données personnelles afin de réaliser des analyses comportementales et un ciblage publicitaire. Amazon est le responsable de traitement de ces opérations, dont la finalité est de permettre aux publicités diffusées par Amazon d\'être affichées aux utilisateurs les plus susceptibles d\'y être réceptifs.<br>22 La Notice « Annonces basées sur vos centres d\'intérêt » d’Amazon est publiée sur<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion<br>%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 ainsi que jointe en Annexe IV de<br>la présente réclamation, où elle est décrite en date du 28 mai 2018<br>15/19<br>2.2.3. Bases légales<br>2.2.3.1 Consentement</li><li>Aucun document publié par Amazon ne laisse penser que celui-ci<br>compte fonder ses traitements d’analyse comportementale et de ciblage publicitaire sur le consentement de ses utilisateurs.<br>2.2.3.2 Contrat</li><li>Les « Conditions d’utilisation23 » d’Amazon prévoient : « Dans le cadre<br>des Services Amazon, nous vous recommanderons des fonctionnalités,<br>des produits et des services, comprenant des publicités de tiers, qui<br>sont susceptibles de vous intéresser, nous identifierons vos préférences et nous personnaliserons votre expérience ».</li><li>Par cela, Amazon pourrait indiquer que ses traitement d’analyse comportementale et de ciblage publicitaire seraient prévus par le contrat<br>qu’il passe avec ses utilisateurs, dont l’exécution les rendrait nécessaires.</li><li>Or, se soumettre à cette analyse comportementale et à ce ciblage publicitaire n’est pas l’objectif que les utilisateurs d’Amazon poursuivent<br>en utilisant ses services. Pour reprendre la CNIL, « la combinaison des<br>données des utilisateurs à des fins de ciblage publicitaire ne correspond ni à l’objet principal du contrat ni aux attentes raisonnables des<br>utilisateurs » (décision SAN-2017-006 précitée).</li><li>Typiquement, l\'objet principal du contrat passé avec Amazon lors de<br>l’utilisation de son site Internet est l’achat et la vente de biens. Cette finalité peut parfaitement être poursuivie sans établir des profils comportementaux et sans diffuser de la publicité ciblée sur la base de<br>ceux-ci.<br>23 Les Conditions d’utilisation d’Amazon sont publiées sur<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie=UTF8&amp;nodeId=201909000, ici décrites en date du 28 mai 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3. Intérêt légitime</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":62} -->\n<ol start=\"62\"><li>Amazon n’invoque pas explicitement son intérêt légitime comme fondement de ses traitements d’analyse comportementale et de ciblage<br>publicitaire. Tel qu’exposé ci-avant dans la partie 2.1.3, il serait dans<br>l’impossibilité de le faire de façon conforme au RGPD.<br>2.3. Illicéité des traitements</li><li>Les traitements d\'analyse comportementale et de ciblage publicitaire<br>mis en œuvre par Amazon sur ses services, tels que décrits ci-avant, ne<br>peuvent pas se fonder sur la nécessité d’exécuter un contrat passé<br>avec les utilisateurs.</li><li>Ils ne sauraient non plus se fonder sur un intérêt légitime, car leur<br>objet est d\'analyser le comportement et d\'établir un profil des utilisateurs à des fins de ciblage publicitaire ce qui, pas plus que le ciblage<br>au moyen de « cookies », ne saurait être autorisé sans consentement<br>préalable de la personne concernée.</li><li>À défaut de base légale, ces traitements sont donc illicites, mettant<br>Amazon en violation du RGPD, notamment de son article 6.<br>17/19</li><li>Demandes</li><li>La Quadrature du Net, au nom des personnes qu\'elle représente, demande à ce que les mesures suivantes soient prononcées à l\'encontre<br>de Amazon :<br>• l\'interdiction des traitements d\'analyse comportementale et de ciblage publicitaire ci-avant décrits, en application de l\'article 58,<br>§2, f, du RGPD ;<br>• une amende administrative qui, de par le caractère massif, durable et manifestement délibéré de la violation constatée, doit être<br>la plus élevée possible, en application de l\'article 83, §§2 et 5, du<br>RGPD.</li></ol>\n<!-- /wp:list -->','','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 10:26:20','2021-07-31 10:26:20','',2145,'https://www.datarainbow.eu/?p=2146',0,'revision','',0),(2149,1,'2021-07-31 10:48:37','2021-07-31 10:48:37','<!-- wp:paragraph -->\n<p>Unofficial translation of the CNIL\'s decision:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Claim against Amazon Europe<br>Claim lodged:<br>By La Quadrature du Net, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Procedure</li><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public interest and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has consented to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a declaration or by a clear positive act</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". 3/19</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br>2.1.1.2. Free consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should<br>not be considered to have been freely given if the person2 G29 guidelines WP259 is available at:<br>http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked<br>boxes or opt-out constructions that require an intervention from the data subject to<br>prevent agreement\".<br>4 p. 17, free translation of \"merely continuing the ordinary use of a website is not<br>conduct from which one can infer an indication of wishes by the data subject to signify<br>his or her agreement to a proposed processing operation\".</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>concerned does not have a real freedom of choice or is not<br>in a position to refuse or withdraw their consent without suffering<br>prejudice ”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<br>consent is presumed not to have been freely given if<br>separate consent cannot be given to different<br>personal data processing&nbsp;operations&nbsp;although this is appropriate in the case species, or if the performance of a contract, including<br>the provision of a service, is subject to consent even<br>if this is not necessary for such performance ”.</li><li>The G29 has clearly specified the meaning of these provisions in its<br>guidelines (WP259, cited above), explaining that “the GDPR provides that<br>if the data subject does not have a real choice, feels compelled<br>to consent or will suffer negative consequences if she does<br>not&nbsp;consent&nbsp;, so her consent is not valid ”5<br>.</li><li>Among the negative consequences that the refusal to consent must not<br>cause, the G29 targets the case where “the use of a service would be deteriorated to the detriment of the user” 6<br>.&nbsp;He gives as<br>a concrete&nbsp;example&nbsp;a mobile application to which the user would refuse to<br>give access to the accelerometer of the phone (for reasons of behavioral analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this<br>would be a negative consequence incompatible with obtaining<br>free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"the<br>RGPD guarantees that the processing of personal data for which<br>5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not<br>consent, then consent will not be valid ”<br>6 p.&nbsp;11, free translation of “the performance of the service being downgraded to the<br>detriment of the user”<br>5/19<br>the consent is requested cannot become, directly or indirectly, the consideration of a contract ”7<br>.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<br>• “No user may be refused access to a service […]<br>on the grounds that he has not consented […] to the processing of his personal data<br>[…] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation<br>adopted on 23 October 2017);<br>• European law must not “legitimize or encourage a<br>practice of monetizing personal data,<br>which cannot be compared to a price, nor considered<br>as a commodity” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasized that these requirements already existed in the<br>law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For<br>example, in France, on December 18, 2017, the CNIL announced that it was putting<br>Whatsapp on notice to stop transmitting various<br>data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based<br>on a non-free consent of users, because \" the refusal of the person concerned to give his consent to the transmission of his<br>data is necessarily accompanied by a<br>significant&nbsp;negative consequence&nbsp;since he will be forced to delete his account and will not be<br>able to use the WhatsApp application ”8<br>.<br>7 p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\".<br>8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP<br>6/19<br>2.1.1.3.&nbsp;Fairness of the request for consent</li><li>Article 5, §1, a, of the GDPR provides that “personal data must be […] processed in a lawful, fair and transparent manner with regard to the data subject”.</li><li>Recital 39 of the GDPR specifies that \"the principle of transparency<br>requires that all information and communication relating to the processing<br>of such personal data be easily accessible, easy to understand, and formulated in clear and simple terms\" and<br>that \"natural persons should be informed of the risks,<br>rules, guarantees and rights associated with the processing of personal data<br>and of the procedures for exercising their rights with<br>regard to such processing ”.</li><li>Article 7, §3 of the GDPR provides that “the data subject has the right<br>to withdraw his consent at any time” and, in application of the<br>principle of loyalty and transparency, that “the data subject<br>is informed before giving his consent ”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful)<br>if it was based on the consent of the data subject while,<br>at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example,<br>to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the<br>data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"right\" would not legally have any effect, the processing being able to be based on another<br>basis. legal.</li><li>Thus, the processing of personal data can never be lawful<br>if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make<br>the information that must be given to the person with regard<br>to the right&nbsp;misleading.&nbsp;to withdraw consent.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that,<br>\"if a data controller chooses to base part of the processing on consent, he must be ready to respect this choice and to<br>end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the<br>basis of consent, when in fact it will&nbsp;be processed on&nbsp;another<br>legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange<br>consent with other legal bases.&nbsp;For example, it is not<br>allowed to retrospectively use the legitimate interest in order to justify a<br>treatment when difficulties have arisen concerning the validity<br>of the consent ”9<br>(p.23 of the WP259 guidelines mentioned above).<br>2.1.2.&nbsp;Contract</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if<br>“it is necessary for the performance of a contract to which the data subject is a party”.</li><li>This provision is identical to that already provided for in Article 7, b,<br>of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already<br>been detailed by the G29 in its opinion 06/2014, issued on November 25,<br>201410, as “to be interpreted strictly and not to cover<br>cases where the processing is not really necessary for<br>the performance of a contract. , but rather unilaterally imposed on the data subject by the controller ”11<br>.<br>9 Free translation of “if a controller chooses to rely on consent for any part of the<br>processing, they must be prepared to respect that choice and stop that part of the<br>processing if an individual withdraws consent.&nbsp;Sending out the message that data will<br>be processed on the basis of consent, while actually some other lawful basis is relied on,<br>would be fundamentally unfair to individuals. In other words, the controller cannot<br>swap from consent to other lawful bases. For example, it is not allowed to<br>retrospectively utilise the legitimate interest basis in order to justify processing, where<br>problems have been encountered with the validity of consent ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf<br>8/19</li><li>The G29 added that “the fact that certain data processing operations<br>are covered by a contract does not automatically mean that<br>these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the<br>tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the<br>contract was not concluded to carry out a profile, but to provide<br>certain goods or certain services, for example.&nbsp;Even if these<br>treatments were specifically mentioned in the details of the<br>contract, this fact alone would not make them \'necessary\' for the execution of the<br>contract ”12<br>.</li><li>These requirements perfectly reflect those imposed in terms of<br>free consent, in order to achieve the same result: the purpose<br>pursued by the data subject by entering into a relationship with the data controller must not lead to the authorization of another,<br>independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue.<br>Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely<br>circumvented based on this other legal basis (the contract). .</li><li>This reflection between “contract” and “consent” is found in the recent WP259 guidelines dedicated to consent (cited<br>earlier), where the G29 integrates its 2014 position into the GDPR: “In accordance with G29 opinion 06/2014, the expression “necessary for the execution<br>11 p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not<br>cover situations where the processing is not genuinely necessary for the performance of<br>a contract, but rather unilaterally imposed on the data subject by the controller\"<br>12 p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a<br>contract does not automatically mean that the processing is necessary for its<br>performance. For example, Article 7(b) is not a suitable legal ground for building a<br>profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to<br>carry out profiling, but rather to deliver particular goods and services, for example.