(2211,1,'2021-08-01 16:43:04','2021-08-01 16:43:04','<!-- wp:paragraph -->\n<p><a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\" rel=\"noreferrer noopener\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-01 16:43:04','2021-08-01 16:43:04','',2145,'https://www.datarainbow.eu/?p=2211',0,'revision','',0),(2212,1,'2021-08-01 17:01:33','2021-08-01 17:01:33','<!-- wp:paragraph -->\n<p><a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\" rel=\"noreferrer noopener\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. <br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-01 17:01:33','2021-08-01 17:01:33','',2145,'https://www.datarainbow.eu/?p=2212',0,'revision','',0),(2213,1,'2021-08-01 17:07:17','2021-08-01 17:07:17','<!-- wp:paragraph -->\n<p>Bloomberg : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend ourselves vigorously in this matter.\" </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-01 17:07:17','2021-08-01 17:07:17','',2145,'https://www.datarainbow.eu/?p=2213',0,'revision','',0),(2215,1,'2021-08-02 15:43:40','2021-08-02 15:43:40','<!-- wp:paragraph -->\n<p><a href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\" rel=\"noreferrer noopener\">La Quadrature du Net press release</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend ourselves vigorously in this matter.\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-02 15:43:40','2021-08-02 15:43:40','',2145,'https://www.datarainbow.eu/?p=2215',0,'revision','',0),(2220,1,'2021-08-02 19:37:53','2021-08-02 19:37:53','<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-02 19:37:53','2021-08-02 19:37:53','',2145,'https://www.datarainbow.eu/?p=2220',0,'revision','',0),(2216,1,'2021-08-02 15:53:02','2021-08-02 15:53:02','<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\" </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\" </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-02 15:53:02','2021-08-02 15:53:02','',2145,'https://www.datarainbow.eu/?p=2216',0,'revision','',0),(2221,1,'2021-08-02 20:39:07','2021-08-02 20:39:07','<!-- wp:image {\"id\":2222,\"width\":465,\"height\":465,\"sizeSlug\":\"full\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/08/PUBLICATIONS-1.jpg\" alt=\"\" class=\"wp-image-2222\" width=\"465\" height=\"465\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:list -->\n<ul><li>Co-written article published by the International Association of Privacy Practionners IAPP, Tara Taubman-Bassirian and Luis Alberto Montezuma <a rel=\"noreferrer noopener\" href=\"https://iapp.org/news/a/how-to-avoid-consent-fatigue/\" target=\"_blank\">\'How to avoid consent fatigue\'</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Co-written with <a rel=\"noreferrer noopener\" href=\"https://www.researchgate.net/profile/Christine-Hilcenko\" target=\"_blank\">Dr Christine Hilcenko</a>, researcher at Cambridge UNIVERSITY, <a href=\"https://www.researchgate.net/publication/336521481_Privacy_Education_and_Human_Dignity\">Privacy, Education and Human Dignity</a>, also published by <a rel=\"noreferrer noopener\" href=\"https://www.ceeol.com/search/article-detail?id=801144\" target=\"_blank\">Wydawnictwo Oświatowe FOSZE</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II Invalidation of the Privacy Shield by the ECJ</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/life-under-digits-and-freedom/\" target=\"_blank\">CCTV cameras and captured images</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\" target=\"_blank\">Websites surreptitiously tracking and reporting on visitors</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/insurability-of-fines-and-penalties-for-breaches-of-the-gdpr/\" target=\"_blank\">Insurability Of Fines And Penalties For Breaches Of The GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/increasing-fines-expected-from-german-dpas/\" target=\"_blank\">Increasing Fines Expected from German DPAs</a></li><li>C<a href=\"https://www.datarainbow.eu/cookies-are-not-yummies/\" target=\"_blank\" rel=\"noreferrer noopener\">ookies Are Not Yummies</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Guest writter Tara Taubman-Bassirian in <a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/topic/tara-taubman-barissian/\" target=\"_blank\">ITSecurity</a> :<ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">GDPR Material and Territorial Scopes</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Still in Denial of the Tough New Privacy Law GDPR?</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Private Company CONCENTRIX Acting on Belhaf of HMRC</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">The New Data Protection Regulation Has Been Adopted</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Apple Stands To Defend Customer’s Privacy</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">ECJ Says Safe Harbor Is Not So Safe</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Ashley Madison Site Has Been Hacked And Why Should It Matter?</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">The Right To Be Forgotten – EU and Elsewhere</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Looking For The Worm in the Apple Watch?</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Internet Law And Privacy</a> </li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Research written for <a rel=\"noreferrer noopener\" href=\"https://www.cutter.com/\" target=\"_blank\">Cutter Consortium</a> : <a href=\"https://www.cutter.com/article/geolocation-and-privacy-part-i-wide-choices-legal-issues-436731\" target=\"_blank\" rel=\"noreferrer noopener\">Geolocation and Privacy: Part I -- Wide Choices, Legal Issues</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Co-written research paper for the European Union Cybersecurity Agency ENISA <a rel=\"noreferrer noopener\" href=\"https://www.enisa.europa.eu/publications/archive/onlineasithappens\" target=\"_blank\">\'Online as soon as it happens (EN)\'</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Published by Global Voices \'<a rel=\"noreferrer noopener\" href=\"https://advox.globalvoices.org/2010/04/05/hhadopi-acta-digital-economy-bill-problematic-regulatory-responses/\" target=\"_blank\">HADOPI, ACTA, Digital Economy Bill: From Human Rights to Economic Rights</a>\' and translated by <a rel=\"noreferrer