INSERT INTO `wp_posts` (`ID`, `post_author`, `post_date`, `post_date_gmt`, `post_content`, `post_title`, `post_excerpt`, `post_status`, `comment_status`, `ping_status`, `post_password`, `post_name`, `to_ping`, `pinged`, `post_modified`, `post_modified_gmt`, `post_content_filtered`, `post_parent`, `guid`, `menu_order`, `post_type`, `post_mime_type`, `comment_count`) VALUES (2185,1,'2021-07-31 19:59:18','2021-07-31 19:59:18','<!-- wp:paragraph -->\n<p>Unofficial translation of the La Quadrature du Net Claim to the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>”</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li><ul><li><em> 2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030<br>3 p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\". </em></li><li>3. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\" </em></li></ul></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which consent is requested cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real<br>choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p. 11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em><br><strong>2.1.1.3. Fairness of the request for consent</strong></li></ul></li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly. The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>11. p. 16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\" </em></li><li><em>12. p. 17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br><strong>2.1.3. Legitimate interest</strong></li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or may not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>13. p. 8, free translation of “<em>According to Opinion 06/2014 of WP29, the term<br>“ necessary for the performance of a contract ”needs to be interpreted strictly. The processing must be necessary to fulfill the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 issuing a financial penalty against the companies FACEBOOK INC. and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments. The G29,<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two conditions alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications ”directive ”. Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can only be authorised if it targets subscribers who have given their prior consent</em>”. The right to object is no longer sufficient: the legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.<ul><li>15 Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http:/ /ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf 11/19\" target=\"_blank\">is accessible here</a>. </li></ul></li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices. First, the way prospecting material is<br>disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads<br>now also appear on smartphone and computer screens. In the near future, advertising could be integrated<br>into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods. </em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of commercial prospecting , the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/201316, on Big Data and Open Data: “<em>free, specific, informed and unmistakable prior consent should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)</li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<ul><li>22. The Amazon “Ads based on your interests” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion% 2A = 1 &amp;% 2Aentries % 2A = 0 &amp; nodeId = 201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of<br>this complaint, where it is described on May 28, 2018<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ul></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><strong>2.3.&nbsp;Iunlawfull processing</strong></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 19:59:18','2021-07-31 19:59:18','',2145,'https://www.datarainbow.eu/?p=2185',0,'revision','',0),(2184,1,'2021-07-31 19:39:21','2021-07-31 19:39:21','<!-- wp:paragraph -->\n<p>Unofficial translation of the La Quadrature du Net Claim to the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public interest and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1. Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1. Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li>4. <em>p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p. 11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em><br><strong>2.1.1.3. Fairness of the request for consent</strong></li></ul></li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p. 16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly. The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p. 17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p. 8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly. The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br><strong>2.1.3. Legitimate interest</strong></li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or may not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC. and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments. The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two conditions alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications ”directive ”. Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can only be authorised if it targets subscribers who have given their prior consent</em>”. The right to object is no longer sufficient: the legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices. First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens. In the near future, advertising could be integrated into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods. </em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of commercial prospecting , the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable prior consent should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure. In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information brokerage , location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p. 46, translation given in G29 opinion 06/2014, p. 52</li><li>18. p. 28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure. In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p. 45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p. 46, translation given in G29 opinion 06/2014, p. 52<br><br><strong>2.2. Treatments carried out</strong><br><strong>2.2.1. Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br><strong>2.2.2. Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest- based advertisements for features, products and services that may be of interest to you.\" He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon sites, content or services </em>.\" In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement. Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3. Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services. To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising targeting processing . As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><strong>2.3. Iunlawfull processing</strong></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior consent of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 19:39:21','2021-07-31 19:39:21','',2145,'https://www.datarainbow.eu/?p=2184',0,'revision','',0),(2186,1,'2021-07-31 20:01:19','2021-07-31 20:01:19','<!-- wp:paragraph -->\n<p>Unofficial translation of the La Quadrature du Net Claim to the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public interest and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1. Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1. Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3 p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li>4. <em>p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p. 11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em><br><strong>2.1.1.3. Fairness of the request for consent</strong></li></ul></li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p. 16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly. The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p. 17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p. 8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly. The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br><strong>2.1.3. Legitimate interest</strong></li><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or may not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC. and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments. The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two conditions alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications ”directive ”. Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can only be authorised if it targets subscribers who have given their prior consent</em>”. The right to object is no longer sufficient: the legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices. First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens. In the near future, advertising could be integrated into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods. </em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of commercial prospecting , the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable prior consent should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure. In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information brokerage , location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p. 46, translation given in G29 opinion 06/2014, p. 52</li><li>18. p. 28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure. In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p. 45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p. 46, translation given in G29 opinion 06/2014, p. 52<br><br><strong>2.2. Treatments carried out</strong><br><strong>2.2.1. Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br><strong>2.2.2. Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest- based advertisements for features, products and services that may be of interest to you.\" He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon sites, content or services </em>.\" In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement. Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3. Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services. To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising targeting processing . As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3. Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior consent of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 20:01:19','2021-07-31 20:01:19','',2145,'https://www.datarainbow.eu/?p=2186',0,'revision','',0),(2187,1,'2021-07-31 20:09:42','2021-07-31 20:09:42','<!-- wp:paragraph -->\n<p>Unofficial translation of the La Quadrature du Net Claim to the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public interest and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1. Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1. Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p. 11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em><br><strong>2.1.1.3. Fairness of the request for consent</strong></li></ul></li><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p. 16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly. The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p. 17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p. 8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly. The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3. Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or may not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC. and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments. The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two conditions alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications ”directive ”. Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can only be authorised if it targets subscribers who have given their prior consent</em>”. The right to object is no longer sufficient: the legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices. First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens. In the near future, advertising could be integrated into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods. </em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of commercial prospecting , the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable prior consent should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure. In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information brokerage , location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p. 46, translation given in G29 opinion 06/2014, p. 52</li><li>18. p. 28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure. In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p. 45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p. 46, translation given in G29 opinion 06/2014, p. 52<br><br><strong>2.2. Treatments carried out</strong><br><strong>2.2.1. Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.<br><strong>2.2.2. Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest- based advertisements for features, products and services that may be of interest to you.\" He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon sites, content or services </em>.\" In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement. Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3. Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services. To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising targeting processing . As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3. Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior consent of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 20:09:42','2021-07-31 20:09:42','',2145,'https://www.datarainbow.eu/?p=2187',0,'revision','',0),(2188,1,'2021-07-31 20:11:00','2021-07-31 20:11:00','<!-- wp:paragraph -->\n<p>Unofficial translation of the La Quadrature du Net Claim to the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public interest and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1. Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1. Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p. 16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p. 17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. <sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical example a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11). For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p. 11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service. ”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying. For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users to Facebook , on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant negative consequences since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p. 8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3. Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would allow himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent). In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right misleading. to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent. To give the impression that data will be processed on the basis of consent, when in fact it will be processed on another legal basis, would be fundamentally unfair to individuals. In other words, the data controller cannot exchange consent with other legal bases. For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced. It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent. Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p. 16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution. For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased. Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example. Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent purpose than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly. The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p. 17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p. 8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly. The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3. Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or may not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC. and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments. The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two conditions alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications ”directive ”. Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can only be authorised if it targets subscribers who have given their prior consent</em>”. The right to object is no longer sufficient: the legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices. First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens. In the near future, advertising could be integrated into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods. </em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of commercial prospecting , the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable prior consent should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure. In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information brokerage , location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p. 46, translation given in G29 opinion 06/2014, p. 52</li><li>18. p. 28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure. In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p. 45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p. 46, translation given in G29 opinion 06/2014, p. 52<br><br><strong>2.2. Treatments carried out</strong><br><strong>2.2.1. Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2. Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest- based advertisements for features, products and services that may be of interest to you.\" He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon sites, content or services </em>.\" In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement. Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3. Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services. To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising targeting processing . As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3. Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior consent of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 20:11:00','2021-07-31 20:11:00','',2145,'https://www.datarainbow.eu/?p=2188',0,'revision','',0),(2190,1,'2021-07-31 22:51:32','2021-07-31 22:51:32','<!-- wp:paragraph -->\n<p>Unofficial translation of the La Quadrature du Net Claim to the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-07-31 22:51:32','2021-07-31 22:51:32','',2145,'https://www.datarainbow.eu/?p=2190',0,'revision','',0),(2191,1,'2021-07-31 22:53:13','2021-07-31 22:53:13','<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A panel discussion moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , Scott Wilson Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a <a href=\"https://www.grcworldforums.com/global/schrems-ii-and-international-data-transfers-the-journey-to-a-new-privacy-shield-and-who-is-leading-the-way/2035.article?adredir=1\" target=\"_blank\" rel=\"noreferrer noopener\">Privsec Webinar Tuesday 22nd of June at 12 BST.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent&nbsp;<a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a href=\"https://ec.europa.eu/transparency/comitology-register/screen/documents/074379/1/consult?lang=en\" data-type=\"URL\" data-id=\"https://ec.europa.eu/transparency/comitology-register/screen/documents/074379/1/consult?lang=en\" target=\"_blank\" rel=\"noreferrer noopener\">Comitology committee</a> met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, on 18 June 2021 the Commission adopted the <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">new Standard Contractual Clauses</a> long awaited, for transfers of personal data to third countries as the GDPR prohibits the transfer of personal data to a country outside the EU unless the third country has been deemed adequate by the European Commission or one of the prescribed transfer mechanisms are in place. The role of the standard contractual clauses is limited to ensuring appropriate data protection safeguards for international data transfers. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, the <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\">EDPB</a> adopted its<a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data - Version 2.0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of&nbsp;<a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679&nbsp;</a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a>&nbsp;(commercial organisations),&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a>&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a>&nbsp;as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Footnote 12 :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>the Parties have to take into <strong>account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information</strong> on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to&nbsp;<a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to&nbsp;<a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to&nbsp;<a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data encryption</strong> can help, when the encryption key remain in Europe. That does not solve the problem when data needs to be accessed/processed in the country of import.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><a href=\"https://gdprinfo.info/#a13.1.f\">Article 13(1)(f)</a> and <a href=\"https://gdprinfo.info/#a14.1.f\">Article 14(1)(f)</a></p><p>Obligation of the controller to provide data subjects with information about the fact that it intends to transfer their personal data to a third country or in accordance with pursuant to </p><p><a href=\"https://gdprinfo.info/#a46\">Article 46</a> of <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679\">Regulation (EU) 2016/679</a>,</p><p>such information must include a reference to the appropriate safeguards and the means by which to obtain a copy of them or information where they have been made available</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p><p>See also</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(b)</td><td><em>The data importer agrees to submit itself to <strong>the jurisdiction</strong> of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.</em></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start as soon as possible with <strong>data mapping</strong>, <strong>data minimising</strong>, and <strong>securing access</strong>. <strong>Hold the data as a hot potato.</strong> Don’t keep it longer than necessary. Keep your <strong>archives</strong> out of the network. Limit access to data. Train your staff. Be ready for data breach that is not anymore IF but WHEN it happens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never have reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly <strong>data heaven</strong> with the risk of opening backdoors to data transfers to the US. Adequacy decision are to be reviewed after 4 years. Meanwhile, a DPA can challenge the decision based on an individual\'s complaint.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touched at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=ed8505f7-4093-4acd-a00a-9a95c53fc9ef\">Portugal – DPA orders suspension</a>- 27 April 2021</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Portuguese DPA investigated complaints against the national statistics institute (INE) for alleged unlawful data transfers. Census data were shared with a third party in the US. The transfer was based on SCCs, but without any supplementary safeguards put in place.The DPA concluded the INE failed to conduct a DPIA prior ti the use of the third party to process a census data (required because of large scale processing of sensitive data) and had not met the requirements for valid data transfers.The transfer of data was suspended both for transfers to the US and to any other country which does not offer an adequate level of data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a rel=\"noreferrer noopener\" href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" data-type=\"URL\" data-id=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" target=\"_blank\" rel=\"noreferrer noopener\">Case Law Digest 2021: Transfers of personal data to third countries</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit.&nbsp;Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies.&nbsp;Each DPA will independently decide upon its areas of action.&nbsp;Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://Schrems II and International Data Transfers: The Journey to a new Privacy Shield and Who Is Leading the Way\" target=\"_blank\" rel=\"noreferrer noopener\">Schrems II and International Data Transfers: The Journey to a new Privacy Shield and Who Is Leading the Way available on demand.