<br>Even if these processing activities are specifically mentioned in the small print of the<br>contract, this fact alone does not make them ‘necessary’ for the performance of the<br>contract »</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>of a contract ”must be interpreted strictly.&nbsp;The processing must be<br>necessary to fulfill the contract individually with each of the<br>data subjects […] There must be a direct and objective link<br>between the processing of data and the purpose of the performance of the contract ”<br>13<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the<br>sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “the main object of the service is<br>the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either<br>to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the<br>necessity of performing a contract ”.<br>2.1.3.&nbsp;Legitimate interest</li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if<br>“it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the<br>interests or fundamental rights and freedoms of the data subject ”.</li><li>Recital 47 of the GDPR provides that “the processing of personal data<br>for prospecting purposes can be considered<br>as being carried out to meet a legitimate interest”.</li><li>Without directly defining the criteria so that prospecting may<br>or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the enca13 p.&nbsp;8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two<br>conditions&nbsp;alone&nbsp;, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can&nbsp;only&nbsp;be authorized if it targets subscribers who have given their<br>prior consent ”.&nbsp;The right to object is no longer sufficient: the<br>legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods.&nbsp;\"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of<br>commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Amazon fined in France','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 10:48:37','2021-07-31 10:48:37','',2145,'https://www.datarainbow.eu/?p=2149',0,'revision','',0),(2151,1,'2021-07-31 10:52:09','2021-07-31 10:52:09','<!-- wp:paragraph -->\n<p>Unofficial translation of the CNIL\'s decision:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Claim against Amazon Europe<br>Claim lodged:<br>By La Quadrature du Net, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Procedure</li><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". 3/19</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br>2.1.1.2. Free consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should<br>not be considered to have been freely given if the person2 G29 guidelines WP259 is available at:<br>http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked<br>boxes or opt-out constructions that require an intervention from the data subject to<br>prevent agreement\".<br>4 p. 17, free translation of \"merely continuing the ordinary use of a website is not<br>conduct from which one can infer an indication of wishes by the data subject to signify<br>his or her agreement to a proposed processing operation\".</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>concerned does not have a real freedom of choice or is not<br>in a position to refuse or withdraw their consent without suffering<br>prejudice ”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<br>consent is presumed not to have been freely given if<br>separate consent cannot be given to different<br>personal data processing&nbsp;operations&nbsp;although this is appropriate in the case species, or if the performance of a contract, including<br>the provision of a service, is subject to consent even<br>if this is not necessary for such performance ”.</li><li>The G29 has clearly specified the meaning of these provisions in its<br>guidelines (WP259, cited above), explaining that “the GDPR provides that<br>if the data subject does not have a real choice, feels compelled<br>to consent or will suffer negative consequences if she does<br>not&nbsp;consent&nbsp;, so her consent is not valid ”5<br>.</li><li>Among the negative consequences that the refusal to consent must not<br>cause, the G29 targets the case where “the use of a service would be deteriorated to the detriment of the user” 6<br>.&nbsp;He gives as<br>a concrete&nbsp;example&nbsp;a mobile application to which the user would refuse to<br>give access to the accelerometer of the phone (for reasons of behavioral analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this<br>would be a negative consequence incompatible with obtaining<br>free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"the<br>RGPD guarantees that the processing of personal data for which<br>5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not<br>consent, then consent will not be valid ”<br>6 p.&nbsp;11, free translation of “the performance of the service being downgraded to the<br>detriment of the user”<br>5/19<br>the consent is requested cannot become, directly or indirectly, the consideration of a contract ”7<br>.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<br>• “No user may be refused access to a service […]<br>on the grounds that he has not consented […] to the processing of his personal data<br>[…] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation<br>adopted on 23 October 2017);<br>• European law must not “legitimize or encourage a<br>practice of monetizing personal data,<br>which cannot be compared to a price, nor considered<br>as a commodity” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasized that these requirements already existed in the<br>law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For<br>example, in France, on December 18, 2017, the CNIL announced that it was putting<br>Whatsapp on notice to stop transmitting various<br>data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based<br>on a non-free consent of users, because \" the refusal of the person concerned to give his consent to the transmission of his<br>data is necessarily accompanied by a<br>significant&nbsp;negative consequence&nbsp;since he will be forced to delete his account and will not be<br>able to use the WhatsApp application ”8<br>.<br>7 p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\".<br>8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP<br>6/19<br>2.1.1.3.&nbsp;Fairness of the request for consent</li><li>Article 5, §1, a, of the GDPR provides that “personal data must be […] processed in a lawful, fair and transparent manner with regard to the data subject”.</li><li>Recital 39 of the GDPR specifies that \"the principle of transparency<br>requires that all information and communication relating to the processing<br>of such personal data be easily accessible, easy to understand, and formulated in clear and simple terms\" and<br>that \"natural persons should be informed of the risks,<br>rules, guarantees and rights associated with the processing of personal data<br>and of the procedures for exercising their rights with<br>regard to such processing ”.</li><li>Article 7, §3 of the GDPR provides that “the data subject has the right<br>to withdraw his consent at any time” and, in application of the<br>principle of loyalty and transparency, that “the data subject<br>is informed before giving his consent ”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful)<br>if it was based on the consent of the data subject while,<br>at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example,<br>to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the<br>data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"right\" would not legally have any effect, the processing being able to be based on another<br>basis. legal.</li><li>Thus, the processing of personal data can never be lawful<br>if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make<br>the information that must be given to the person with regard<br>to the right&nbsp;misleading.&nbsp;to withdraw consent.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that,<br>\"if a data controller chooses to base part of the processing on consent, he must be ready to respect this choice and to<br>end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the<br>basis of consent, when in fact it will&nbsp;be processed on&nbsp;another<br>legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange<br>consent with other legal bases.&nbsp;For example, it is not<br>allowed to retrospectively use the legitimate interest in order to justify a<br>treatment when difficulties have arisen concerning the validity<br>of the consent ”9<br>(p.23 of the WP259 guidelines mentioned above).<br>2.1.2.&nbsp;Contract</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if<br>“it is necessary for the performance of a contract to which the data subject is a party”.</li><li>This provision is identical to that already provided for in Article 7, b,<br>of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already<br>been detailed by the G29 in its opinion 06/2014, issued on November 25,<br>201410, as “to be interpreted strictly and not to cover<br>cases where the processing is not really necessary for<br>the performance of a contract. , but rather unilaterally imposed on the data subject by the controller ”11<br>.<br>9 Free translation of “if a controller chooses to rely on consent for any part of the<br>processing, they must be prepared to respect that choice and stop that part of the<br>processing if an individual withdraws consent.&nbsp;Sending out the message that data will<br>be processed on the basis of consent, while actually some other lawful basis is relied on,<br>would be fundamentally unfair to individuals. In other words, the controller cannot<br>swap from consent to other lawful bases. For example, it is not allowed to<br>retrospectively utilise the legitimate interest basis in order to justify processing, where<br>problems have been encountered with the validity of consent ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf<br>8/19</li><li>The G29 added that “the fact that certain data processing operations<br>are covered by a contract does not automatically mean that<br>these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the<br>tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the<br>contract was not concluded to carry out a profile, but to provide<br>certain goods or certain services, for example.&nbsp;Even if these<br>treatments were specifically mentioned in the details of the<br>contract, this fact alone would not make them \'necessary\' for the execution of the<br>contract ”12<br>.</li><li>These requirements perfectly reflect those imposed in terms of<br>free consent, in order to achieve the same result: the purpose<br>pursued by the data subject by entering into a relationship with the data controller must not lead to the authorization of another,<br>independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue.<br>Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely<br>circumvented based on this other legal basis (the contract). .</li><li>This reflection between “contract” and “consent” is found in the recent WP259 guidelines dedicated to consent (cited<br>earlier), where the G29 integrates its 2014 position into the GDPR: “In accordance with G29 opinion 06/2014, the expression “necessary for the execution<br>11 p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not<br>cover situations where the processing is not genuinely necessary for the performance of<br>a contract, but rather unilaterally imposed on the data subject by the controller\"<br>12 p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a<br>contract does not automatically mean that the processing is necessary for its<br>performance. For example, Article 7(b) is not a suitable legal ground for building a<br>profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to<br>carry out profiling, but rather to deliver particular goods and services, for example.<br>Even if these processing activities are specifically mentioned in the small print of the<br>contract, this fact alone does not make them ‘necessary’ for the performance of the<br>contract »</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>of a contract ”must be interpreted strictly.&nbsp;The processing must be<br>necessary to fulfill the contract individually with each of the<br>data subjects […] There must be a direct and objective link<br>between the processing of data and the purpose of the performance of the contract ”<br>13<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the<br>sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “the main object of the service is<br>the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either<br>to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the<br>necessity of performing a contract ”.<br>2.1.3.&nbsp;Legitimate interest</li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if<br>“it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the<br>interests or fundamental rights and freedoms of the data subject ”.</li><li>Recital 47 of the GDPR provides that “the processing of personal data<br>for prospecting purposes can be considered<br>as being carried out to meet a legitimate interest”.</li><li>Without directly defining the criteria so that prospecting may<br>or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the enca13 p.&nbsp;8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two<br>conditions&nbsp;alone&nbsp;, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can&nbsp;only&nbsp;be authorized if it targets subscribers who have given their<br>prior consent ”.&nbsp;The right to object is no longer sufficient: the<br>legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods.&nbsp;\"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of<br>commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Amazon fined in France','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 10:52:09','2021-07-31 10:52:09','',2145,'https://www.datarainbow.eu/?p=2151',0,'revision','',0),(2152,1,'2021-07-31 10:56:25','2021-07-31 10:56:25','<!