noopener\" href=\"https://pt.globalvoices.org/author/joaomiguel/\" target=\"_blank\">João Miguel Lima</a> in Portuguese <a rel=\"noreferrer noopener\" href=\"https://pt.globalvoices.org/2010/05/14/hadopi-acta-declaracao-da-economia-digital-dos-direitos-humanos-aos-direitos-economicos/\" target=\"_blank\">HADOPI, ACTA, Declaração da Economia Digital: dos Direitos Humanos aos Direitos Econômicos</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Published on Linkedin :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/les-professionnels-du-droit-lere-numerique-tara-taubman-bassirian-llm/\" target=\"_blank\">Les Professionnels du Droit à l\'Ère du Numérique</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/lawyer-cloud-act-quel-pour-les-cabinets-davocats-tara/\" target=\"_blank\">Lawyer Cloud Act : Quel Cloud Pour Les Cabinets d\'Avocats ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/lensauvagement-vu-par-lavokayon-tara-taubman-bassirian-llm/\" target=\"_blank\">L\'Ensauvagement Vu Par l\'Avokayon</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/how-understand-ofqual-ai-predicting-a-levels-debacle-tara-1f/\" target=\"_blank\">How To Understand the Ofqual AI Predicting A-Levels Debacle</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/schrems-ii-invalidation-privacy-shield-ecj-tara-taubman-bassirian-llm/\" target=\"_blank\">Schrems II Invalidation of the Privacy Shield by the ECJ</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/effective-gdpr-enforcement-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\">An Alternative Proposition for A More Effective GDPR Enforcement</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/stop-covid-combattre-la-pand%C3%A9mie-sans-infecter-taubman-bassirian-llm/\" target=\"_blank\">STOP-COVID COMBATTRE LA PANDÉMIE SANS INFECTER LA DÉMOCRATIE</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/zoom-videoconferencing-privacy-liability-tara-taubman-bassirian-llm/\" target=\"_blank\">ZOOM VIDEOCONFERENCING PRIVACY AND LIABILITY</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/zooms-privacy-security-concerns-wake-up-call-gdpr-tara/\" target=\"_blank\">Zoom\'s Privacy and Security Concerns Is A Wake Up Call for GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consider-personal-data-hot-potato-tara-taubman-bassirian-llm/\" target=\"_blank\">Consider Personal Data as a Hot Potato</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/french-court-said-facial-recognition-technology-tara/\" target=\"_blank\">French Court Said NO To Facial Recognition Technology</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facial-recognition-technologies-tara-taubman-bassirian-llm/\" target=\"_blank\">FACIAL RECOGNITION TECHNOLOGIES</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privay-glance-tara-taubman-bassirian-llm/\" target=\"_blank\">Privacy at a Glance</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/pourquoi-le-respect-de-la-vie-privee-est-important-tara/?published=t\" target=\"_blank\">POURQUOI LE RESPECT DE LA VIE PRIVEE EST IMPERATIF</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/uk-watchdog-investigation-british-airways-marriott-tara/\" target=\"_blank\">UK WATCHDOG INVESTIGATION OF BRITISH AIRWAYS AND MARRIOTT HOTELS SECURITY BREACHES</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consent-direct-marketing-tara-taubman-bassirian-llm/\" target=\"_blank\">Consent and Direct Marketing</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-saga-tara-taubman-bassirian-llm/\" target=\"_blank\">Facebook Saga</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/happy-valentines-day-privacy-lovers-tara-taubman-bassirian-llm/\" target=\"_blank\">HAPPY VALENTINES DAY PRIVACY LOVERS</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/how-understand-gdpr-legitimate-interest-tara-taubman-bassirian-llm/\" target=\"_blank\">How to Understand the GDPR Legitimate Interest</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/google-subject-biggest-fine-under-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">Google Subject to the Biggest Fine Under GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/2019-gdpr-privacy-best-wishes-tara-taubman-bassirian-llm/\" target=\"_blank\">2019 GDPR and Privacy Best Wishes</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/website-transparency-cookies-privacy-notice-taubman-bassirian-llm/\" target=\"_blank\">Website Transparency : Cookies and Privacy Notice</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">CNIL - Six months of GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/cnil-published-first-review-6-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">CNIL Published a First Review : 6 Months of the GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privacy-design-tara-taubman-bassirian-llm/\" target=\"_blank\">Privacy And Design</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/memory-forgetfulness-privacy-tara-taubman-bassirian-llm/\" target=\"_blank\">Memory, Forgetfulness and Privacy</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/after-canada-airlines-here-comes-british-airways-tara/\" target=\"_blank\">After Air Canada Breach Here Comes British Airways</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\" target=\"_blank\">The Facebook Fan Page ECJ ruling</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consenting-consent-needs-tara-taubman-bassirian-llm/\" target=\"_blank\">Consenting to Consent Needs Consent?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/gdpr-shooting-messenger-tara-taubman-bassirian-llm/\" target=\"_blank\">GDPR Is Not Shooting The Messenger</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/\" target=\"_blank\">GDPR Material and Territorial Scopes</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/round-up-privacy-data-protection-news-tara-taubman-bassirian-llm/\" target=\"_blank\">Round up of Privacy and Data Protection News</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/end-unsollicited-emails-tara-taubman-bassirian-llm/\" target=\"_blank\">The End Of Unsollicited Emails?