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This document does not constitute a legal advice. Simply a fresh analyse of the recent publications.</p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','A panel discussion moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , Scott Wilson Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.','inherit','closed','closed','','2054-revision-v1','','','2021-07-31 22:53:13','2021-07-31 22:53:13','',2054,'https://www.datarainbow.eu/?p=2191',0,'revision','',0),(2192,1,'2021-07-31 22:55:15','2021-07-31 22:55:15','<!-- wp:heading {\"level\":3} -->\n<h3>the modern Cassandra Complex - By <a href=\"https://www.linkedin.com/in/daniel-aldridge-2a93922b/\">Daniel Aldridge</a> Senior Policy &amp; Programmes Manager at BCS, The Chartered Institute for IT</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Published on March 12, 2021</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I\'m never one to shy away from a niche topic, especially one at the vanguard of politics and technology, so I was happy to speak at the Holyrood Connect event last week on cyber security and data protection post Brexit. <a rel=\"noreferrer noopener\" href=\"https://cybersecurityni.holyrood.com/agenda\" target=\"_blank\">Public Sector Cyber Security Northern Ireland</a> Especially as increasingly I feel that we in the IT and digital communities are are suffering from a modern Cassandra complex where we know there are existential threats that need action, but its so often being put in the too-difficult box.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the panel, I was joined by fellow BCS member, lawyer and Data Protection Consultant, Tara Taubman-Bassirian of Data Rainbow; Joseph Byrne, Privacy Solutions Engineer at OneTrust and the event chair, David Lee, formerly of The Scotsman. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I spent 6 years working in Scottish public policy and campaigns and I’m no stranger to Holyrood Connect as a force for good in addressing the critical digital issues of our times and its place as a strong voice for devolved administrations. Also, the Chartered Institute has sizeable active membership in Scotland, Northern Ireland and Wales and it’s been personal commitment of mine to drive greater engagement and collaboration across the UK’s rich tech landscape so the future of IT and digital technologies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chartered Institute is primarily a network of its people and over the past 12 months it’s been amazing how our members and the wider IT and digital communities have continued to make IT good for society whilst we all face huge and unprecedented threats.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IT workers really are the unsung heroes of the pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s important to note that in the context of rapid service and product delivery changes etc; organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But the problem for many of us working in this area is that so many of our organisations are caught up in this perfect storm without even the awareness they need legal advice and expertise, let alone having it in house.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A big bug bear for me and my colleagues is the absence of CIOs or equivalent at the highest levels of organisational decision making and risk management.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hear often about an encouraging rise in the amount of boards with a dedicated person with responsibility for cyber and data security and protection; but in many situations, it does feel very much like when boards were encouraged to appoint a diversity champion, the person was often not appointed based on real knowledge or expertise and were asked to ‘take on’ the brief. In both cases, the board member often relies almost exclusively on the briefing of the IT team with much lost in translation and debate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When we look at how many Boards include a CIO or equivalent, the picture is problematic, only 10 -20% of NHS organisations for example have a CIO or equivalent at the highest level of decision making and risk management<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the demand is there though for better, tech led decision making!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The past decade has seen a cottage industry grow up around supporting technologists to speak effectively with boards and decision makers; this is why we are so keen to drive professional standards and professional development across the IT world to drive up this capacity to support innovation and mitigate risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A new data regime ushered in by the UK’s Data Strategy will reiterate the need for effective data maintenance and governance while removing obstacles and impediments to innovation, an opportunity to basically clean up our digital processes and make them fit for a more dynamic digital infrastructure. Indeed the new information commissioner’s job specification<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;requires a drive to do just that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This aside, despite the sabre rattling from both sides over the past few months, most of the signs indicate that the UK and EU want to cooperate on a number of key areas such as enforcement, cyber security, copyright infringement, IP, tech sovereignty and certain areas of competition. This may well mean that the ICO will turn its attention more meaningfully to scrutinising data governance procedures, while also calling out over-burdensome procedures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite no clear public desire to needlessly interrupt trade, it’s unclear how long an adequacy agreement, if finally ratified by EU states, can be sustainable. As a third country, the UK will be susceptible to judicial review similar to Schrems 2 and outside the EU, we’ll be held to a higher standard.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To be competitive the UK needs to show it is dynamic and has a commercial edge over the EU in certain areas, data will be one of those areas; the political and legal challenges are however huge!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Make no mistake, privacy campaigners have the UK in their sights and will seek to make this the next battleground, so depending on where and how we plan to flex our independence on things like human rights legislation etc, there will be a need for preparatory action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what can we do…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>listen to and champion your IT and data protection people to help get our houses in order</li><li>Continue to drive up professional standards and champion the mitigation of risk across the economy and civil society</li><li>Raise the issues you care about with your elected officials, I don\'t think there is enough literacy at national, devolved or local government level for us to reap the benefits, we should be aiming to thrive, not just survive</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We’re all learning ‘on the job’ on this so let’s continue to have these conversations, mainstream the issues and make sure we’re ahead of the game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref1\" target=\"_blank\">[1]</a>&nbsp;<a href=\"https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/\" target=\"_blank\" rel=\"noreferrer noopener\">Networks issues open letter to get CCIOs and CIOs on NHS boards</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref2\" target=\"_blank\">[2]</a>&nbsp;<a rel=\"noreferrer noopener\" href=\"https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/\" target=\"_blank\">HM Government Public Appointments</a></p>\n<!-- /wp:paragraph -->','Beyond Brexit: Cyber Security and Data Protection','It’s important to note that in the context of rapid service and product delivery changes etc; organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!','inherit','closed','closed','','2026-revision-v1','','','2021-07-31 22:55:15','2021-07-31 22:55:15','',2026,'https://www.datarainbow.eu/?p=2192',0,'revision','',0),(2193,1,'2021-07-31 22:57:48','2021-07-31 22:57:48','<!-- wp:paragraph -->\n<p>Legal and Regulatory Responses to Technology Challenges</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Octobre 2020, I participated to this online event organised by the Practicing Law Institute PLI.  I participated, along with EU and US experts, on the first panel on E.U. Developments in Platform Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pli.edu/programs/online-platforms\">The material remains available on demand until Octobre 2021.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I focused on Chapitre V, Lawful data transfer and the Schrems-II European Court of Justice decision in July 2020. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During the day, various speakers develop other aspects of online platforms:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Learn about the geopolitical and industry rivalries and debates about platforms and popular technologies</li><li>Hear about the implications of Brexit for platform regulations</li><li>Understand how the pandemic has affected, and will profoundly affect, issues relating to privacy, surveillance, AI and algorithms, and other topics</li><li>Gain insight into the politicization of social media platforms and communication technologies</li><li>Find connections among seemingly disparate topics of hate speech, copyright, and “fake news” through the lens of “content moderation”</li><li>Benefit from perspectives of seasoned in-house counsel, advisors, and litigators</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":1068} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/11/Screenshot-2020-10-21-at-18.29.03-1024x489.png\" alt=\"\" class=\"wp-image-1068\"/></figure>\n<!-- /wp:image -->','Online Platforms and Popular Technologies 2020','Legal and Regulatory Responses to Technology Challenges Octobre 2020 online In Octobre 2020, I participated to this online ','inherit','closed','closed','','1074-autosave-v1','','','2021-07-31 22:57:48','2021-07-31 22:57:48','',1074,'https://www.datarainbow.eu/?p=2193',0,'revision','',0),(2194,1,'2021-07-31 22:58:23','2021-07-31 22:58:23','<!-- wp:paragraph -->\n<p>Legal and Regulatory Responses to Technology Challenges</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Octobre 2020, I participated to this online event organised by the Practicing Law Institute PLI.  I participated, along with EU and US experts, on the first panel on E.U. Developments in Platform Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pli.edu/programs/online-platforms\">The material remains available on demand until Octobre 2021.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I focused on Chapitre V, Lawful data transfer and the Schrems-II European Court of Justice decision in July 2020. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During the day, various speakers develop other aspects of online platforms:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Learn about the geopolitical and industry rivalries and debates about platforms and popular technologies</li><li>Hear about the implications of Brexit for platform regulations</li><li>Understand how the pandemic has affected, and will profoundly affect, issues relating to privacy, surveillance, AI and algorithms, and other topics</li><li>Gain insight into the politicization of social media platforms and communication technologies</li><li>Find connections among seemingly disparate topics of hate speech, copyright, and “fake news” through the lens of “content moderation”</li><li>Benefit from perspectives of seasoned in-house counsel, advisors, and litigators</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":1068} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/11/Screenshot-2020-10-21-at-18.29.03-1024x489.png\" alt=\"\" class=\"wp-image-1068\"/></figure>\n<!-- /wp:image -->','Online Platforms and Popular Technologies 2020','Legal and Regulatory Responses to Technology Challenges, online event organised by the Practicing Law Institute PLI.','inherit','closed','closed','','1074-revision-v1','','','2021-07-31 22:58:23','2021-07-31 22:58:23','',1074,'https://www.datarainbow.eu/?p=2194',0,'revision','',0),(2195,1,'2021-07-31 23:01:19','2021-07-31 23:01:19','<!