-- wp:paragraph -->\n<p>Unofficial translation of the CNIL\'s decision:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Claim against Amazon Europe<br>Claim lodged:<br>By La Quadrature du Net, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Procedure</li><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". 3/19</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br>2.1.1.2. Free consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to<br>prevent agreement\".<br>4 p. 17, free translation of \"merely continuing the ordinary use of a website is not<br>conduct from which one can infer an indication of wishes by the data subject to signify<br>his or her agreement to a proposed processing operation\".</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>concerned does not have a real freedom of choice or is not<br>in a position to refuse or withdraw their consent without suffering<br>prejudice ”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<br>consent is presumed not to have been freely given if<br>separate consent cannot be given to different<br>personal data processing&nbsp;operations&nbsp;although this is appropriate in the case species, or if the performance of a contract, including<br>the provision of a service, is subject to consent even<br>if this is not necessary for such performance ”.</li><li>The G29 has clearly specified the meaning of these provisions in its<br>guidelines (WP259, cited above), explaining that “the GDPR provides that<br>if the data subject does not have a real choice, feels compelled<br>to consent or will suffer negative consequences if she does<br>not&nbsp;consent&nbsp;, so her consent is not valid ”5<br>.</li><li>Among the negative consequences that the refusal to consent must not<br>cause, the G29 targets the case where “the use of a service would be deteriorated to the detriment of the user” 6<br>.&nbsp;He gives as<br>a concrete&nbsp;example&nbsp;a mobile application to which the user would refuse to<br>give access to the accelerometer of the phone (for reasons of behavioral analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this<br>would be a negative consequence incompatible with obtaining<br>free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"the<br>RGPD guarantees that the processing of personal data for which<br>5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not<br>consent, then consent will not be valid ”<br>6 p.&nbsp;11, free translation of “the performance of the service being downgraded to the<br>detriment of the user”<br>5/19<br>the consent is requested cannot become, directly or indirectly, the consideration of a contract ”7<br>.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<br>• “No user may be refused access to a service […]<br>on the grounds that he has not consented […] to the processing of his personal data<br>[…] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation<br>adopted on 23 October 2017);<br>• European law must not “legitimize or encourage a<br>practice of monetizing personal data,<br>which cannot be compared to a price, nor considered<br>as a commodity” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasized that these requirements already existed in the<br>law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For<br>example, in France, on December 18, 2017, the CNIL announced that it was putting<br>Whatsapp on notice to stop transmitting various<br>data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based<br>on a non-free consent of users, because \" the refusal of the person concerned to give his consent to the transmission of his<br>data is necessarily accompanied by a<br>significant&nbsp;negative consequence&nbsp;since he will be forced to delete his account and will not be<br>able to use the WhatsApp application ”8<br>.<br>7 p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\".<br>8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP<br>6/19<br>2.1.1.3.&nbsp;Fairness of the request for consent</li><li>Article 5, §1, a, of the GDPR provides that “personal data must be […] processed in a lawful, fair and transparent manner with regard to the data subject”.</li><li>Recital 39 of the GDPR specifies that \"the principle of transparency<br>requires that all information and communication relating to the processing<br>of such personal data be easily accessible, easy to understand, and formulated in clear and simple terms\" and<br>that \"natural persons should be informed of the risks,<br>rules, guarantees and rights associated with the processing of personal data<br>and of the procedures for exercising their rights with<br>regard to such processing ”.</li><li>Article 7, §3 of the GDPR provides that “the data subject has the right<br>to withdraw his consent at any time” and, in application of the<br>principle of loyalty and transparency, that “the data subject<br>is informed before giving his consent ”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful)<br>if it was based on the consent of the data subject while,<br>at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example,<br>to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the<br>data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"right\" would not legally have any effect, the processing being able to be based on another<br>basis. legal.</li><li>Thus, the processing of personal data can never be lawful<br>if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make<br>the information that must be given to the person with regard<br>to the right&nbsp;misleading.&nbsp;to withdraw consent.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that,<br>\"if a data controller chooses to base part of the processing on consent, he must be ready to respect this choice and to<br>end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the<br>basis of consent, when in fact it will&nbsp;be processed on&nbsp;another<br>legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange<br>consent with other legal bases.&nbsp;For example, it is not<br>allowed to retrospectively use the legitimate interest in order to justify a<br>treatment when difficulties have arisen concerning the validity<br>of the consent ”9<br>(p.23 of the WP259 guidelines mentioned above).<br>2.1.2.&nbsp;Contract</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if<br>“it is necessary for the performance of a contract to which the data subject is a party”.</li><li>This provision is identical to that already provided for in Article 7, b,<br>of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already<br>been detailed by the G29 in its opinion 06/2014, issued on November 25,<br>201410, as “to be interpreted strictly and not to cover<br>cases where the processing is not really necessary for<br>the performance of a contract. , but rather unilaterally imposed on the data subject by the controller ”11<br>.<br>9 Free translation of “if a controller chooses to rely on consent for any part of the<br>processing, they must be prepared to respect that choice and stop that part of the<br>processing if an individual withdraws consent.&nbsp;Sending out the message that data will<br>be processed on the basis of consent, while actually some other lawful basis is relied on,<br>would be fundamentally unfair to individuals. In other words, the controller cannot<br>swap from consent to other lawful bases. For example, it is not allowed to<br>retrospectively utilise the legitimate interest basis in order to justify processing, where<br>problems have been encountered with the validity of consent ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf<br>8/19</li><li>The G29 added that “the fact that certain data processing operations<br>are covered by a contract does not automatically mean that<br>these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the<br>tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the<br>contract was not concluded to carry out a profile, but to provide<br>certain goods or certain services, for example.&nbsp;Even if these<br>treatments were specifically mentioned in the details of the<br>contract, this fact alone would not make them \'necessary\' for the execution of the<br>contract ”12<br>.</li><li>These requirements perfectly reflect those imposed in terms of<br>free consent, in order to achieve the same result: the purpose<br>pursued by the data subject by entering into a relationship with the data controller must not lead to the authorization of another,<br>independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue.<br>Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely<br>circumvented based on this other legal basis (the contract). .</li><li>This reflection between “contract” and “consent” is found in the recent WP259 guidelines dedicated to consent (cited<br>earlier), where the G29 integrates its 2014 position into the GDPR: “In accordance with G29 opinion 06/2014, the expression “necessary for the execution<br>11 p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not<br>cover situations where the processing is not genuinely necessary for the performance of<br>a contract, but rather unilaterally imposed on the data subject by the controller\"<br>12 p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a<br>contract does not automatically mean that the processing is necessary for its<br>performance. For example, Article 7(b) is not a suitable legal ground for building a<br>profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to<br>carry out profiling, but rather to deliver particular goods and services, for example.<br>Even if these processing activities are specifically mentioned in the small print of the<br>contract, this fact alone does not make them ‘necessary’ for the performance of the<br>contract »</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>of a contract ”must be interpreted strictly.&nbsp;The processing must be<br>necessary to fulfill the contract individually with each of the<br>data subjects […] There must be a direct and objective link<br>between the processing of data and the purpose of the performance of the contract ”<br>13<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the<br>sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “the main object of the service is<br>the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either<br>to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the<br>necessity of performing a contract ”.<br>2.1.3.&nbsp;Legitimate interest</li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if<br>“it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the<br>interests or fundamental rights and freedoms of the data subject ”.</li><li>Recital 47 of the GDPR provides that “the processing of personal data<br>for prospecting purposes can be considered<br>as being carried out to meet a legitimate interest”.</li><li>Without directly defining the criteria so that prospecting may<br>or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the enca13 p.&nbsp;8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two<br>conditions&nbsp;alone&nbsp;, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can&nbsp;only&nbsp;be authorized if it targets subscribers who have given their<br>prior consent ”.&nbsp;The right to object is no longer sufficient: the<br>legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods.&nbsp;\"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of<br>commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Amazon fined in France','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 10:56:25','2021-07-31 10:56:25','',2145,'https://www.datarainbow.eu/?p=2152',0,'revision','',0),(2157,1,'2021-07-31 11:43:03','2021-07-31 11:43:03','<!-- wp:paragraph -->\n<p>Unofficial translation of the CNIL\'s decision:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Claim against Amazon Europe<br>Claim lodged:<br>By La Quadrature du Net, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Procedure</li><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". 3/19</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br>2.1.1.2. Free consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\".</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”5</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” 6<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>  general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which 5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid </em>”.<br>6 p. 11, free translation of “<em>the performance of the service being downgraded to the detriment of the user</em>”<br>5/19 the requested consent cannot become, directly or indirectly, the condition of a contract ”7</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); • European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”8<br>7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\".<br>8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP 6/19<br>2.1.1.3. Fairness of the request for consent</li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity<br>of the consent </em>”9 (p.23 of the WP259 guidelines mentioned above).<br>2.1.2. Contract</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 201410, as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”11<br>9 Free translation of “<em>if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent</em> ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf<br>8/19</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”12<br>.</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely<br>circumvented based on this other legal basis (the contract). .