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\" target=\"_blank\">The Facebook Fan Page ECJ Ruling</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\" target=\"_blank\">Keeping an Eye</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/\" target=\"_blank\">Law Firm Internet Security and Data Protection</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\" target=\"_blank\">Life Under Digits</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privacy-experts-need-career-path-tara-taubman-bassirian/\" target=\"_blank\">Privacy Experts in Need of Career Path</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/united-airlines-bad-shape-tara-taubman-bassirian-llm/\" target=\"_blank\">United Airlines In Bad Shape</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/challenges-artificial-intelligence-france-tara-taubman-bassirian-llm/\" target=\"_blank\">France Initiatives to Tackle the Challenges of Artificial Intelligence</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\">All You Need to Know About GDPR Compliance</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/jacqueline-sauvage-tara-taubman-bassirian/\" target=\"_blank\">Jacqueline Sauvage</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian/\" target=\"_blank\">Drones, Autonomus Cars, Ethics and Regulation.</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian/\" target=\"_blank\">Wearable Cameras</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/police-3d-printed-murder-victims-finger-unlock-his-taubman-bassirian/\" target=\"_blank\">Police 3D-Printed a murder victim\'s finger to unlock his phone</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/private-company-concentrix-acting-belhaf-hmrc-raising-tara/\" target=\"_blank\">Private Company Concentrix Acting on Behalf of HMRC raising a Number of Issues</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-est-en-deuil-tara-taubman-bassirian/\" target=\"_blank\">Periscope est en deuil</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/navigating-new-eu-data-protection-rules-tara-taubman-bassirian/\" target=\"_blank\">Navigating the new EU Data Protection Rules</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/why-should-we-all-care-panamapapers-tara-taubman-bassirian/\" target=\"_blank\">Why Should We All Care About PanamaPapers ?</a></li><li><a href=\"https://www.linkedin.com/pulse/copyright-claim-deny-freedom-speech-tara-taubman-bassirian/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/pulse/copyright-claim-deny-freedom-speech-tara-taubman-bassirian/\">Copyright Claim to Deny Freedom of Speech</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/welcoming-human-beings-remains-duty-tara-taubman-bassirian/\" target=\"_blank\">Welcoming Human Beings Remains a Duty</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/accueillir-les-immigr%C3%A9s-reste-un-devoir-tara-taubman-bassirian/\" target=\"_blank\">Accueillir les immigrés reste un devoir</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/right-education-tara-taubman-bassirian/\" target=\"_blank\">The Right to Education for the Right Education</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/apple-fbi-battle-security-v-privacy-tara-taubman-bassirian/\" target=\"_blank\">Apple-FBI battle of Privacy v Security</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-lawyers-tara-taubman-bassirian/\" target=\"_blank\">Periscope For Lawyers ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-tara-taubman-bassirian/\" target=\"_blank\">Periscope or not ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/ecj-says-safe-harbor-so-tara-taubman-bassirian/\" target=\"_blank\">ECJ Says Safe Harbor Is Not So Safe</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/right-forgotten-censorship-tara-taubman-bassirian/\" target=\"_blank\">The Right to be Forgotten is no Censorship</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/bigger-than-big-data-processed-information-gold-taubman-bassirian/\" target=\"_blank\">Bigger Than Big Data, Processed Information is Gold</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20141115151647-19096867-teaching-the-skills-for-life-compassion-and-empathy/?published=t\" target=\"_blank\">Teaching The Skills For Life, Compassion And Empathy</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20141019172647-19096867-how-an-online-negative-comment-can-be-positively-exploited/\" target=\"_blank\">How an Online Negative Review Can Be Positively Exploited</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20140816204805-19096867-cadeau/?published=t\" target=\"_blank\">Boyhood You Said? It Was Just Motherhood That I Saw</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20140814210844-19096867-any-hope-for-a-universal-language/?published=t\" target=\"_blank\">Any Hope For a Universal Language ?</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Elsewhere on the net :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/06/09/the-future-of-the-digital-music/\" target=\"_blank\">The Future of the Digital&nbsp;Music</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/02/22/law-enforcement-and-internet-jurisdiction/\" target=\"_blank\">Law Enforcement and Internet&nbsp;Jurisdiction</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/02/17/to-be-or-not-to-be-anonymous-anonymyity-in-the-age-of-big-and-open-data/\" target=\"_blank\">To be or not to be (anonymous)? Anonymity in the age of big and open&nbsp;data</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/01/23/catching-up-with-the-annual-cdpd-conference-in-brussels/\" target=\"_blank\">Catching up with the annual CPDP conference in&nbsp;Brussels</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2014/03/01/copyright-confusion-is-madness/\" target=\"_blank\">Copyright Confusion is&nbsp;Madness</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/12/06/to-nelson-mandela-and-all-brave-men-of-his-kind/\" target=\"_blank\">To Nelson Mandela and all brave men of his&nbsp;kind</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/02/20/the-ecommerce-directive-a-shield-for-isps-or-a-stick-with-which-they-may-be-beaten/\" target=\"_blank\">The eCommerce Directive: A shield for ISPs…. Or a stick with which they may be&nbsp;beaten ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/02/06/the-interests-of-authors-february-6-700-p-m-est/\" target=\"_blank\">The Interests of Authors, February 6, 7:00 p.m.