-- wp:paragraph -->\n<p>We have recently looked at Artificial Intelligence, after <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian?trk=mp-author-card\" target=\"_blank\">Police wearable cameras</a>, <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/police-3d-printed-murder-victims-finger-unlock-his-taubman-bassirian?trk=mp-author-card\" target=\"_blank\">Police 3D Printing a digital finger</a>, <a rel=\"noreferrer noopener\" href=\"https://www.theguardian.com/technology/2016/jul/08/police-bomb-robot-explosive-killed-suspect-dallas\" target=\"_blank\">Police killing robots</a>, here comes a look at drones and <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\">\'driveless\'</a>or<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\"> \'autonomus\' cars</a>. <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/google-driveless/id16157941\" target=\"_blank\">Google</a> initiated the path, <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/telsa-cars/id16157944\" target=\"_blank\">Telsa</a> has been in the news for a recent accident. <a rel=\"noreferrer noopener\" href=\"http://fusion.net/story/324731/security-robot-runs-over-child/\" target=\"_blank\">\'Security robot accidentally attacks child\'</a>. Finally, but not the last incident to report, a <a rel=\"noreferrer noopener\" href=\"http://www.telegraph.co.uk/news/worldnews/asia/southkorea/11399713/Robot-vacuum-cleaner-attacks-South-Korea-housewifes-hair.html\" target=\"_blank\">\'Robot vacuum cleaner \'attacks\' South Korea housewife\'s hair\'. </a>All incidents that raise questions: what regulation and what ethics? Should a driver car put the driver\'s safety first or the road safety?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, there is no easy answer. Widely helped by Al Macintyre who has been collecting resources on these subjects. Thanks to the collaborative tool Pearltrees, here are more material for whoever interested on these subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jules Polonetsky from the Future of Privacy Forum has been active.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'&nbsp;<em>in response to the Administration’s&nbsp;<a href=\"https://www.whitehouse.gov/webform/national-call-commitments-use-unmanned-aircraft-systems-protect-privacy-benefit-society-and-\" target=\"_blank\" rel=\"noreferrer noopener\">call-to-action</a>&nbsp;on privacy protections related to drone operations,&nbsp;<a href=\"https://fpf.org/\" target=\"_blank\" rel=\"noreferrer noopener\">Future of Privacy Forum (FPF)</a>,&nbsp;<a href=\"http://www.intel.com/\" target=\"_blank\" rel=\"noreferrer noopener\">Intel</a>, and&nbsp;<a href=\"http://www.precisionhawk.com/\" target=\"_blank\" rel=\"noreferrer noopener\">PrecisionHawk</a>&nbsp;released&nbsp;<a href=\"http://fpf.org/wp-content/uploads/2016/08/Drones_and_Privacy_by_Design_FPF_Intel_PrecisionHawk.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Drones and Privacy by Design: Embedding Privacy Enhancing Technology in Unmanned Aircraft</a>. The report highlights examples of privacy enhancing technologies and “Privacy-by-Design” applied to drones.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"Drones and Privacy by Design describes techniques that can be used to safeguard privacy and support responsible data practices, including practices described in the May 2016 stakeholder-drafted&nbsp;<a href=\"https://www.ntia.doc.gov/files/ntia/publications/uas_privacy_best_practices_6-21-16.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Voluntary Best Practices for UAS Privacy, Transparency, and Accountability</a>.&nbsp; “The best practices were developed through hard-won consensus within the drone community,” said John Verdi, FPF’s Vice President of Policy. “They articulate important principles that should guide drone operators’ data practices, and today’s report describes practical safeguards that can help operators implement those principles.”</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;One scholar has long been studying the legal and ethical issues,&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/ryan-calo/id16152989\" target=\"_blank\" rel=\"noreferrer noopener\">Ryan Calo</a>. I have collected most of his work, papers, interviews and videos.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>All to be found&nbsp;<a href=\"http://www.pearltrees.com/dronelaw\" target=\"_blank\" rel=\"noreferrer noopener\">here.</a>&nbsp;Drones and&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\" rel=\"noreferrer noopener\">Driveless cars</a>&nbsp;with elements of regulations in most western countries.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;A good read in The Economist :&nbsp;<a href=\"http://www.economist.com/blogs/democracyinamerica/2015/03/drones-and-privacy\" target=\"_blank\" rel=\"noreferrer noopener\">\' Drones and privacy. A looming threat\'.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Picture, \'Le Monde Sans Dessus Dessous\', Photography by Tara Taubman Bassirian.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><strong>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</strong></em>Report this</p>\n<!-- /wp:paragraph -->','Drones, Autonomus Cars, Ethics and Regulation','Artificial Intelligence, Police wearable cameras, Police 3D Printing a digital finger, Police killing robots, here comes a look at drones and \'driveless\'or \'autonomus\' cars. Google initiatives, Telsa on the news for a recent accident. \'Security robot accidentally attacks child\'.','inherit','closed','closed','','831-autosave-v1','','','2021-07-31 23:01:19','2021-07-31 23:01:19','',831,'https://www.datarainbow.eu/?p=2195',0,'revision','',0),(2196,1,'2021-07-31 23:01:22','2021-07-31 23:01:22','<!-- wp:paragraph -->\n<p>We have recently looked at Artificial Intelligence, after <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian?trk=mp-author-card\" target=\"_blank\">Police wearable cameras</a>, <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/police-3d-printed-murder-victims-finger-unlock-his-taubman-bassirian?trk=mp-author-card\" target=\"_blank\">Police 3D Printing a digital finger</a>, <a rel=\"noreferrer noopener\" href=\"https://www.theguardian.com/technology/2016/jul/08/police-bomb-robot-explosive-killed-suspect-dallas\" target=\"_blank\">Police killing robots</a>, here comes a look at drones and <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\">\'driveless\'</a>or<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\"> \'autonomus\' cars</a>. <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/google-driveless/id16157941\" target=\"_blank\">Google</a> initiated the path, <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/telsa-cars/id16157944\" target=\"_blank\">Telsa</a> has been in the news for a recent accident. <a rel=\"noreferrer noopener\" href=\"http://fusion.net/story/324731/security-robot-runs-over-child/\" target=\"_blank\">\'Security robot accidentally attacks child\'</a>. Finally, but not the last incident to report, a <a rel=\"noreferrer noopener\" href=\"http://www.telegraph.co.uk/news/worldnews/asia/southkorea/11399713/Robot-vacuum-cleaner-attacks-South-Korea-housewifes-hair.html\" target=\"_blank\">\'Robot vacuum cleaner \'attacks\' South Korea housewife\'s hair\'. </a>All incidents that raise questions: what regulation and what ethics? Should a driver car put the driver\'s safety first or the road safety?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, there is no easy answer. Widely helped by Al Macintyre who has been collecting resources on these subjects. Thanks to the collaborative tool Pearltrees, here are more material for whoever interested on these subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jules Polonetsky from the Future of Privacy Forum has been active.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'&nbsp;<em>in response to the Administration’s&nbsp;<a href=\"https://www.whitehouse.gov/webform/national-call-commitments-use-unmanned-aircraft-systems-protect-privacy-benefit-society-and-\" target=\"_blank\" rel=\"noreferrer noopener\">call-to-action</a>&nbsp;on privacy protections related to drone operations,&nbsp;<a href=\"https://fpf.org/\" target=\"_blank\" rel=\"noreferrer noopener\">Future of Privacy Forum (FPF)</a>,&nbsp;<a href=\"http://www.intel.com/\" target=\"_blank\" rel=\"noreferrer noopener\">Intel</a>, and&nbsp;<a href=\"http://www.precisionhawk.com/\" target=\"_blank\" rel=\"noreferrer noopener\">PrecisionHawk</a>&nbsp;released&nbsp;<a href=\"http://fpf.org/wp-content/uploads/2016/08/Drones_and_Privacy_by_Design_FPF_Intel_PrecisionHawk.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Drones and Privacy by Design: Embedding Privacy Enhancing Technology in Unmanned Aircraft</a>. The report highlights examples of privacy enhancing technologies and “Privacy-by-Design” applied to drones.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"Drones and Privacy by Design describes techniques that can be used to safeguard privacy and support responsible data practices, including practices described in the May 2016 stakeholder-drafted&nbsp;<a href=\"https://www.ntia.doc.gov/files/ntia/publications/uas_privacy_best_practices_6-21-16.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Voluntary Best Practices for UAS Privacy, Transparency, and Accountability</a>.&nbsp; “The best practices were developed through hard-won consensus within the drone community,” said John Verdi, FPF’s Vice President of Policy. “They articulate important principles that should guide drone operators’ data practices, and today’s report describes practical safeguards that can help operators implement those principles.”</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;One scholar has long been studying the legal and ethical issues,&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/ryan-calo/id16152989\" target=\"_blank\" rel=\"noreferrer noopener\">Ryan Calo</a>. I have collected most of his work, papers, interviews and videos.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>All to be found&nbsp;<a href=\"http://www.pearltrees.com/dronelaw\" target=\"_blank\" rel=\"noreferrer noopener\">here.</a>&nbsp;Drones and&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\" rel=\"noreferrer noopener\">Driveless cars</a>&nbsp;with elements of regulations in most western countries.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;A good read in The Economist :&nbsp;<a href=\"http://www.economist.com/blogs/democracyinamerica/2015/03/drones-and-privacy\" target=\"_blank\" rel=\"noreferrer noopener\">\' Drones and privacy. A looming threat\'.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Picture, \'Le Monde Sans Dessus Dessous\', Photography by Tara Taubman Bassirian.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><strong>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</strong></em>Report this</p>\n<!-- /wp:paragraph -->','Drones, Autonomus Cars, Ethics and Regulation','Artificial Intelligence, Police wearable cameras, Police 3D Printing a digital finger, Police killing robots, here comes a look at drones and \'driveless\'or \'autonomus\' cars. Google initiatives, Telsa on the news for a recent accident. \'Security robot accidentally attacks child\'.','inherit','closed','closed','','831-revision-v1','','','2021-07-31 23:01:22','2021-07-31 23:01:22','',831,'https://www.datarainbow.eu/?p=2196',0,'revision','',0),(2197,1,'2021-07-31 23:01:50','2021-07-31 23:01:50','<!