</li><li>This reflection between “contract” and “consent” is found in the recent WP259 guidelines dedicated to consent (cited<br>earlier), where the G29 integrates its 2014 position into the GDPR: “In accordance with G29 opinion 06/2014, the expression “necessary for the execution<br>11 p. 16, free translation of \"the provision must be interpreted strictly and does not<br>cover situations where the processing is not genuinely necessary for the performance of<br>a contract, but rather unilaterally imposed on the data subject by the controller\"<br>12 p. 17, free translation of \"also the fact that some data processing is covered by a<br>contract does not automatically mean that the processing is necessary for its<br>performance. For example, Article 7(b) is not a suitable legal ground for building a<br>profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to<br>carry out profiling, but rather to deliver particular goods and services, for example.<br>Even if these processing activities are specifically mentioned in the small print of the<br>contract, this fact alone does not make them ‘necessary’ for the performance of the<br>contract »</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>of a contract ”must be interpreted strictly.&nbsp;The processing must be<br>necessary to fulfill the contract individually with each of the<br>data subjects […] There must be a direct and objective link<br>between the processing of data and the purpose of the performance of the contract ”<br>13<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the<br>sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “the main object of the service is<br>the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either<br>to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the<br>necessity of performing a contract ”.<br>2.1.3.&nbsp;Legitimate interest</li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if<br>“it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the<br>interests or fundamental rights and freedoms of the data subject ”.</li><li>Recital 47 of the GDPR provides that “the processing of personal data<br>for prospecting purposes can be considered<br>as being carried out to meet a legitimate interest”.</li><li>Without directly defining the criteria so that prospecting may<br>or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the enca13 p.&nbsp;8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two<br>conditions&nbsp;alone&nbsp;, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can&nbsp;only&nbsp;be authorized if it targets subscribers who have given their<br>prior consent ”.&nbsp;The right to object is no longer sufficient: the<br>legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods.&nbsp;\"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of<br>commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Luxembourg slaps record €750 million fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 11:43:03','2021-07-31 11:43:03','',2145,'https://www.datarainbow.eu/?p=2157',0,'revision','',0),(2154,1,'2021-07-31 11:20:27','2021-07-31 11:20:27','<!-- wp:paragraph -->\n<p>Unofficial translation of the CNIL\'s decision:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Claim against Amazon Europe<br>Claim lodged:<br>By La Quadrature du Net, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Procedure</li><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". 3/19</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br>2.1.1.2. Free consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\".</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”5</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” 6<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>  general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which 5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid </em>”.<br>6 p. 11, free translation of “<em>the performance of the service being downgraded to the detriment of the user</em>”<br>5/19 the requested consent cannot become, directly or indirectly, the condition of a contract ”7</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); • European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”8<br>7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\".<br>8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP 6/19<br>2.1.1.3. Fairness of the request for consent</li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"the principle of transparency<br>requires that all information and communication relating to the processing<br>of such personal data be easily accessible, easy to understand, and formulated in clear and simple terms\" and<br>that \"natural persons should be informed of the risks,<br>rules, guarantees and rights associated with the processing of personal data<br>and of the procedures for exercising their rights with<br>regard to such processing ”.</li><li>Article 7, §3 of the GDPR provides that “the data subject has the right<br>to withdraw his consent at any time” and, in application of the<br>principle of loyalty and transparency, that “the data subject<br>is informed before giving his consent ”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful)<br>if it was based on the consent of the data subject while,<br>at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example,<br>to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the<br>data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"right\" would not legally have any effect, the processing being able to be based on another<br>basis. legal.</li><li>Thus, the processing of personal data can never be lawful<br>if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make<br>the information that must be given to the person with regard<br>to the right misleading. to withdraw consent.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that,<br>\"if a data controller chooses to base part of the processing on consent, he must be ready to respect this choice and to<br>end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the<br>basis of consent, when in fact it will&nbsp;be processed on&nbsp;another<br>legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange<br>consent with other legal bases.&nbsp;For example, it is not<br>allowed to retrospectively use the legitimate interest in order to justify a<br>treatment when difficulties have arisen concerning the validity<br>of the consent ”9<br>(p.23 of the WP259 guidelines mentioned above).<br>2.1.2.&nbsp;Contract</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if<br>“it is necessary for the performance of a contract to which the data subject is a party”.</li><li>This provision is identical to that already provided for in Article 7, b,<br>of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already<br>been detailed by the G29 in its opinion 06/2014, issued on November 25,<br>201410, as “to be interpreted strictly and not to cover<br>cases where the processing is not really necessary for<br>the performance of a contract. , but rather unilaterally imposed on the data subject by the controller ”11<br>.<br>9 Free translation of “if a controller chooses to rely on consent for any part of the<br>processing, they must be prepared to respect that choice and stop that part of the<br>processing if an individual withdraws consent.&nbsp;Sending out the message that data will<br>be processed on the basis of consent, while actually some other lawful basis is relied on,<br>would be fundamentally unfair to individuals. In other words, the controller cannot<br>swap from consent to other lawful bases. For example, it is not allowed to<br>retrospectively utilise the legitimate interest basis in order to justify processing, where<br>problems have been encountered with the validity of consent ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf<br>8/19</li><li>The G29 added that “the fact that certain data processing operations<br>are covered by a contract does not automatically mean that<br>these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the<br>tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the<br>contract was not concluded to carry out a profile, but to provide<br>certain goods or certain services, for example.&nbsp;Even if these<br>treatments were specifically mentioned in the details of the<br>contract, this fact alone would not make them \'necessary\' for the execution of the<br>contract ”12<br>.</li><li>These requirements perfectly reflect those imposed in terms of<br>free consent, in order to achieve the same result: the purpose<br>pursued by the data subject by entering into a relationship with the data controller must not lead to the authorization of another,<br>independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue.<br>Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely<br>circumvented based on this other legal basis (the contract). .</li><li>This reflection between “contract” and “consent” is found in the recent WP259 guidelines dedicated to consent (cited<br>earlier), where the G29 integrates its 2014 position into the GDPR: “In accordance with G29 opinion 06/2014, the expression “necessary for the execution<br>11 p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not<br>cover situations where the processing is not genuinely necessary for the performance of<br>a contract, but rather unilaterally imposed on the data subject by the controller\"<br>12 p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a<br>contract does not automatically mean that the processing is necessary for its<br>performance. For example, Article 7(b) is not a suitable legal ground for building a<br>profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to<br>carry out profiling, but rather to deliver particular goods and services, for example.<br>Even if these processing activities are specifically mentioned in the small print of the<br>contract, this fact alone does not make them ‘necessary’ for the performance of the<br>contract »</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>of a contract ”must be interpreted strictly.&nbsp;The processing must be<br>necessary to fulfill the contract individually with each of the<br>data subjects […] There must be a direct and objective link<br>between the processing of data and the purpose of the performance of the contract ”<br>13<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the<br>sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “the main object of the service is<br>the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either<br>to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the<br>necessity of performing a contract ”.<br>2.1.3.&nbsp;Legitimate interest</li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if<br>“it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the<br>interests or fundamental rights and freedoms of the data subject ”.</li><li>Recital 47 of the GDPR provides that “the processing of personal data<br>for prospecting purposes can be considered<br>as being carried out to meet a legitimate interest”.</li><li>Without directly defining the criteria so that prospecting may<br>or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the enca13 p.&nbsp;8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two<br>conditions&nbsp;alone&nbsp;, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can&nbsp;only&nbsp;be authorized if it targets subscribers who have given their<br>prior consent ”.&nbsp;The right to object is no longer sufficient: the<br>legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods.&nbsp;\"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of<br>commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Amazon fined in France','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 11:20:27','2021-07-31 11:20:27','',2145,'https://www.datarainbow.eu/?p=2154',0,'revision','',0),(2156,1,'2021-07-31 11:37:24','2021-07-31 11:37:24','<!-- wp:paragraph -->\n<p>Unofficial translation of the CNIL\'s decision:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Claim against Amazon Europe<br>Claim lodged:<br>By La Quadrature du Net, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Procedure</li><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". 3/19</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br>2.1.1.2. Free consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\".</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”5</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” 6<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>  general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which 5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid </em>”.<br>6 p. 11, free translation of “<em>the performance of the service being downgraded to the detriment of the user</em>”<br>5/19 the requested consent cannot become, directly or indirectly, the condition of a contract ”7</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); • European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”8<br>7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\".<br>8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP 6/19<br>2.1.1.3. Fairness of the request for consent</li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity<br>of the consent </em>”9 (p.23 of the WP259 guidelines mentioned above).<br>2.1.2. Contract</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 201410, as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”11<br>9 Free translation of “<em>if a controller chooses to rely on consent for any part of the<br>processing, they must be prepared to respect that choice and stop that part of the<br>processing if an individual withdraws consent. Sending out the message that data will<br>be processed on the basis of consent, while actually some other lawful basis is relied on,<br>would be fundamentally unfair to individuals. In other words, the controller cannot<br>swap from consent to other lawful bases. For example, it is not allowed to<br>retrospectively utilise the legitimate interest basis in order to justify processing, where<br>problems have been encountered with the validity of consent</em> ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf<br>8/19</li><li>The G29 added that “the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract ”12<br>.</li><li>These requirements perfectly reflect those imposed in terms of<br>free consent, in order to achieve the same result: the purpose<br>pursued by the data subject by entering into a relationship with the data controller must not lead to the authorization of another,<br>independent purpose than the data subject. does not wish to continue.