&nbsp;EST</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/01/31/the-copyright-maddness-inflames-the-relationship-between-us-and-antiguabarbuda/\" target=\"_blank\">The Copyright madness inflames the relationship between US and&nbsp;Antigua/Barbuda</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/01/19/humanity-connected-is-god/\" target=\"_blank\">Humanity Connected is&nbsp;God ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.blogspot.com/2010/03/what-week-weak-copyright.html\" target=\"_blank\">What a week! A weak copyright ! </a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/02/jeff-jarvis-tought-me-iomega-sucks.html\">jeff Jarvis tought me iomega sucks</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/01/la-lecture-de-larticle-de-yann-leroux.html\">Des yeux dans le bac a sable, paranoia ou realite. A la recherche d\'un consentement avise</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/01/why-should-we-all-pay-for-music.html\">Why should we all pay for the Music Industry ?</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/12/loi-hadopi-1-2-3.html\">Loi Hadopi 1 + 2 = 3 ?</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/07/amazon-burns-orwells-e-books.html\">Amazon Burns Orwell\'s E-Books</a></li><li><strong><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.blogspot.com/search?updated-max=2009-12-15T13:32:00-08:00&amp;max-results=7&amp;start=7&amp;by-date=false\" target=\"_blank\">IP Addresses and User Privacy</a></strong></li><li>T<a href=\"https://clarinettesblog.blogspot.com/2009/07/technical-explanations-on-hadopi-or-law.html\">echnical explanations on HADOPI or a law in agony</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/05/twitter-suspended-my-account.html\">Twitter suspended my account!!!</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, was initially trained in French Law before settling in the UK. She has a Maitrise of Private Law from the prestigious <a href=\"https://www.u-paris2.fr/fr\" target=\"_blank\" rel=\"noreferrer noopener\">University of Pantheon Assas, Paris 2</a>, before her more recent specialisation in Computer and Communication Law with a Masters at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group&nbsp;<a class=\"\" href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a>&nbsp;with&nbsp;<a class=\"\" href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group <a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":880} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.29.42.png\" alt=\"\" class=\"wp-image-880\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":878} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Champion-Badge.png\" alt=\"\" class=\"wp-image-878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Seen on Twitter</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":252} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-31-at-11.22.40.png\" alt=\"\" class=\"wp-image-252\"/></figure>\n<!-- /wp:image -->','DATARAINBOW - PUBLICATIONS','','inherit','closed','closed','','84-autosave-v1','','','2021-08-02 20:39:07','2021-08-02 20:39:07','',84,'https://www.datarainbow.eu/?p=2221',0,'revision','',0),(2222,1,'2021-08-02 20:38:28','2021-08-02 20:38:28','','PUBLICATIONS-1','','inherit','open','closed','','publications-1','','','2021-08-02 20:38:28','2021-08-02 20:38:28','',84,'https://www.datarainbow.eu/wp-content/uploads/2021/08/PUBLICATIONS-1.jpg',0,'attachment','image/jpeg',0),(2223,1,'2021-08-02 20:38:35','2021-08-02 20:38:35','<!-- wp:list -->\n<ul><li>Co-written article published by the International Association of Privacy Practionners IAPP, Tara Taubman-Bassirian and Luis Alberto Montezuma <a rel=\"noreferrer noopener\" href=\"https://iapp.org/news/a/how-to-avoid-consent-fatigue/\" target=\"_blank\">\'How to avoid consent fatigue\'</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Co-written with <a rel=\"noreferrer noopener\" href=\"https://www.researchgate.net/profile/Christine-Hilcenko\" target=\"_blank\">Dr Christine Hilcenko</a>, researcher at Cambridge UNIVERSITY, <a href=\"https://www.researchgate.net/publication/336521481_Privacy_Education_and_Human_Dignity\">Privacy, Education and Human Dignity</a>, also published by <a rel=\"noreferrer noopener\" href=\"https://www.ceeol.com/search/article-detail?id=801144\" target=\"_blank\">Wydawnictwo Oświatowe FOSZE</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II Invalidation of the Privacy Shield by the ECJ</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/life-under-digits-and-freedom/\" target=\"_blank\">CCTV cameras and captured images</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\" target=\"_blank\">Websites surreptitiously tracking and reporting on visitors</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/insurability-of-fines-and-penalties-for-breaches-of-the-gdpr/\" target=\"_blank\">Insurability Of Fines And Penalties For Breaches Of The GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/increasing-fines-expected-from-german-dpas/\" target=\"_blank\">Increasing Fines Expected from German DPAs</a></li><li>C<a href=\"https://www.datarainbow.eu/cookies-are-not-yummies/\" target=\"_blank\" rel=\"noreferrer noopener\">ookies Are Not Yummies</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Guest writter Tara Taubman-Bassirian in <a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/topic/tara-taubman-barissian/\" target=\"_blank\">ITSecurity</a> :<ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">GDPR Material and Territorial Scopes</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Still in Denial of the Tough New Privacy Law GDPR?</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Private Company CONCENTRIX Acting on Belhaf of HMRC</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">The New Data Protection Regulation Has Been Adopted</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Apple Stands To Defend Customer’s Privacy</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">ECJ Says Safe Harbor Is Not So Safe</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Ashley Madison Site Has Been Hacked And Why Should It Matter?</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">The Right To Be Forgotten – EU and Elsewhere</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Looking For The Worm in the Apple Watch?