-- wp:paragraph -->\n<p>We have recently looked at Artificial Intelligence, after <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian?trk=mp-author-card\" target=\"_blank\">Police wearable cameras</a>, <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/police-3d-printed-murder-victims-finger-unlock-his-taubman-bassirian?trk=mp-author-card\" target=\"_blank\">Police 3D Printing a digital finger</a>, <a rel=\"noreferrer noopener\" href=\"https://www.theguardian.com/technology/2016/jul/08/police-bomb-robot-explosive-killed-suspect-dallas\" target=\"_blank\">Police killing robots</a>, here comes a look at drones and <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\">\'driveless\'</a>or<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\"> \'autonomus\' cars</a>. <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/google-driveless/id16157941\" target=\"_blank\">Google</a> initiated the path, <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/telsa-cars/id16157944\" target=\"_blank\">Telsa</a> has been in the news for a recent accident. <a rel=\"noreferrer noopener\" href=\"http://fusion.net/story/324731/security-robot-runs-over-child/\" target=\"_blank\">\'Security robot accidentally attacks child\'</a>. Finally, but not the last incident to report, a <a rel=\"noreferrer noopener\" href=\"http://www.telegraph.co.uk/news/worldnews/asia/southkorea/11399713/Robot-vacuum-cleaner-attacks-South-Korea-housewifes-hair.html\" target=\"_blank\">\'Robot vacuum cleaner \'attacks\' South Korea housewife\'s hair\'. </a>All incidents that raise questions: what regulation and what ethics? Should a driver car put the driver\'s safety first or the road safety?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, there is no easy answer. Widely helped by Al Macintyre who has been collecting resources on these subjects. Thanks to the collaborative tool Pearltrees, here are more material for whoever interested on these subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jules Polonetsky from the Future of Privacy Forum has been active.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'&nbsp;<em>in response to the Administration’s&nbsp;<a href=\"https://www.whitehouse.gov/webform/national-call-commitments-use-unmanned-aircraft-systems-protect-privacy-benefit-society-and-\" target=\"_blank\" rel=\"noreferrer noopener\">call-to-action</a>&nbsp;on privacy protections related to drone operations,&nbsp;<a href=\"https://fpf.org/\" target=\"_blank\" rel=\"noreferrer noopener\">Future of Privacy Forum (FPF)</a>,&nbsp;<a href=\"http://www.intel.com/\" target=\"_blank\" rel=\"noreferrer noopener\">Intel</a>, and&nbsp;<a href=\"http://www.precisionhawk.com/\" target=\"_blank\" rel=\"noreferrer noopener\">PrecisionHawk</a>&nbsp;released&nbsp;<a href=\"http://fpf.org/wp-content/uploads/2016/08/Drones_and_Privacy_by_Design_FPF_Intel_PrecisionHawk.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Drones and Privacy by Design: Embedding Privacy Enhancing Technology in Unmanned Aircraft</a>. The report highlights examples of privacy enhancing technologies and “Privacy-by-Design” applied to drones.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"Drones and Privacy by Design describes techniques that can be used to safeguard privacy and support responsible data practices, including practices described in the May 2016 stakeholder-drafted&nbsp;<a href=\"https://www.ntia.doc.gov/files/ntia/publications/uas_privacy_best_practices_6-21-16.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Voluntary Best Practices for UAS Privacy, Transparency, and Accountability</a>.&nbsp; “The best practices were developed through hard-won consensus within the drone community,” said John Verdi, FPF’s Vice President of Policy. “They articulate important principles that should guide drone operators’ data practices, and today’s report describes practical safeguards that can help operators implement those principles.”</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;One scholar has long been studying the legal and ethical issues,&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/ryan-calo/id16152989\" target=\"_blank\" rel=\"noreferrer noopener\">Ryan Calo</a>. I have collected most of his work, papers, interviews and videos.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>All to be found&nbsp;<a href=\"http://www.pearltrees.com/dronelaw\" target=\"_blank\" rel=\"noreferrer noopener\">here.</a>&nbsp;Drones and&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\" rel=\"noreferrer noopener\">Driveless cars</a>&nbsp;with elements of regulations in most western countries.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;A good read in The Economist :&nbsp;<a href=\"http://www.economist.com/blogs/democracyinamerica/2015/03/drones-and-privacy\" target=\"_blank\" rel=\"noreferrer noopener\">\' Drones and privacy. A looming threat\'.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Picture, \'Le Monde Sans Dessus Dessous\', Photography by Tara Taubman Bassirian.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><strong>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</strong></em>Report this</p>\n<!-- /wp:paragraph -->','Drones, Autonomous Cars, Ethics and Regulation','Artificial Intelligence, Police wearable cameras, Police 3D Printing a digital finger, Police killing robots, here comes a look at drones and \'driveless\'or \'autonomus\' cars. Google initiatives, Telsa on the news for a recent accident. \'Security robot accidentally attacks child\'.','inherit','closed','closed','','831-revision-v1','','','2021-07-31 23:01:50','2021-07-31 23:01:50','',831,'https://www.datarainbow.eu/?p=2197',0,'revision','',0),(2198,1,'2021-07-31 23:04:06','2021-07-31 23:04:06','<!-- wp:paragraph -->\n<p>In this digital era, freely available data is overwhelming. Data storage has become excessively&nbsp;cheap or free. Access to valid information is capital.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the light of the recent terrorists attacks, our Western intelligence agencies have proved to have missed this ability of efficiently process the mass of collected data. They were not able to prevail terrorists attacks. Mohammed Mehra,&nbsp;<a href=\"http://www.pearltrees.com/clarinette02/amedy-coulibaly-freres-kouashi/id13426226\" target=\"_blank\" rel=\"noreferrer noopener\">Amedy Coulibaly, or the brother Kouashi</a>, they were all known and tracked by security agencies,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what went wrong? Probably the right process and analysis of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What every organisation could learn from this experience?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Mass data or more sophistically called ‘Big Data’, is only the step one towards knowledge and wisdom. Processed data that is organised and accurate is worthy of gold. As for personal information, data minimisation, accuracy and data not kept longer than necessary are the basic requirements of the Data Protection principles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing how efficiently organize information with minimal cost is crucial.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>that brings me to the Peartrees.&nbsp;<a href=\"https://www.pearltrees.com/\" target=\"_blank\" rel=\"noreferrer noopener\">Pearltrees</a>&nbsp;is a useful tool for collecting and cataloging topics. This free application is a visual and collaborative curation tool to organize, explore and share any URL, document, picture or note. Just like classified paper documents in folders with the ability to duplicate, share, and add editorials, available everywhere, accessible on any electronic device. The curation can be public and shared with other members of the platform or private. Topics are searchable within your own folders or within the community. Very quickly and easily, the Pearltrees can become the ‘<em>place for your interests</em>’. Everywhere you read a piece, your browser App lets you ‘<em>pearl</em>’ the page you are visiting to be stored in a specific file or leave it on your ‘<em>drop zone</em>’ for later. The product features a unique visual interface that allows users to drag and organise collected URLs, and other digital files that themselves can be further organised into collections and sub-collections.You can also engage in&nbsp;<a href=\"http://en.wikipedia.org/wiki/social\" target=\"_blank\" rel=\"noreferrer noopener\">social</a>/<a href=\"http://en.wikipedia.org/wiki/collaborative\" target=\"_blank\" rel=\"noreferrer noopener\">collaborative</a>&nbsp;<a href=\"http://en.wikipedia.org/wiki/digital_curation\" target=\"_blank\" rel=\"noreferrer noopener\">curation</a>&nbsp;using a feature called \'<em>Pearltrees Teams\'</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been \'feeding\' my Pearltrees for some time. I have therefore created an exhaustive collection of concurring publications on the subjects of my specialities, IT/IP law, social media, eCommerce, Privacy and Data Protection, or elearning for the last few years. This mass of information has been organised by theme. Where books, especially law books are fast obsolete, these Pearltrees are an ongoing project that can be constantly updated and maintained.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to&nbsp;<a href=\"http://en.wikipedia.org/wiki/Pearltrees\" target=\"_blank\" rel=\"noreferrer noopener\">Wikipedia</a>&nbsp;“<em>Pearltrees claims to be one of the largest communities of curators on the web;</em>&nbsp;<em>by December 2011, the company claimed to have over 300,000 registered users and as of March 2012 the number had increased to over 400,000.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The company also claims to have broken the one million unique visitors per month barrier in January 2012 and to have received in excess of 30,000,000 page views that same month.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They are few other online tools of information management based on cloud storage such as&nbsp;<a href=\"https://delicious.com/\" target=\"_blank\" rel=\"noreferrer noopener\">Delicious</a>&nbsp;for the oldest,&nbsp;<a href=\"https://www.diigo.com/\" target=\"_blank\" rel=\"noreferrer noopener\">Diigo</a>&nbsp;or&nbsp;<a href=\"https://www.zotero.org/\" target=\"_blank\" rel=\"noreferrer noopener\">Zotero</a>. The Pearltrees has the best visual interface. The same result could be achieved with other tools. The main point is to bookmark, organise and personalise the information easily accessible and shareable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An example of how data can be collected to gather information around a conference is my curation of the major&nbsp;<a href=\"https://clarinettesblog.wordpress.com/2015/01/23/catching-up-with-the-annual-cdpd-conference-in-brussels/\" target=\"_blank\" rel=\"noreferrer noopener\">Computers, Privacy and Data Protection conference this Month in Brussels</a>. Simply click on any square to access the relevant information, would it be a link to a webpage, a Pdf or a text or a picture.<br></p>\n<!-- /wp:paragraph -->','Bigger Than Big Data, Processed Information is Gold','In this digital era, freely available data is overwhelming. Data storage has become excessively cheap or free. Access to valid information is capital.','inherit','closed','closed','','838-revision-v1','','','2021-07-31 23:04:06','2021-07-31 23:04:06','',838,'https://www.datarainbow.eu/?p=2198',0,'revision','',0),(2199,1,'2021-07-31 23:05:56','2021-07-31 23:05:56','<!-- wp:paragraph -->\n<p>By now you must have heard of the incident that happened Sunday 9th of April at the Chicago O\'Hare International Airport. It\'s all over the news.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what happened exactly?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From what we know, it was the last flight on a Sunday evening 5pm from Chicago to Louisville Ky, on a small plane operated by United Express on behalf of the United Airlines. A passenger, Dr. David Dao, 69 years old, internal medicine specialist from Kentucky, was violently removed him from the seat, then dragged out of the plane by three policemen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- It was not the case of an over-booked flight. First correction to what has been largely reported, the flight was not over-booked. All passengers had their tickets and had boarded on the plane. At this point, and once everyone was seated, somehow the company discovered they needed four seats for their own crew to board. According to the company, they used a set of criteria to determine which passengers should be denied access to boarding. Again, remember in this case everyone had been issued boarding passes and seated. So the right to deny boarding was waved by issuing barding passes and allowing passengers inside the plane. In the case of over-booked flight, Rule 25- Boarding Priorities of the airline contract stipulates :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\" If a flight is Oversold, no one may be denied boarding against his/her will until UA or other carrier personnel first ask for volunteers who will give up their reservations willingly in exchange for compensation as determined by UA. If there are not enough volunteers, other Passengers may be denied boarding involuntarily in accordance with UA’s boarding priority:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Passengers who are Qualified Individuals with Disabilities, unaccompanied minors under the age of 18 years, or minors between the ages of 5 to 15 years who use the unaccompanied minor service, will be the last to be involuntarily denied boarding if it is determined by UA that such denial would constitute a hardship.