<br>Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely<br>circumvented based on this other legal basis (the contract). .</li><li>This reflection between “contract” and “consent” is found in the recent WP259 guidelines dedicated to consent (cited<br>earlier), where the G29 integrates its 2014 position into the GDPR: “In accordance with G29 opinion 06/2014, the expression “necessary for the execution<br>11 p. 16, free translation of \"the provision must be interpreted strictly and does not<br>cover situations where the processing is not genuinely necessary for the performance of<br>a contract, but rather unilaterally imposed on the data subject by the controller\"<br>12 p. 17, free translation of \"also the fact that some data processing is covered by a<br>contract does not automatically mean that the processing is necessary for its<br>performance. For example, Article 7(b) is not a suitable legal ground for building a<br>profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to<br>carry out profiling, but rather to deliver particular goods and services, for example.<br>Even if these processing activities are specifically mentioned in the small print of the<br>contract, this fact alone does not make them ‘necessary’ for the performance of the<br>contract »</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>of a contract ”must be interpreted strictly.&nbsp;The processing must be<br>necessary to fulfill the contract individually with each of the<br>data subjects […] There must be a direct and objective link<br>between the processing of data and the purpose of the performance of the contract ”<br>13<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the<br>sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “the main object of the service is<br>the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either<br>to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the<br>necessity of performing a contract ”.<br>2.1.3.&nbsp;Legitimate interest</li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if<br>“it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the<br>interests or fundamental rights and freedoms of the data subject ”.</li><li>Recital 47 of the GDPR provides that “the processing of personal data<br>for prospecting purposes can be considered<br>as being carried out to meet a legitimate interest”.</li><li>Without directly defining the criteria so that prospecting may<br>or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the enca13 p.&nbsp;8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two<br>conditions&nbsp;alone&nbsp;, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can&nbsp;only&nbsp;be authorized if it targets subscribers who have given their<br>prior consent ”.&nbsp;The right to object is no longer sufficient: the<br>legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods.&nbsp;\"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of<br>commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Amazon fined in France','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 11:37:24','2021-07-31 11:37:24','',2145,'https://www.datarainbow.eu/?p=2156',0,'revision','',0),(2155,1,'2021-07-31 11:29:06','2021-07-31 11:29:06','<!-- wp:paragraph -->\n<p>Unofficial translation of the CNIL\'s decision:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Claim against Amazon Europe<br>Claim lodged:<br>By La Quadrature du Net, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Procedure</li><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". 3/19</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br>2.1.1.2. Free consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\".</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”5</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” 6<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>  general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which 5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid </em>”.<br>6 p. 11, free translation of “<em>the performance of the service being downgraded to the detriment of the user</em>”<br>5/19 the requested consent cannot become, directly or indirectly, the condition of a contract ”7</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); • European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”8<br>7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\".<br>8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP 6/19<br>2.1.1.3. Fairness of the request for consent</li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “the data subject has the right to withdraw his consent at any time” and, in application of the principle of lawfullness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that,<br>\"if a data controller chooses to base part of the processing on consent, he must be ready to respect this choice and to<br>end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the<br>basis of consent, when in fact it will&nbsp;be processed on&nbsp;another<br>legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange<br>consent with other legal bases.&nbsp;For example, it is not<br>allowed to retrospectively use the legitimate interest in order to justify a<br>treatment when difficulties have arisen concerning the validity<br>of the consent ”9<br>(p.23 of the WP259 guidelines mentioned above).<br>2.1.2.&nbsp;Contract</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if<br>“it is necessary for the performance of a contract to which the data subject is a party”.</li><li>This provision is identical to that already provided for in Article 7, b,<br>of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already<br>been detailed by the G29 in its opinion 06/2014, issued on November 25,<br>201410, as “to be interpreted strictly and not to cover<br>cases where the processing is not really necessary for<br>the performance of a contract. , but rather unilaterally imposed on the data subject by the controller ”11<br>.<br>9 Free translation of “if a controller chooses to rely on consent for any part of the<br>processing, they must be prepared to respect that choice and stop that part of the<br>processing if an individual withdraws consent.&nbsp;Sending out the message that data will<br>be processed on the basis of consent, while actually some other lawful basis is relied on,<br>would be fundamentally unfair to individuals. In other words, the controller cannot<br>swap from consent to other lawful bases. For example, it is not allowed to<br>retrospectively utilise the legitimate interest basis in order to justify processing, where<br>problems have been encountered with the validity of consent ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf<br>8/19</li><li>The G29 added that “the fact that certain data processing operations<br>are covered by a contract does not automatically mean that<br>these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the<br>tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the<br>contract was not concluded to carry out a profile, but to provide<br>certain goods or certain services, for example.&nbsp;Even if these<br>treatments were specifically mentioned in the details of the<br>contract, this fact alone would not make them \'necessary\' for the execution of the<br>contract ”12<br>.</li><li>These requirements perfectly reflect those imposed in terms of<br>free consent, in order to achieve the same result: the purpose<br>pursued by the data subject by entering into a relationship with the data controller must not lead to the authorization of another,<br>independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue.<br>Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely<br>circumvented based on this other legal basis (the contract). .</li><li>This reflection between “contract” and “consent” is found in the recent WP259 guidelines dedicated to consent (cited<br>earlier), where the G29 integrates its 2014 position into the GDPR: “In accordance with G29 opinion 06/2014, the expression “necessary for the execution<br>11 p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not<br>cover situations where the processing is not genuinely necessary for the performance of<br>a contract, but rather unilaterally imposed on the data subject by the controller\"<br>12 p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a<br>contract does not automatically mean that the processing is necessary for its<br>performance. For example, Article 7(b) is not a suitable legal ground for building a<br>profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to<br>carry out profiling, but rather to deliver particular goods and services, for example.<br>Even if these processing activities are specifically mentioned in the small print of the<br>contract, this fact alone does not make them ‘necessary’ for the performance of the<br>contract »</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>of a contract ”must be interpreted strictly.&nbsp;The processing must be<br>necessary to fulfill the contract individually with each of the<br>data subjects […] There must be a direct and objective link<br>between the processing of data and the purpose of the performance of the contract ”<br>13<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the<br>sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “the main object of the service is<br>the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either<br>to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the<br>necessity of performing a contract ”.<br>2.1.3.&nbsp;Legitimate interest</li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if<br>“it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the<br>interests or fundamental rights and freedoms of the data subject ”.</li><li>Recital 47 of the GDPR provides that “the processing of personal data<br>for prospecting purposes can be considered<br>as being carried out to meet a legitimate interest”.</li><li>Without directly defining the criteria so that prospecting may<br>or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the enca13 p.&nbsp;8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two<br>conditions&nbsp;alone&nbsp;, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can&nbsp;only&nbsp;be authorized if it targets subscribers who have given their<br>prior consent ”.&nbsp;The right to object is no longer sufficient: the<br>legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods.&nbsp;\"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of<br>commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Amazon fined in France','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 11:29:06','2021-07-31 11:29:06','',2145,'https://www.datarainbow.eu/?p=2155',0,'revision','',0),(2153,1,'2021-07-31 11:02:49','2021-07-31 11:02:49','<!-- wp:paragraph -->\n<p>Unofficial translation of the CNIL\'s decision:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Claim against Amazon Europe<br>Claim lodged:<br>By La Quadrature du Net, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Procedure</li><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". 3/19</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br>2.1.1.2. Free consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\".</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “the GDPR provides that if the data subject does not have a real choice, feels compelled<br>to consent or will suffer negative consequences if she does not consent, so her consent is not valid ”5</li><li>Among the negative consequences that the refusal to consent must not<br>cause, the G29 targets the case where “the use of a service would be deteriorated to the detriment of the user” 6<br>. He gives as<br>a concrete example a mobile application to which the user would refuse to<br>give access to the accelerometer of the phone (for reasons of behavioral analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this<br>would be a negative consequence incompatible with obtaining<br>free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"the<br>RGPD guarantees that the processing of personal data for which<br>5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not<br>consent, then consent will not be valid ”<br>6 p. 11, free translation of “the performance of the service being downgraded to the<br>detriment of the user”<br>5/19<br>the consent is requested cannot become, directly or indirectly, the consideration of a contract ”7<br>.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<br>• “No user may be refused access to a service […]<br>on the grounds that he has not consented […] to the processing of his personal data<br>[…] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation<br>adopted on 23 October 2017);<br>• European law must not “legitimize or encourage a<br>practice of monetizing personal data,<br>which cannot be compared to a price, nor considered<br>as a commodity” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasized that these requirements already existed in the<br>law prior to the GDPR, the latter having contented itself here with codifying. For<br>example, in France, on December 18, 2017, the CNIL announced that it was putting<br>Whatsapp on notice to stop transmitting various<br>data on its users to Facebook , on the grounds that this transmission was based<br>on a non-free consent of users, because \" the refusal of the person concerned to give his consent to the transmission of his<br>data is necessarily accompanied by a<br>significant negative consequence since he will be forced to delete his account and will not be<br>able to use the WhatsApp application ”8<br>.<br>7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\".<br>8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP<br>6/19<br>2.1.1.3. Fairness of the request for consent</li><li>Article 5, §1, a, of the GDPR provides that “personal data must be […] processed in a lawful, fair and transparent manner with regard to the data subject”.