</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Internet Law And Privacy</a> </li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Research written for <a rel=\"noreferrer noopener\" href=\"https://www.cutter.com/\" target=\"_blank\">Cutter Consortium</a> : <a href=\"https://www.cutter.com/article/geolocation-and-privacy-part-i-wide-choices-legal-issues-436731\" target=\"_blank\" rel=\"noreferrer noopener\">Geolocation and Privacy: Part I -- Wide Choices, Legal Issues</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Co-written research paper for the European Union Cybersecurity Agency ENISA <a rel=\"noreferrer noopener\" href=\"https://www.enisa.europa.eu/publications/archive/onlineasithappens\" target=\"_blank\">\'Online as soon as it happens (EN)\'</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Published by Global Voices \'<a rel=\"noreferrer noopener\" href=\"https://advox.globalvoices.org/2010/04/05/hhadopi-acta-digital-economy-bill-problematic-regulatory-responses/\" target=\"_blank\">HADOPI, ACTA, Digital Economy Bill: From Human Rights to Economic Rights</a>\' and translated by <a rel=\"noreferrer noopener\" href=\"https://pt.globalvoices.org/author/joaomiguel/\" target=\"_blank\">João Miguel Lima</a> in Portuguese <a rel=\"noreferrer noopener\" href=\"https://pt.globalvoices.org/2010/05/14/hadopi-acta-declaracao-da-economia-digital-dos-direitos-humanos-aos-direitos-economicos/\" target=\"_blank\">HADOPI, ACTA, Declaração da Economia Digital: dos Direitos Humanos aos Direitos Econômicos</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Published on Linkedin :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/les-professionnels-du-droit-lere-numerique-tara-taubman-bassirian-llm/\" target=\"_blank\">Les Professionnels du Droit à l\'Ère du Numérique</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/lawyer-cloud-act-quel-pour-les-cabinets-davocats-tara/\" target=\"_blank\">Lawyer Cloud Act : Quel Cloud Pour Les Cabinets d\'Avocats ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/lensauvagement-vu-par-lavokayon-tara-taubman-bassirian-llm/\" target=\"_blank\">L\'Ensauvagement Vu Par l\'Avokayon</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/how-understand-ofqual-ai-predicting-a-levels-debacle-tara-1f/\" target=\"_blank\">How To Understand the Ofqual AI Predicting A-Levels Debacle</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/schrems-ii-invalidation-privacy-shield-ecj-tara-taubman-bassirian-llm/\" target=\"_blank\">Schrems II Invalidation of the Privacy Shield by the ECJ</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/effective-gdpr-enforcement-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\">An Alternative Proposition for A More Effective GDPR Enforcement</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/stop-covid-combattre-la-pand%C3%A9mie-sans-infecter-taubman-bassirian-llm/\" target=\"_blank\">STOP-COVID COMBATTRE LA PANDÉMIE SANS INFECTER LA DÉMOCRATIE</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/zoom-videoconferencing-privacy-liability-tara-taubman-bassirian-llm/\" target=\"_blank\">ZOOM VIDEOCONFERENCING PRIVACY AND LIABILITY</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/zooms-privacy-security-concerns-wake-up-call-gdpr-tara/\" target=\"_blank\">Zoom\'s Privacy and Security Concerns Is A Wake Up Call for GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consider-personal-data-hot-potato-tara-taubman-bassirian-llm/\" target=\"_blank\">Consider Personal Data as a Hot Potato</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/french-court-said-facial-recognition-technology-tara/\" target=\"_blank\">French Court Said NO To Facial Recognition Technology</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facial-recognition-technologies-tara-taubman-bassirian-llm/\" target=\"_blank\">FACIAL RECOGNITION TECHNOLOGIES</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privay-glance-tara-taubman-bassirian-llm/\" target=\"_blank\">Privacy at a Glance</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/pourquoi-le-respect-de-la-vie-privee-est-important-tara/?published=t\" target=\"_blank\">POURQUOI LE RESPECT DE LA VIE PRIVEE EST IMPERATIF</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/uk-watchdog-investigation-british-airways-marriott-tara/\" target=\"_blank\">UK WATCHDOG INVESTIGATION OF BRITISH AIRWAYS AND MARRIOTT HOTELS SECURITY BREACHES</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consent-direct-marketing-tara-taubman-bassirian-llm/\" target=\"_blank\">Consent and Direct Marketing</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-saga-tara-taubman-bassirian-llm/\" target=\"_blank\">Facebook Saga</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/happy-valentines-day-privacy-lovers-tara-taubman-bassirian-llm/\" target=\"_blank\">HAPPY VALENTINES DAY PRIVACY LOVERS</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/how-understand-gdpr-legitimate-interest-tara-taubman-bassirian-llm/\" target=\"_blank\">How to Understand the GDPR Legitimate Interest</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/google-subject-biggest-fine-under-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">Google Subject to the Biggest Fine Under GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/2019-gdpr-privacy-best-wishes-tara-taubman-bassirian-llm/\" target=\"_blank\">2019 GDPR and Privacy Best Wishes</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/website-transparency-cookies-privacy-notice-taubman-bassirian-llm/\" target=\"_blank\">Website Transparency : Cookies and Privacy Notice</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">CNIL - Six months of GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/cnil-published-first-review-6-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">CNIL Published a First Review : 6 Months of the GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privacy-design-tara-taubman-bassirian-llm/\" target=\"_blank\">Privacy And Design</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/memory-forgetfulness-privacy-tara-taubman-bassirian-llm/\" target=\"_blank\">Memory, Forgetfulness and Privacy</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/after-canada-airlines-here-comes-british-airways-tara/\" target=\"_blank\">After Air Canada Breach Here Comes British Airways</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\" target=\"_blank\">The Facebook Fan Page ECJ ruling</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consenting-consent-needs-tara-taubman-bassirian-llm/\" target=\"_blank\">Consenting to Consent Needs Consent?