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines\' Own Contract Denied it any Right to Remove Passenger.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"United said in a statement that it needed room on the aircraft to transfer crew for another flight and that it offered $1,000 to customers to give up their seats. When no one volunteered, it selected several passengers to deplane.\" M. Dao was chosen, but United said he refused to get off the plane. The tree other passengers accepted to onboard. M. Dao resisted explaining he had an early morning appointment the next day.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A case of obvious management failure. They should have known they needed the seats before allowing passengers to board. Had they not boarded, they could have better managed the situation at the airport instead of rushing shortly before the take off.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The road distance from Chicago to Louisville is about 5 hours drive. Leaving at 5pm, the crew could still arrive at 10 pm ready for departure the next morning. Next time, they might consider that option.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They preferred to call airport cops to evacuate the 69 years old manu militari, three police officers dragging him on the floor, causing injuries to the passenger.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2- Use of disproportionate force to evacuate the passenger. This article in BoingBoing brings more details : Oversold, understated and authoritarian: debullshitifying the reporting on United\'s \"removal\" of Dr David Dao</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"Dao wasn\'t beaten up by Chicago Police, but by airport cops, who are not part of CPD; what\'s more, the airport cops\' rolls include Richard Zuley, a dirty Chicago homicide detective who quit after a series of wrongful convictions, then worked as an \"interrogator\" at Guantanamo Bay, before boarding a plane in Chicago and beating a passenger unconscious.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Again, and they share my view, that once seated, the place is secured and the passenger should not be involuntarily evacuated. The plane was not over-booked, UAL was giving priority to its own crew.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Rule 21- “Refusal of Transport” lays out the conditions under which a passenger can be removed and refused transport on the aircraft. This includes situations where passengers act in a “disorderly, offensive, abusive, or violent” manner, refuse to comply with the smoking policy, are barefoot or “not properly clothed,” as well as many other situations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It does not appear from the passengers recordings or witnesses that Dr Dao had any offensive behaviour. His resistance only started once they persisted to drag him out.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3- What was the result of the operation?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chicago’s aviation police officers dragged him out of his seat and up the aisle, causing bleeding to his face. Cellphone videos of the incident quickly went viral.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dao suffered a broken nose and concussion, his lawyer said Thursday. He was in a Chicago hospital undergoing treatment for his injuries. He has retained a high-powered Chicago personal injury lawyer, Thomas Demetrio.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The man who was dragged off the United flight just took the first step toward filing a lawsuit</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United faces more questions as dragged passenger hires high-powered attorney</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the Chicago Tribune : \"Demetrio\'s practice centres on medical negligence, product liability, airplane crash and commercial litigation on behalf of plaintiffs and he has negotiated more than $1 billion in settlements, according to the firm\'s website.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Attorney for United Airlines passenger Dao says there will \'probably\' be a lawsuit</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the biggest damage caused is the reputation of the company. The incident was a public relations nightmare for United.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the age of the internet, social media and smartphone recordings, the word get spread at the speed of the light. Video recordings of the incident have gone viral online. Calls to boycott and all kind of sarcasm have followed. The company made a first public statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines confirms that beatings will continue until volunteering improves</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines Training Video.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I Know You’re Mad at United but… (Thoughts from a Pilot Wife About Flight 3411)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At the close of trading Monday, the airline was valued at about $22.49 billion. At around noon on Tuesday, its value had sunk to $21.92 billion, a loss of more than $500 million. By close of trading its value had recovered a bit, to $22.25 billion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines Stock Drops $1.4 Billion After Passenger-Removal Controversy</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines loses $950 million in market value as shares tumble.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How a Disconnected Corporate Culture Cost United Airlines $800 Million Overnight</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially, Instead of apologising and promising to change its protocol, United grew defensive and entrenched itself behind legalistic corporate-speak. The company claimed that its employees had “followed established procedures” to remove the man from the plane—to “re-accommodate” him, in their clunky euphemism—using its legal right to deny people boarding when it overbooks a plane. Consequently, United was strongly criticised for its public handling of the crisis.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially, the company’s CEO placed the blame on Dao for the incident.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On Tuesday, CEO Oscar Munoz called the event \"truly horrific\" publishing a second apology:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"Like you, I continue to be disturbed by what happened on this flight and I deeply apologise to the customer forcibly removed and to all the customers aboard. No one should ever be mistreated this way,\" ...</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"I want you to know that we take full responsibility and we will work to make it right,\" he said. \"It\'s never too late to do the right thing.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Association of Flight Attendants agreed. An involuntary bump \"should never result in a passenger being physically injured,\" spokeswoman Taylor Garland said.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The aviation security officer who pulled the man from his seat was placed on leave Monday, \"pending a thorough review of the situation,\" the Chicago Department of Aviation said in a statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chicago Tribune reports:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>White House spokesman Sean Spicer characterised the incident as \"troubling\" and said he was sure President Donald Trump had seen the video.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, legislators posed their own questions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"Consumer trust and confidence are critical to ensure this industry continues to thrive, and we hope United Airlines will work diligently to immediately address this incident and make necessary improvements to ensure it does not occur again,\" a group of 21 senators wrote in a letter to Munoz.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Separately, four senators sent several questions about the \"very disturbing\" incident in letters to Munoz and Ginger Evans, Chicago\'s aviation commissioner.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The senators said it was \"hard to believe that some combination of better planning, training, communication, or additional incentives\" would not have mitigated the incident or prevented it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Daily Mail reports : Angry United Airlines pilots\' union issue statement denying ALL responsibility for forcible removal of doctor last week and say Chicago cops are to blame</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Americans trust big companies less and less. When Bill Clinton took office in 1993, only 31 percent of Americans said that they had little or no trust in business, according to Gallup.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4- On the Algorithm that selects the un-voluntary passengers to be evacuated. What determined that M. Dao had to evacuate its seats was an algorithm :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"The priority of all other confirmed passengers may be determined based on a passenger’s fare class, itinerary, status of frequent flyer program membership, and the time in which the passenger presents him/herself for check-in without advanced seat assignment.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was this a fair deal? had the passengers not boarded already? A machine, automated, artificial intelligence based selection is less \'arbitrary\' the result is dame to be \'fair\'. However, a human decision could have listened to M. Dao\'s arguments on why he would not agree to give up his seat. Maybe the fact of being of a minority Chinese origin was not innocent to the heat of the conflict. Should the final decision be taken by a human? Some of the questions that will come out more and more often, including with the automated decision making of autonomous cars.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Artificial intelligence: How to avoid racist algorithms</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I strongly recommend the read of Wendy Grossman\'s article on algorithm AI decision making and the United Airlines incident. The automated decision to select the passengers to deplane could have been better explained and eventually accommodate the specific situations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Mark Rasch, Attorney and Cybersecurity Expert, The United Airlines Doctor Debacle, The Law and Crisis Communication</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further reading :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY UNITED WAS LEGALLY WRONG TO DEPLANE DAVID DAO</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines Passenger May Need Surgery, Lawyer Says</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a Creative Commons Attribution 4.0 International License.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Image borrowed from Zizzle.</p>\n<!-- /wp:paragraph -->','United Airlines In Bad Shape','By now you must have heard of the incident that happened Sunday 9th of April at the Chicago O’Hare International Airport. It’s all over the news.','inherit','closed','closed','','814-revision-v1','','','2021-07-31 23:05:56','2021-07-31 23:05:56','',814,'https://www.datarainbow.eu/?p=2199',0,'revision','',0),(2200,1,'2021-07-31 23:26:10','2021-07-31 23:26:10','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An all time easy advice</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lets reflect on two decades of mass collection of data. Massive amount of data necessarily means inaccurate data. Data storage equals data risk. Data risk equal liabilities. Data breach notification needs a fast response within 72 hours. More sensitive the data stored, higher the liability. We are awaiting the class actions in the UK, Lloyd v Google, several others in the EU and the latest in the US against&nbsp;<a href=\"https://www.linkedin.com/pulse/french-court-said-facial-recognition-technology-tara/\" target=\"_blank\" rel=\"noreferrer noopener\">ClearviewAI</a>. Data breach causes harm and loss of control that call for compensation. Nearly everyday we hear the breaking news of a new data breach. It is no more IF but WHEN data breach occurs. It happpens to big organisations as well as small ones.