</li><li>Recital 39 of the GDPR specifies that \"the principle of transparency<br>requires that all information and communication relating to the processing<br>of such personal data be easily accessible, easy to understand, and formulated in clear and simple terms\" and<br>that \"natural persons should be informed of the risks,<br>rules, guarantees and rights associated with the processing of personal data<br>and of the procedures for exercising their rights with<br>regard to such processing ”.</li><li>Article 7, §3 of the GDPR provides that “the data subject has the right<br>to withdraw his consent at any time” and, in application of the<br>principle of loyalty and transparency, that “the data subject<br>is informed before giving his consent ”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful)<br>if it was based on the consent of the data subject while,<br>at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example,<br>to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the<br>data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"right\" would not legally have any effect, the processing being able to be based on another<br>basis. legal.</li><li>Thus, the processing of personal data can never be lawful<br>if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make<br>the information that must be given to the person with regard<br>to the right misleading. to withdraw consent.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that,<br>\"if a data controller chooses to base part of the processing on consent, he must be ready to respect this choice and to<br>end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the<br>basis of consent, when in fact it will&nbsp;be processed on&nbsp;another<br>legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange<br>consent with other legal bases.&nbsp;For example, it is not<br>allowed to retrospectively use the legitimate interest in order to justify a<br>treatment when difficulties have arisen concerning the validity<br>of the consent ”9<br>(p.23 of the WP259 guidelines mentioned above).<br>2.1.2.&nbsp;Contract</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if<br>“it is necessary for the performance of a contract to which the data subject is a party”.</li><li>This provision is identical to that already provided for in Article 7, b,<br>of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already<br>been detailed by the G29 in its opinion 06/2014, issued on November 25,<br>201410, as “to be interpreted strictly and not to cover<br>cases where the processing is not really necessary for<br>the performance of a contract. , but rather unilaterally imposed on the data subject by the controller ”11<br>.<br>9 Free translation of “if a controller chooses to rely on consent for any part of the<br>processing, they must be prepared to respect that choice and stop that part of the<br>processing if an individual withdraws consent.&nbsp;Sending out the message that data will<br>be processed on the basis of consent, while actually some other lawful basis is relied on,<br>would be fundamentally unfair to individuals. In other words, the controller cannot<br>swap from consent to other lawful bases. For example, it is not allowed to<br>retrospectively utilise the legitimate interest basis in order to justify processing, where<br>problems have been encountered with the validity of consent ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf<br>8/19</li><li>The G29 added that “the fact that certain data processing operations<br>are covered by a contract does not automatically mean that<br>these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the<br>tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the<br>contract was not concluded to carry out a profile, but to provide<br>certain goods or certain services, for example.&nbsp;Even if these<br>treatments were specifically mentioned in the details of the<br>contract, this fact alone would not make them \'necessary\' for the execution of the<br>contract ”12<br>.</li><li>These requirements perfectly reflect those imposed in terms of<br>free consent, in order to achieve the same result: the purpose<br>pursued by the data subject by entering into a relationship with the data controller must not lead to the authorization of another,<br>independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue.<br>Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely<br>circumvented based on this other legal basis (the contract). .</li><li>This reflection between “contract” and “consent” is found in the recent WP259 guidelines dedicated to consent (cited<br>earlier), where the G29 integrates its 2014 position into the GDPR: “In accordance with G29 opinion 06/2014, the expression “necessary for the execution<br>11 p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not<br>cover situations where the processing is not genuinely necessary for the performance of<br>a contract, but rather unilaterally imposed on the data subject by the controller\"<br>12 p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a<br>contract does not automatically mean that the processing is necessary for its<br>performance. For example, Article 7(b) is not a suitable legal ground for building a<br>profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to<br>carry out profiling, but rather to deliver particular goods and services, for example.<br>Even if these processing activities are specifically mentioned in the small print of the<br>contract, this fact alone does not make them ‘necessary’ for the performance of the<br>contract »</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>of a contract ”must be interpreted strictly.&nbsp;The processing must be<br>necessary to fulfill the contract individually with each of the<br>data subjects […] There must be a direct and objective link<br>between the processing of data and the purpose of the performance of the contract ”<br>13<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the<br>sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “the main object of the service is<br>the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either<br>to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the<br>necessity of performing a contract ”.<br>2.1.3.&nbsp;Legitimate interest</li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if<br>“it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the<br>interests or fundamental rights and freedoms of the data subject ”.</li><li>Recital 47 of the GDPR provides that “the processing of personal data<br>for prospecting purposes can be considered<br>as being carried out to meet a legitimate interest”.</li><li>Without directly defining the criteria so that prospecting may<br>or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the enca13 p.&nbsp;8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two<br>conditions&nbsp;alone&nbsp;, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can&nbsp;only&nbsp;be authorized if it targets subscribers who have given their<br>prior consent ”.&nbsp;The right to object is no longer sufficient: the<br>legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods.&nbsp;\"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of<br>commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Amazon fined in France','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 11:02:49','2021-07-31 11:02:49','',2145,'https://www.datarainbow.eu/?p=2153',0,'revision','',0),(2160,1,'2021-07-31 12:08:30','2021-07-31 12:08:30','<!-- wp:paragraph -->\n<p>Unofficial translation of the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br><strong>2.1.1.2. Free consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\" concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”5</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” 6<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>  general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which 5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid </em>”. 6 p. 11, free translation of “<em>the performance of the service being downgraded to the detriment of the user</em>” the requested consent cannot become, directly or indirectly, the condition of a contract ”7</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); • European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”8 7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\". 8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP <br><strong>2.1.1.3. Fairness of the request for consent</strong></li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity<br>of the consent </em>”9 (p.23 of the WP259 guidelines mentioned above).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2. Contrac</strong>t</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 201410, as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”11<br>9 Free translation of “<em>if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent</em> ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”12</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution 11 p. 16, free translation of \"<em>the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>\" 12 p. 17, free translation of \"<em>also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract</em>». of a contract ”must be interpreted strictly. The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ”13</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br><strong>2.1.3. Legitimate interest</strong></li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if<br>“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “the processing of personal data<br>for prospecting purposes can be considered<br>as being carried out to meet a legitimate interest”.</li><li>Without directly defining the criteria so that prospecting may<br>or may not meet a legitimate interest, the GDPR here echoes the enca13 p. 8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly. The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC. and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments. The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two<br>conditions alone , the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications ”directive ”. Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can only be authorized if it targets subscribers who have given their<br>prior consent ”. The right to object is no longer sufficient: the<br>legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices. First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens. In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods. \"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of<br>commercial prospecting , the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Luxembourg slaps record €750 million fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 12:08:30','2021-07-31 12:08:30','',2145,'https://www.datarainbow.eu/?p=2160',0,'revision','',0),(2159,1,'2021-07-31 12:02:52','2021-07-31 12:02:52','<!-- wp:paragraph -->\n<p>Unofficial translation of the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br>2.1.1.2. Free consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\".</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”5</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” 6<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>  general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which 5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid </em>”.<br>6 p. 11, free translation of “<em>the performance of the service being downgraded to the detriment of the user</em>” the requested consent cannot become, directly or indirectly, the condition of a contract ”7</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); • European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”8<br>7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\".<br>8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP <br><strong>2.1.1.3. Fairness of the request for consent</strong></li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity<br>of the consent </em>”9 (p.23 of the WP259 guidelines mentioned above).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2. Contrac</strong>t</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 201410, as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”11<br>9 Free translation of “<em>if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent</em> ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”12</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution 11 p. 16, free translation of \"<em>the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>\" 12 p. 17, free translation of \"<em>also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract</em>». of a contract ”must be interpreted strictly. The processing must be necessary to fulfill the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ”13</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the<br>sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “the main object of the service is<br>the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either<br>to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the<br>necessity of performing a contract ”.<br>2.1.3.&nbsp;Legitimate interest</li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if<br>“it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the<br>interests or fundamental rights and freedoms of the data subject ”.</li><li>Recital 47 of the GDPR provides that “the processing of personal data<br>for prospecting purposes can be considered<br>as being carried out to meet a legitimate interest”.</li><li>Without directly defining the criteria so that prospecting may<br>or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the enca13 p.&nbsp;8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two<br>conditions&nbsp;alone&nbsp;, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can&nbsp;only&nbsp;be authorized if it targets subscribers who have given their<br>prior consent ”.&nbsp;The right to object is no longer sufficient: the<br>legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods.&nbsp;\"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of<br>commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Luxembourg slaps record €750 million fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 12:02:52','2021-07-31 12:02:52','',2145,'https://www.datarainbow.eu/?p=2159',0,'revision','',0),(2161,1,'2021-07-31 12:11:55','2021-07-31 12:11:55','<!-- wp:paragraph -->\n<p>Unofficial translation of the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br><strong>2.1.1.2. Free consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\" concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”5</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” 6<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>  general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which 5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid </em>”. 6 p. 11, free translation of “<em>the performance of the service being downgraded to the detriment of the user</em>” the requested consent cannot become, directly or indirectly, the condition of a contract ”7</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); • European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”8 7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\". 8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP <br><strong>2.1.1.3. Fairness of the request for consent</strong></li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity<br>of the consent </em>”9 (p.23 of the WP259 guidelines mentioned above).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2. Contrac</strong>t</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 201410, as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”11<br>9 Free translation of “<em>if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent</em> ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”12</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution 11 p. 16, free translation of \"<em>the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>\" 12 p. 17, free translation of \"<em>also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract</em>». of a contract ”must be interpreted strictly. The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ”13</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br><strong>2.1.3. Legitimate interest</strong></li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may<br>or may not meet a legitimate interest, the GDPR here echoes the enca13 p. 8, free translation of “According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly. The<br>processing must be necessary to fulfill the contract with each individual data subject.<br>(…) There needs to be a direct and objective link between the processing of the data<br>and the purpose of the execution of the contract ”.<br>14 Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC. and FACEBOOK<br>IRELAND<br>10/19<br>very specific that commercial prospecting has received in European law during the various technological developments. The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest15 takes precisely the evolution of this framework as an educational example<br>illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that<br>processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two<br>conditions alone , the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being<br>required).</li><li>In 2002, the G29 explained that, “to take account of new<br>technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and<br>electronic communications ”directive ”. Article 13, §1, of this directive<br>(Directive 2002/58 / EC) now provides that, in principle, the use of \"electronic mail for direct marketing purposes<br>can only be authorized if it targets subscribers who have given their<br>prior consent ”. The right to object is no longer sufficient: the<br>legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive<br>2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent ,<br>suffices): in the case of \"direct prospecting for similar products or services that it itself provides\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi15 Opinion 06/2014 of the G29 is accessible at: http: / /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf<br>11/19<br>of a user were authorized if the data subject was<br>informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “Technologies have evolved,<br>requiring similar, relatively simple solutions which<br>follow a similar logic for new prospecting practices. First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving<br>in mailboxes, targeted behavioral ads<br>now also appear on smartphone and computer screens. In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw<br>It started with tracking consumer activity which is increasingly<br>kept online and offline and analyzed using<br>more sophisticated automated methods. \"</li><li>The G29 thus concludes that \"this change in the dominant business model and the valuation of personal data as an<br>asset for commercial companies explain the recent requirement<br>for consent in this context\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of<br>commercial prospecting , the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Luxembourg slaps record €750 million fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 12:11:55','2021-07-31 12:11:55','',2145,'https://www.datarainbow.eu/?p=2161',0,'revision','',0),(2162,1,'2021-07-31 12:20:53','2021-07-31 12:20:53','<!-- wp:paragraph -->\n<p>Unofficial translation of the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br><strong>2.1.1.2. Free consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\" concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”5</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” 6<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>  general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which 5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid </em>”. 6 p. 11, free translation of “<em>the performance of the service being downgraded to the detriment of the user</em>” the requested consent cannot become, directly or indirectly, the condition of a contract ”7</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); • European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”8 7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\". 8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP <br><strong>2.1.1.3. Fairness of the request for consent</strong></li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity<br>of the consent </em>”9 (p.23 of the WP259 guidelines mentioned above).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2. Contrac</strong>t</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 201410, as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”11<br>9 Free translation of “<em>if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent</em> ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”12</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution 11 p. 16, free translation of \"<em>the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>\" 12 p. 17, free translation of \"<em>also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract</em>». of a contract ”must be interpreted strictly. The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ”13</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br><strong>2.1.3. Legitimate interest</strong></li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or may not meet a legitimate interest, the GDPR here echoes the enca13 p. 8, free translation of “<em>According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly. The processing must be necessary to fulfill the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.14 </li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC. and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments. The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest 15 takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two conditions alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications ”directive ”. Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can only be authorised if it targets subscribers who have given their prior consent</em>”. The right to object is no longer sufficient: the legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi of a user were authorised if the data subject was informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.15 Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http:/ /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf 11/19\" target=\"_blank\">is accessible here</a>. </li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices. First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads<br>now also appear on smartphone and computer screens. In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods. </em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit<br>of information on the terminal of the The user can no<br>longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of<br>commercial prospecting , the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other<br>form of behavioral analysis for advertising purposes can<br>experience a fate different from that of “cookies”: to be lawful<br>only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316<br>,<br>on Big Data and Open Data: “free,<br>specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required” therefore that an “organization specifically wishes to analyze<br>or predict the personal preferences, behavior and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers” 17<br>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “\'measures or decisions\' do not cover only<br>formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided ”18<br>.</li><li>He gives as an example of such “measures and decisions” the dissemination of<br>“personalized discounts, special offers and targeted advertising based on the customer\'s profile” 19<br>.</li><li>The G29 clearly concludes that \'consent should above all be<br>required, for example, for tracking and profiling for the purposes of<br>direct marketing, behavioral advertising,<br>information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based ”20<br>.<br>16 G29 opinion 03/2013 is available at: accessible at<br>http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf<br>17 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>18 p.&nbsp;28, free translation of \"\'measures or decisions\' do not only cover formal decisions<br>and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular<br>individuals - either negative or positive - should be avoided »<br>19 p.&nbsp;45, free translation of “personalized discounts, special offers and targeted<br>advertisements based on the customer\'s profile”<br>20 p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br>13/19<br>2.2.&nbsp;Treatments carried out<br>2.2.1.&nbsp;Data processed</li><li>Amazon describes in its Notice “Protection of your personal information21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that<br>Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wishlists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<br>21 The leaflet \"Protecting your personal information ”from Amazon is published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?<br>ie = UTF8 &amp; nodeId = 201909010 as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br>2.2.2.&nbsp;Treatments performed</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice<br>“Advertisements based on your interests<br>22”.</li><li>This notice states: \"In order to show you ads based on<br>your interests, we use information such as that<br>relating to your use of<br>Amazon&nbsp;sites, content or services&nbsp;.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs,<br>Amazon allows its users to \"Do not display advertisements from<br>Amazon based on my interests\", this option being<br>unchecked by fault.</li><li>From this different information, it appears that Amazon processes<br>personal data in order to carry out behavioral analyzes and advertising targeting.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br>22 The Amazon “Ads based on your interests” Notice is published at<br>https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%<br>2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360 as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br>15/19<br>2.2.3.&nbsp;Legal basis<br>2.2.3.1 Consent</li><li>No document published by Amazon suggests that it<br>intends to base its behavioral analysis and advertising targeting treatments on the consent of its users.<br>2.2.3.2 Contract</li><li>Amazon\'s “Terms of Service” 23 provide: “As part<br>of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that<br>may be of interest to you, we will identify your preferences and we will personalize your experience ”.</li><li>By this, Amazon could indicate that its behavioral analysis and advertising targeting processing would be provided for in the contract<br>it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioral analysis and advertising targeting is not the goal that Amazon users pursue<br>when using its services.&nbsp;To quote the CNIL, “the combination of<br>user data for advertising targeting purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when<br>using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioral profiles and without disseminating targeted advertising on the basis of<br>them.<br>23 The Amazon Terms of Service are published at<br>https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?<br>ie = UTF8 &amp; nodeId = 201909000, here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2.2.3.3.&nbsp;Legitimate interest</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Luxembourg slaps record €750 million fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 12:20:53','2021-07-31 12:20:53','',2145,'https://www.datarainbow.eu/?p=2162',0,'revision','',0),(2163,1,'2021-07-31 12:36:32','2021-07-31 12:36:32','<!-- wp:paragraph -->\n<p>Unofficial translation of the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br><strong>2.1.1.2. Free consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\" concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”5</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” 6<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>  general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which 5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid </em>”. 