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/gdpr-shooting-messenger-tara-taubman-bassirian-llm/\" target=\"_blank\">GDPR Is Not Shooting The Messenger</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/\" target=\"_blank\">GDPR Material and Territorial Scopes</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/round-up-privacy-data-protection-news-tara-taubman-bassirian-llm/\" target=\"_blank\">Round up of Privacy and Data Protection News</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/end-unsollicited-emails-tara-taubman-bassirian-llm/\" target=\"_blank\">The End Of Unsollicited Emails?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\" target=\"_blank\">The Facebook Fan Page ECJ Ruling</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\" target=\"_blank\">Keeping an Eye</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/\" target=\"_blank\">Law Firm Internet Security and Data Protection</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\" target=\"_blank\">Life Under Digits</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privacy-experts-need-career-path-tara-taubman-bassirian/\" target=\"_blank\">Privacy Experts in Need of Career Path</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/united-airlines-bad-shape-tara-taubman-bassirian-llm/\" target=\"_blank\">United Airlines In Bad Shape</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/challenges-artificial-intelligence-france-tara-taubman-bassirian-llm/\" target=\"_blank\">France Initiatives to Tackle the Challenges of Artificial Intelligence</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\">All You Need to Know About GDPR Compliance</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/jacqueline-sauvage-tara-taubman-bassirian/\" target=\"_blank\">Jacqueline Sauvage</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian/\" target=\"_blank\">Drones, Autonomus Cars, Ethics and Regulation.</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian/\" target=\"_blank\">Wearable Cameras</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/police-3d-printed-murder-victims-finger-unlock-his-taubman-bassirian/\" target=\"_blank\">Police 3D-Printed a murder victim\'s finger to unlock his phone</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/private-company-concentrix-acting-belhaf-hmrc-raising-tara/\" target=\"_blank\">Private Company Concentrix Acting on Behalf of HMRC raising a Number of Issues</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-est-en-deuil-tara-taubman-bassirian/\" target=\"_blank\">Periscope est en deuil</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/navigating-new-eu-data-protection-rules-tara-taubman-bassirian/\" target=\"_blank\">Navigating the new EU Data Protection Rules</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/why-should-we-all-care-panamapapers-tara-taubman-bassirian/\" target=\"_blank\">Why Should We All Care About PanamaPapers ?</a></li><li><a href=\"https://www.linkedin.com/pulse/copyright-claim-deny-freedom-speech-tara-taubman-bassirian/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/pulse/copyright-claim-deny-freedom-speech-tara-taubman-bassirian/\">Copyright Claim to Deny Freedom of Speech</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/welcoming-human-beings-remains-duty-tara-taubman-bassirian/\" target=\"_blank\">Welcoming Human Beings Remains a Duty</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/accueillir-les-immigr%C3%A9s-reste-un-devoir-tara-taubman-bassirian/\" target=\"_blank\">Accueillir les immigrés reste un devoir</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/right-education-tara-taubman-bassirian/\" target=\"_blank\">The Right to Education for the Right Education</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/apple-fbi-battle-security-v-privacy-tara-taubman-bassirian/\" target=\"_blank\">Apple-FBI battle of Privacy v Security</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-lawyers-tara-taubman-bassirian/\" target=\"_blank\">Periscope For Lawyers ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-tara-taubman-bassirian/\" target=\"_blank\">Periscope or not ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/ecj-says-safe-harbor-so-tara-taubman-bassirian/\" target=\"_blank\">ECJ Says Safe Harbor Is Not So Safe</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/right-forgotten-censorship-tara-taubman-bassirian/\" target=\"_blank\">The Right to be Forgotten is no Censorship</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/bigger-than-big-data-processed-information-gold-taubman-bassirian/\" target=\"_blank\">Bigger Than Big Data, Processed Information is Gold</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20141115151647-19096867-teaching-the-skills-for-life-compassion-and-empathy/?published=t\" target=\"_blank\">Teaching The Skills For Life, Compassion And Empathy</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20141019172647-19096867-how-an-online-negative-comment-can-be-positively-exploited/\" target=\"_blank\">How an Online Negative Review Can Be Positively Exploited</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20140816204805-19096867-cadeau/?published=t\" target=\"_blank\">Boyhood You Said? It Was Just Motherhood That I Saw</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20140814210844-19096867-any-hope-for-a-universal-language/?published=t\" target=\"_blank\">Any Hope For a Universal Language ?