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So in that context, why collecting unnecessary data?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I still hear stories of Data Controllers asking for ID card to respond to a Subject Access Request. Professional Associations, even lawyers, asking for ID card to process documents or key access. I just want to remind of one of the key principals of the GDPR that can keep away from many troubles : DATA MINIMISATION.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consider personal data as a hot potato.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do not collect if you don\'t necessarily need it. Do not keep it longer than necessary, Do not share it with third parties with whom you\'ll become co-controller and therefore liable (Think of all these third parties accessing your visitors data such as Google Analytics or Facebook); Purpose limitation means do not process the personal data for further purposes ; You ought to keep the data accurate, secure and no longer than necessary. Less data you collect and keep, better you are.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an ECJ Advocate General opinion on the validity of consent in the context of the provision of a copy of ID cards required from customers. Why should a telco company need to require to keep ID documents? read more&nbsp;<a href=\"https://datarainbow.eu/2020/03/04/consumer-contracts-and-the-validity-of-consent/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Consider Personal Data as A Hot Potato','An all time easy advice','inherit','closed','closed','','807-revision-v1','','','2021-07-31 23:26:10','2021-07-31 23:26:10','',807,'https://www.datarainbow.eu/?p=2200',0,'revision','',0),(2201,1,'2021-07-31 23:28:04','2021-07-31 23:28:04','<!-- wp:paragraph -->\n<p>Guest post by Kurt Brand, Executive IT Consultant and Interim CDO/CIO/CTO/CISO <br>If you want to do yourself a big favor, please invest a short moment of your precious time to watch this 12 minute New York Times video published on Dec 20, 2019, under the heading \"You should be freaking out about privacy\":&nbsp;<a rel=\"noreferrer noopener\" href=\"https://t1p.de/8pfe?fbclid=IwAR2mQDwX17ReKM0T8z6bu6Cg9V0jMRCNQoFviWCmp7TPaByMoiRqcLaTo2Y\" target=\"_blank\">https://t1p.de/8pfe</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The video explains i.a.:<br>▶︎&nbsp;How your&nbsp;<a href=\"https://www.facebook.com/hashtag/privacy?source=feed_text&amp;epa=HASHTAG\">#privacy</a>&nbsp;is invaded at an industrial scale 24/7 and 365 days/year ;<br>▶︎&nbsp;How your personal information is raided, traded and used against you in terrifying ways, while you are reading this posting ;<br>▶︎&nbsp;How advertising companies, intelligence services and criminals are able to combine small information pieces for building up complete profiles of you (\"digital twins\") ;<br>▶︎&nbsp;How advertising is used to predict and manipulate your individual mood and behavior by addressing your (sometimes even subconscious) weak spots&nbsp;;<br>▶︎&nbsp;How the combination of information from different sources can bring you into serious trouble - deliberately or accidentally ;<br>▶︎&nbsp;How you can be identified even within masses of people by analyzing videos from public&nbsp;<a href=\"https://www.facebook.com/hashtag/surveillance?source=feed_text&amp;epa=HASHTAG\">#surveillance</a>&nbsp;cameras utilizing AI-based face recognition and match this information with publicly available photos of you.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Note: At the end of 2019, the USA FREEDOM Act (former USA PATRIOT Act), that provides the legal basis for government surveillance, was renewed again.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How much of your private information are you really comfortable giving away? Where is your red line? Do you believe it\'s okay, if the entire population is being placed under general suspicion and under surveillance to identify and track a small minority of outlaws and criminals?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Imagine what today\'s surveillance technology in the hands of authoritarian regimes mean for civil rights activists, journalists or lawyers. Surveillance is a means of control and suppression.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The U.S. Constitution comprises no \"Right to Privacy\", even though some US-Americans believe they have such a right. As long as Tech companies spend tens of millions for lobbying the government, the likelihood for effective legislation for protecting citizen\'s privacy is close to zero.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We don\'t need to compromise privacy and liberty to achieve safety. We just need three iron rules :<br>▶︎&nbsp;Privacy is essential to democracy and liberty ;<br>▶︎&nbsp;Everyone should be given the ability to discover who is using his/her personal data and how ;<br>▶︎&nbsp;Our privacy is not something that can be traded in exchange for access to a \"free\" social media app or a smartphone.<br>�<br>Our freedom to think, speak and act, as we want, is key. A society of surveillance is just one step away from a society of submission.<br>From 1933 onwards, Germany was not only ruled by the most radical anti-Semites in history, but they brought about two decisive changes :<br>1. They intensified the latent anti-Semitism in the population, which had developed since the founder\'s crisis in 1873 through the influence of Otto Glagau, Wilhelm Marr or Gustav Freytag, by inciting the Jews as scapegoats<br>2. With the help of the Gestapo, SA and SS, they succeeded in intimidating and keeping the (much larger) passive-critical part of the population in check through a system of surveillance, denunciation and threat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Source and complementary readings :<br>▶︎&nbsp;\"How was Adolf Hitler possible?\" published on November 12, 2019, <a href=\"https://t1p.de/vujt\">in German:</a>&nbsp;&nbsp;(<a href=\"https://t1p.de/5dhc\">English translation</a>&nbsp;) ;<br>▶︎&nbsp;<a href=\"https://t1p.de/ypux\">\"How the U.S. government discredits the U.S. American IT industry\"</a> published on August 20, 2017&nbsp;(in<a href=\"https://t1p.de/89y3\"> German</a>&nbsp;) ;<br>▶︎&nbsp;\"<a href=\"https://t1p.de/inz5\">The spy in your pocket\"</a> published on April 25, 2017:&nbsp;(<a href=\"https://t1p.de/nhlr\">in German</a>) ;<br>▶︎&nbsp;<a href=\"https://t1p.de/2cc0﻿\">\"The digital disruption of warfare\"</a> published on June 11, 2017&nbsp;&nbsp;(only in English so far) ;<br>▶︎&nbsp;\"<a href=\"https://t1p.de/00q3﻿\">Digitalization strategy for countries</a>\" published on February 21, 2018:&nbsp;&nbsp;(<a href=\"https://t1p.de/g08k\">in German</a>) ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With thanks to Kurt Brand.</p>\n<!-- /wp:paragraph -->','You Should be Freaking out About Privacy','If you want to do yourself a big favor, please invest a short moment of your precious time to watch this 12 minute New York Times video published on Dec 20, 2019, under the heading “You should be freaking out about privacy”','inherit','closed','closed','','511-revision-v1','','','2021-07-31 23:28:04','2021-07-31 23:28:04','',511,'https://www.datarainbow.eu/?p=2201',0,'revision','',0),(2203,1,'2021-08-01 10:11:42','2021-08-01 10:11:42','<!-- wp:paragraph -->\n<p><a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is the unofficial translation of the La Quadrature du Net Claim that leads to the Supervisory authority of Luxembourg\'s decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-01 10:11:42','2021-08-01 10:11:42','',2145,'https://www.datarainbow.eu/?p=2203',0,'revision','',0),(2208,1,'2021-08-01 14:24:09','2021-08-01 14:24:09','<!-- wp:paragraph -->\n<p><a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawint would have had the confirmation that the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior consent of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-01 14:24:09','2021-08-01 14:24:09','',2145,'https://www.datarainbow.eu/?p=2208',0,'revision','',0),(2205,1,'2021-08-01 10:46:17','2021-08-01 10:46:17','<!-- wp:paragraph -->\n<p><a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior consent of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-01 10:46:17','2021-08-01 10:46:17','',2145,'https://www.datarainbow.eu/?p=2205',0,'revision','',0),(2390,1,'2022-08-22 16:36:30','2022-08-22 16:36:30','<!-- wp:heading {\"level\":3} -->\n<h3>The modern Cassandra Complex - By <a href=\"https://www.linkedin.com/in/daniel-aldridge-2a93922b/\">Daniel Aldridge</a> Senior Policy &amp; Programmes Manager at BCS, The Chartered Institute for IT</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Published on March 12, 2021</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I\'m never one to shy away from a niche topic, especially one at the vanguard of politics and technology, so I was happy to speak at the Holyrood Connect event last week on cyber security and data protection post Brexit. <a rel=\"noreferrer noopener\" href=\"https://cybersecurityni.holyrood.com/agenda\" target=\"_blank\">Public Sector Cyber Security Northern Ireland</a> Especially as increasingly I feel that we in the IT and digital communities are are suffering from a modern Cassandra complex where we know there are existential threats that need action, but its so often being put in the too-difficult box.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the panel, I was joined by fellow BCS member, lawyer and Data Protection Consultant, Tara Taubman-Bassirian of Data Rainbow; Joseph Byrne, Privacy Solutions Engineer at OneTrust and the event chair, David Lee, formerly of The Scotsman. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I spent 6 years working in Scottish public policy and campaigns and I’m no stranger to Holyrood Connect as a force for good in addressing the critical digital issues of our times and its place as a strong voice for devolved administrations. Also, the Chartered Institute has sizeable active membership in Scotland, Northern Ireland and Wales and it’s been personal commitment of mine to drive greater engagement and collaboration across the UK’s rich tech landscape so the future of IT and digital technologies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chartered Institute is primarily a network of its people and over the past 12 months it’s been amazing how our members and the wider IT and digital communities have continued to make IT good for society whilst we all face huge and unprecedented threats.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IT workers really are the unsung heroes of the pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s important to note that in the context of rapid service and product delivery changes etc; organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But the problem for many of us working in this area is that so many of our organisations are caught up in this perfect storm without even the awareness they need legal advice and expertise, let alone having it in house.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A big bug bear for me and my colleagues is the absence of CIOs or equivalent at the highest levels of organisational decision making and risk management.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hear often about an encouraging rise in the amount of boards with a dedicated person with responsibility for cyber and data security and protection; but in many situations, it does feel very much like when boards were encouraged to appoint a diversity champion, the person was often not appointed based on real knowledge or expertise and were asked to ‘take on’ the brief. In both cases, the board member often relies almost exclusively on the briefing of the IT team with much lost in translation and debate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When we look at how many Boards include a CIO or equivalent, the picture is problematic, only 10 -20% of NHS organisations for example have a CIO or equivalent at the highest level of decision making and risk management<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the demand is there though for better, tech led decision making!