6 p. 11, free translation of “<em>the performance of the service being downgraded to the detriment of the user</em>” the requested consent cannot become, directly or indirectly, the condition of a contract ”7</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); • European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”8 7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\". 8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP <br><strong>2.1.1.3. Fairness of the request for consent</strong></li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity<br>of the consent </em>”9 (p.23 of the WP259 guidelines mentioned above).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2. Contrac</strong>t</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 201410, as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”11<br>9 Free translation of “<em>if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent</em> ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”12</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution 11 p. 16, free translation of \"<em>the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>\" 12 p. 17, free translation of \"<em>also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract</em>». of a contract ”must be interpreted strictly. The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ”13</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br><strong>2.1.3. Legitimate interest</strong></li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or may not meet a legitimate interest, the GDPR here echoes the enca13 p. 8, free translation of “<em>According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly. The processing must be necessary to fulfill the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.14 </li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC. and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments. The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest 15 takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two conditions alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications ”directive ”. Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can only be authorised if it targets subscribers who have given their prior consent</em>”. The right to object is no longer sufficient: the legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi of a user were authorised if the data subject was informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.15 Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http:/ /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf 11/19\" target=\"_blank\">is accessible here</a>. </li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices. First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads<br>now also appear on smartphone and computer screens. In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods. </em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of commercial prospecting , the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316, on Big Data and Open Data: “<em>free, specific, informed and unmistakable prior consent should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” 17</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure. In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”18</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” 19</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information brokerage , location-based advertising or<br>market research. digital tracing-based </em>”20 - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a>  17 p. 46, translation given in G29 opinion 06/2014, p. 52<br>18 p. 28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure. In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » 19 p. 45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” 20 p. 46, translation given in G29 opinion 06/2014, p. 52<br><br><strong>2.2. Treatments carried out</strong><br><strong>2.2.1. Data processed</strong></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em> 21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system 21 The leaflet \"Protecting your personal information ”from Amazon is published <a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br><strong>2.2.2. Treatments performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest- based advertisements for features, products and services that may be of interest to you.\" He then refers to his Notice “Advertisements based on your interests 22</em>”.</li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon sites, content or services </em>.\" In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement. Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them. 22 The Amazon “Ads based on your interests” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion% 2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br><br><strong>2.2.3. Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” 23 provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services. To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<br>23 The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3. Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be<br>impossible to do so in accordance with the GDPR.<br>2.3.&nbsp;Illegality of processing</li><li>The behavioral analysis and advertising targeting treatments<br>implemented by Amazon on its services, as described above,<br>cannot be based on the need to perform a contract<br>with users.</li><li>They cannot be based on a legitimate interest either, because their<br>purpose is to analyze the behavior and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"cookies\", cannot be authorized without the<br>prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting<br>Amazon in violation of the GDPR, in particular its article 6.<br>17/19</li><li>Requests</li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against<br>Amazon:<br>• the prohibition of the behavioral analysis and advertising targeting treatments described above, in application of article 58,<br>§2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, must be<br>as high as possible, in application of article 83, §§2 and 5, of the<br>GDPR.</li></ol>\n<!-- /wp:list -->','Luxembourg slaps record €750 million fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 12:36:32','2021-07-31 12:36:32','',2145,'https://www.datarainbow.eu/?p=2163',0,'revision','',0),(2164,1,'2021-07-31 12:42:31','2021-07-31 12:42:31','<!-- wp:paragraph -->\n<p>Unofficial translation of the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides </em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is an association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defense of the social, cultural, innovation and human development interests of citizens </em>”<br>.</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these illicit (2.3). 2.1. Legal bases required by the GDPR</li><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed. Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2); the legitimate interest of the controller or a third party (2.1.3). 2.1.1. Consent</li><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.<br>2.1.1.1. Explicit consent</li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP2592).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” 3</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" 4.<br><strong>2.1.1.2. Free consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". 4 p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\" concerned does not have a real freedom of choice or is not in a position to refuse or withdraw their consent without suffering prejudice ”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”5</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” 6<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>  general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which 5 p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid </em>”. 6 p. 11, free translation of “<em>the performance of the service being downgraded to the detriment of the user</em>” the requested consent cannot become, directly or indirectly, the condition of a contract ”7</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); • European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”8 7 p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance<br>of a contract\". 8 Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company<br>WHATSAPP <br><strong>2.1.1.3. Fairness of the request for consent</strong></li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity<br>of the consent </em>”9 (p.23 of the WP259 guidelines mentioned above).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2. Contrac</strong>t</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 201410, as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”11<br>9 Free translation of “<em>if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent</em> ».<br>10 L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”12</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution 11 p. 16, free translation of \"<em>the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>\" 12 p. 17, free translation of \"<em>also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract</em>». of a contract ”must be interpreted strictly. The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ”13</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27.</li><li>The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br><strong>2.1.3. Legitimate interest</strong></li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or may not meet a legitimate interest, the GDPR here echoes the enca13 p. 8, free translation of “<em>According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly. The processing must be necessary to fulfill the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.14 </li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC. and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments. The G29,<br>in its opinion 06/2014 dedicated to the notion of legitimate interest 15 takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this<br>legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two conditions alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications ”directive ”. Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can only be authorised if it targets subscribers who have given their prior consent</em>”. The right to object is no longer sufficient: the legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the termi of a user were authorised if the data subject was informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.15 Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http:/ /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf 11/19\" target=\"_blank\">is accessible here</a>. </li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices. First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads<br>now also appear on smartphone and computer screens. In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods. </em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of commercial prospecting , the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This is the path taken by the G29 in appendix II of its opinion 03/201316, on Big Data and Open Data: “<em>free, specific, informed and unmistakable prior consent should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” 17</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure. In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”18</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” 19</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information brokerage , location-based advertising or<br>market research. digital tracing-based </em>”20 - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a>  17 p. 46, translation given in G29 opinion 06/2014, p. 52<br>18 p. 28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure. In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » 19 p. 45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” 20 p. 46, translation given in G29 opinion 06/2014, p. 52<br><br><strong>2.2. Treatments carried out</strong><br><strong>2.2.1. Data processed</strong></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em> 21” the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system 21 The leaflet \"Protecting your personal information ”from Amazon is published <a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br><strong>2.2.2. Treatments performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest- based advertisements for features, products and services that may be of interest to you.\" He then refers to his Notice “Advertisements based on your interests 22</em>”.</li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon sites, content or services </em>.\" In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement. Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them. 22 The Amazon “Ads based on your interests” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion% 2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br><br><strong>2.2.3. Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” 23 provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services. To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<br>23 The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3. Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising targeting processing . As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><strong>2.3. Illegality of processing</strong></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior consent of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li><li><strong>Requests</strong></li><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->','Luxembourg slaps record €750 million fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 12:42:31','2021-07-31 12:42:31','',2145,'https://www.datarainbow.eu/?p=2164',0,'revision','',0),