</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Elsewhere on the net :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/06/09/the-future-of-the-digital-music/\" target=\"_blank\">The Future of the Digital&nbsp;Music</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/02/22/law-enforcement-and-internet-jurisdiction/\" target=\"_blank\">Law Enforcement and Internet&nbsp;Jurisdiction</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/02/17/to-be-or-not-to-be-anonymous-anonymyity-in-the-age-of-big-and-open-data/\" target=\"_blank\">To be or not to be (anonymous)? Anonymity in the age of big and open&nbsp;data</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/01/23/catching-up-with-the-annual-cdpd-conference-in-brussels/\" target=\"_blank\">Catching up with the annual CPDP conference in&nbsp;Brussels</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2014/03/01/copyright-confusion-is-madness/\" target=\"_blank\">Copyright Confusion is&nbsp;Madness</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/12/06/to-nelson-mandela-and-all-brave-men-of-his-kind/\" target=\"_blank\">To Nelson Mandela and all brave men of his&nbsp;kind</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/02/20/the-ecommerce-directive-a-shield-for-isps-or-a-stick-with-which-they-may-be-beaten/\" target=\"_blank\">The eCommerce Directive: A shield for ISPs…. Or a stick with which they may be&nbsp;beaten ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/02/06/the-interests-of-authors-february-6-700-p-m-est/\" target=\"_blank\">The Interests of Authors, February 6, 7:00 p.m.&nbsp;EST</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/01/31/the-copyright-maddness-inflames-the-relationship-between-us-and-antiguabarbuda/\" target=\"_blank\">The Copyright madness inflames the relationship between US and&nbsp;Antigua/Barbuda</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/01/19/humanity-connected-is-god/\" target=\"_blank\">Humanity Connected is&nbsp;God ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.blogspot.com/2010/03/what-week-weak-copyright.html\" target=\"_blank\">What a week! A weak copyright ! </a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/02/jeff-jarvis-tought-me-iomega-sucks.html\">jeff Jarvis tought me iomega sucks</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/01/la-lecture-de-larticle-de-yann-leroux.html\">Des yeux dans le bac a sable, paranoia ou realite. A la recherche d\'un consentement avise</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/01/why-should-we-all-pay-for-music.html\">Why should we all pay for the Music Industry ?</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/12/loi-hadopi-1-2-3.html\">Loi Hadopi 1 + 2 = 3 ?</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/07/amazon-burns-orwells-e-books.html\">Amazon Burns Orwell\'s E-Books</a></li><li><strong><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.blogspot.com/search?updated-max=2009-12-15T13:32:00-08:00&amp;max-results=7&amp;start=7&amp;by-date=false\" target=\"_blank\">IP Addresses and User Privacy</a></strong></li><li>T<a href=\"https://clarinettesblog.blogspot.com/2009/07/technical-explanations-on-hadopi-or-law.html\">echnical explanations on HADOPI or a law in agony</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/05/twitter-suspended-my-account.html\">Twitter suspended my account!!!</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, was initially trained in French Law before settling in the UK. She has a Maitrise of Private Law from the prestigious <a href=\"https://www.u-paris2.fr/fr\" target=\"_blank\" rel=\"noreferrer noopener\">University of Pantheon Assas, Paris 2</a>, before her more recent specialisation in Computer and Communication Law with a Masters at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group&nbsp;<a class=\"\" href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a>&nbsp;with&nbsp;<a class=\"\" href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group <a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2222,\"sizeSlug\":\"full\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/08/PUBLICATIONS-1.jpg\" alt=\"\" class=\"wp-image-2222\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":880} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.29.42.png\" alt=\"\" class=\"wp-image-880\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":878} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Champion-Badge.png\" alt=\"\" class=\"wp-image-878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Seen on Twitter</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":252} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-31-at-11.22.40.png\" alt=\"\" class=\"wp-image-252\"/></figure>\n<!-- /wp:image -->','DATARAINBOW - PUBLICATIONS','','inherit','closed','closed','','84-revision-v1','','','2021-08-02 20:38:35','2021-08-02 20:38:35','',84,'https://www.datarainbow.eu/?p=2223',0,'revision','',0),(2224,1,'2021-08-02 20:39:57','2021-08-02 20:39:57','<!-- wp:image {\"id\":2222,\"width\":398,\"height\":398,\"sizeSlug\":\"full\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-full is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/08/PUBLICATIONS-1.jpg\" alt=\"\" class=\"wp-image-2222\" width=\"398\" height=\"398\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:list -->\n<ul><li>Co-written article published by the International Association of Privacy Practionners IAPP, Tara Taubman-Bassirian and Luis Alberto Montezuma <a rel=\"noreferrer noopener\" href=\"https://iapp.org/news/a/how-to-avoid-consent-fatigue/\" target=\"_blank\">\'How to avoid consent fatigue\'</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Co-written with <a rel=\"noreferrer noopener\" href=\"https://www.researchgate.net/profile/Christine-Hilcenko\" target=\"_blank\">Dr Christine Hilcenko</a>, researcher at Cambridge UNIVERSITY, <a href=\"https://www.researchgate.net/publication/336521481_Privacy_Education_and_Human_Dignity\">Privacy, Education and Human Dignity</a>, also published by <a rel=\"noreferrer noopener\" href=\"https://www.ceeol.com/search/article-detail?id=801144\" target=\"_blank\">Wydawnictwo Oświatowe FOSZE</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II Invalidation of the Privacy Shield by the ECJ</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/life-under-digits-and-freedom/\" target=\"_blank\">CCTV cameras and captured images</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\" target=\"_blank\">Websites surreptitiously tracking and reporting on visitors</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/insurability-of-fines-and-penalties-for-breaches-of-the-gdpr/\" target=\"_blank\">Insurability Of Fines And Penalties For Breaches Of The GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/increasing-fines-expected-from-german-dpas/\" target=\"_blank\">Increasing Fines Expected from German DPAs</a></li><li>C<a href=\"https://www.datarainbow.eu/cookies-are-not-yummies/\" target=\"_blank\" rel=\"noreferrer noopener\">ookies Are Not Yummies</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Guest writter Tara Taubman-Bassirian in <a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/topic/tara-taubman-barissian/\" target=\"_blank\">ITSecurity</a> :<ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">GDPR Material and Territorial Scopes</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Still in Denial of the Tough New Privacy Law GDPR?