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The past decade has seen a cottage industry grow up around supporting technologists to speak effectively with boards and decision makers; this is why we are so keen to drive professional standards and professional development across the IT world to drive up this capacity to support innovation and mitigate risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A new data regime ushered in by the UK’s Data Strategy will reiterate the need for effective data maintenance and governance while removing obstacles and impediments to innovation, an opportunity to basically clean up our digital processes and make them fit for a more dynamic digital infrastructure. Indeed the new information commissioner’s job specification<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;requires a drive to do just that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This aside, despite the sabre rattling from both sides over the past few months, most of the signs indicate that the UK and EU want to cooperate on a number of key areas such as enforcement, cyber security, copyright infringement, IP, tech sovereignty and certain areas of competition. This may well mean that the ICO will turn its attention more meaningfully to scrutinising data governance procedures, while also calling out over-burdensome procedures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite no clear public desire to needlessly interrupt trade, it’s unclear how long an adequacy agreement, if finally ratified by EU states, can be sustainable. As a third country, the UK will be susceptible to judicial review similar to Schrems 2 and outside the EU, we’ll be held to a higher standard.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To be competitive the UK needs to show it is dynamic and has a commercial edge over the EU in certain areas, data will be one of those areas; the political and legal challenges are however huge!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Make no mistake, privacy campaigners have the UK in their sights and will seek to make this the next battleground, so depending on where and how we plan to flex our independence on things like human rights legislation etc, there will be a need for preparatory action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what can we do…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>listen to and champion your IT and data protection people to help get our houses in order</li><li>Continue to drive up professional standards and champion the mitigation of risk across the economy and civil society</li><li>Raise the issues you care about with your elected officials, I don\'t think there is enough literacy at national, devolved or local government level for us to reap the benefits, we should be aiming to thrive, not just survive</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We’re all learning ‘on the job’ on this so let’s continue to have these conversations, mainstream the issues and make sure we’re ahead of the game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref1\" target=\"_blank\">[1]</a>&nbsp;<a href=\"https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/\" target=\"_blank\" rel=\"noreferrer noopener\">Networks issues open letter to get CCIOs and CIOs on NHS boards</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref2\" target=\"_blank\">[2]</a>&nbsp;<a rel=\"noreferrer noopener\" href=\"https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/\" target=\"_blank\">HM Government Public Appointments</a></p>\n<!-- /wp:paragraph -->','Beyond Brexit: Cyber Security and Data Protection','In the context of rapid service and product delivery changes, organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!','inherit','closed','closed','','2026-autosave-v1','','','2022-08-22 16:36:30','2022-08-22 16:36:30','',2026,'https://www.datarainbow.eu/?p=2390',0,'revision','',0),(2207,1,'2021-08-01 10:48:06','2021-08-01 10:48:06','<!-- wp:heading {\"level\":3} -->\n<h3>the modern Cassandra Complex - By <a href=\"https://www.linkedin.com/in/daniel-aldridge-2a93922b/\">Daniel Aldridge</a> Senior Policy &amp; Programmes Manager at BCS, The Chartered Institute for IT</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Published on March 12, 2021</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I\'m never one to shy away from a niche topic, especially one at the vanguard of politics and technology, so I was happy to speak at the Holyrood Connect event last week on cyber security and data protection post Brexit. <a rel=\"noreferrer noopener\" href=\"https://cybersecurityni.holyrood.com/agenda\" target=\"_blank\">Public Sector Cyber Security Northern Ireland</a> Especially as increasingly I feel that we in the IT and digital communities are are suffering from a modern Cassandra complex where we know there are existential threats that need action, but its so often being put in the too-difficult box.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the panel, I was joined by fellow BCS member, lawyer and Data Protection Consultant, Tara Taubman-Bassirian of Data Rainbow; Joseph Byrne, Privacy Solutions Engineer at OneTrust and the event chair, David Lee, formerly of The Scotsman. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I spent 6 years working in Scottish public policy and campaigns and I’m no stranger to Holyrood Connect as a force for good in addressing the critical digital issues of our times and its place as a strong voice for devolved administrations. Also, the Chartered Institute has sizeable active membership in Scotland, Northern Ireland and Wales and it’s been personal commitment of mine to drive greater engagement and collaboration across the UK’s rich tech landscape so the future of IT and digital technologies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chartered Institute is primarily a network of its people and over the past 12 months it’s been amazing how our members and the wider IT and digital communities have continued to make IT good for society whilst we all face huge and unprecedented threats.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IT workers really are the unsung heroes of the pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s important to note that in the context of rapid service and product delivery changes etc; organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But the problem for many of us working in this area is that so many of our organisations are caught up in this perfect storm without even the awareness they need legal advice and expertise, let alone having it in house.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A big bug bear for me and my colleagues is the absence of CIOs or equivalent at the highest levels of organisational decision making and risk management.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hear often about an encouraging rise in the amount of boards with a dedicated person with responsibility for cyber and data security and protection; but in many situations, it does feel very much like when boards were encouraged to appoint a diversity champion, the person was often not appointed based on real knowledge or expertise and were asked to ‘take on’ the brief. In both cases, the board member often relies almost exclusively on the briefing of the IT team with much lost in translation and debate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When we look at how many Boards include a CIO or equivalent, the picture is problematic, only 10 -20% of NHS organisations for example have a CIO or equivalent at the highest level of decision making and risk management<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the demand is there though for better, tech led decision making!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The past decade has seen a cottage industry grow up around supporting technologists to speak effectively with boards and decision makers; this is why we are so keen to drive professional standards and professional development across the IT world to drive up this capacity to support innovation and mitigate risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A new data regime ushered in by the UK’s Data Strategy will reiterate the need for effective data maintenance and governance while removing obstacles and impediments to innovation, an opportunity to basically clean up our digital processes and make them fit for a more dynamic digital infrastructure. Indeed the new information commissioner’s job specification<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;requires a drive to do just that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This aside, despite the sabre rattling from both sides over the past few months, most of the signs indicate that the UK and EU want to cooperate on a number of key areas such as enforcement, cyber security, copyright infringement, IP, tech sovereignty and certain areas of competition. This may well mean that the ICO will turn its attention more meaningfully to scrutinising data governance procedures, while also calling out over-burdensome procedures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite no clear public desire to needlessly interrupt trade, it’s unclear how long an adequacy agreement, if finally ratified by EU states, can be sustainable. As a third country, the UK will be susceptible to judicial review similar to Schrems 2 and outside the EU, we’ll be held to a higher standard.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To be competitive the UK needs to show it is dynamic and has a commercial edge over the EU in certain areas, data will be one of those areas; the political and legal challenges are however huge!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Make no mistake, privacy campaigners have the UK in their sights and will seek to make this the next battleground, so depending on where and how we plan to flex our independence on things like human rights legislation etc, there will be a need for preparatory action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what can we do…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>listen to and champion your IT and data protection people to help get our houses in order</li><li>Continue to drive up professional standards and champion the mitigation of risk across the economy and civil society</li><li>Raise the issues you care about with your elected officials, I don\'t think there is enough literacy at national, devolved or local government level for us to reap the benefits, we should be aiming to thrive, not just survive</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We’re all learning ‘on the job’ on this so let’s continue to have these conversations, mainstream the issues and make sure we’re ahead of the game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref1\" target=\"_blank\">[1]</a>&nbsp;<a href=\"https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/\" target=\"_blank\" rel=\"noreferrer noopener\">Networks issues open letter to get CCIOs and CIOs on NHS boards</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref2\" target=\"_blank\">[2]</a>&nbsp;<a rel=\"noreferrer noopener\" href=\"https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/\" target=\"_blank\">HM Government Public Appointments</a></p>\n<!-- /wp:paragraph -->','Beyond Brexit: Cyber Security and Data Protection','In the context of rapid service and product delivery changes, organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!','inherit','closed','closed','','2026-revision-v1','','','2021-08-01 10:48:06','2021-08-01 10:48:06','',2026,'https://www.datarainbow.eu/?p=2207',0,'revision','',0),(2209,1,'2021-08-01 14:30:18','2021-08-01 14:30:18','<!-- wp:paragraph -->\n<p><a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior consent of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-01 14:30:18','2021-08-01 14:30:18','',2145,'https://www.datarainbow.eu/?p=2209',0,'revision','',0),