</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Private Company CONCENTRIX Acting on Belhaf of HMRC</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">The New Data Protection Regulation Has Been Adopted</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Apple Stands To Defend Customer’s Privacy</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">ECJ Says Safe Harbor Is Not So Safe</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Ashley Madison Site Has Been Hacked And Why Should It Matter?</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">The Right To Be Forgotten – EU and Elsewhere</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Looking For The Worm in the Apple Watch?</a></li><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Internet Law And Privacy</a> </li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Research written for <a rel=\"noreferrer noopener\" href=\"https://www.cutter.com/\" target=\"_blank\">Cutter Consortium</a> : <a href=\"https://www.cutter.com/article/geolocation-and-privacy-part-i-wide-choices-legal-issues-436731\" target=\"_blank\" rel=\"noreferrer noopener\">Geolocation and Privacy: Part I -- Wide Choices, Legal Issues</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Co-written research paper for the European Union Cybersecurity Agency ENISA <a rel=\"noreferrer noopener\" href=\"https://www.enisa.europa.eu/publications/archive/onlineasithappens\" target=\"_blank\">\'Online as soon as it happens (EN)\'</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Published by Global Voices \'<a rel=\"noreferrer noopener\" href=\"https://advox.globalvoices.org/2010/04/05/hhadopi-acta-digital-economy-bill-problematic-regulatory-responses/\" target=\"_blank\">HADOPI, ACTA, Digital Economy Bill: From Human Rights to Economic Rights</a>\' and translated by <a rel=\"noreferrer noopener\" href=\"https://pt.globalvoices.org/author/joaomiguel/\" target=\"_blank\">João Miguel Lima</a> in Portuguese <a rel=\"noreferrer noopener\" href=\"https://pt.globalvoices.org/2010/05/14/hadopi-acta-declaracao-da-economia-digital-dos-direitos-humanos-aos-direitos-economicos/\" target=\"_blank\">HADOPI, ACTA, Declaração da Economia Digital: dos Direitos Humanos aos Direitos Econômicos</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Published on Linkedin :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/les-professionnels-du-droit-lere-numerique-tara-taubman-bassirian-llm/\" target=\"_blank\">Les Professionnels du Droit à l\'Ère du Numérique</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/lawyer-cloud-act-quel-pour-les-cabinets-davocats-tara/\" target=\"_blank\">Lawyer Cloud Act : Quel Cloud Pour Les Cabinets d\'Avocats ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/lensauvagement-vu-par-lavokayon-tara-taubman-bassirian-llm/\" target=\"_blank\">L\'Ensauvagement Vu Par l\'Avokayon</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/how-understand-ofqual-ai-predicting-a-levels-debacle-tara-1f/\" target=\"_blank\">How To Understand the Ofqual AI Predicting A-Levels Debacle</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/schrems-ii-invalidation-privacy-shield-ecj-tara-taubman-bassirian-llm/\" target=\"_blank\">Schrems II Invalidation of the Privacy Shield by the ECJ</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/effective-gdpr-enforcement-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\">An Alternative Proposition for A More Effective GDPR Enforcement</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/stop-covid-combattre-la-pand%C3%A9mie-sans-infecter-taubman-bassirian-llm/\" target=\"_blank\">STOP-COVID COMBATTRE LA PANDÉMIE SANS INFECTER LA DÉMOCRATIE</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/zoom-videoconferencing-privacy-liability-tara-taubman-bassirian-llm/\" target=\"_blank\">ZOOM VIDEOCONFERENCING PRIVACY AND LIABILITY</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/zooms-privacy-security-concerns-wake-up-call-gdpr-tara/\" target=\"_blank\">Zoom\'s Privacy and Security Concerns Is A Wake Up Call for GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consider-personal-data-hot-potato-tara-taubman-bassirian-llm/\" target=\"_blank\">Consider Personal Data as a Hot Potato</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/french-court-said-facial-recognition-technology-tara/\" target=\"_blank\">French Court Said NO To Facial Recognition Technology</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facial-recognition-technologies-tara-taubman-bassirian-llm/\" target=\"_blank\">FACIAL RECOGNITION TECHNOLOGIES</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privay-glance-tara-taubman-bassirian-llm/\" target=\"_blank\">Privacy at a Glance</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/pourquoi-le-respect-de-la-vie-privee-est-important-tara/?published=t\" target=\"_blank\">POURQUOI LE RESPECT DE LA VIE PRIVEE EST IMPERATIF</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/uk-watchdog-investigation-british-airways-marriott-tara/\" target=\"_blank\">UK WATCHDOG INVESTIGATION OF BRITISH AIRWAYS AND MARRIOTT HOTELS SECURITY BREACHES</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consent-direct-marketing-tara-taubman-bassirian-llm/\" target=\"_blank\">Consent and Direct Marketing</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-saga-tara-taubman-bassirian-llm/\" target=\"_blank\">Facebook Saga</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/happy-valentines-day-privacy-lovers-tara-taubman-bassirian-llm/\" target=\"_blank\">HAPPY VALENTINES DAY PRIVACY LOVERS</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/how-understand-gdpr-legitimate-interest-tara-taubman-bassirian-llm/\" target=\"_blank\">How to Understand the GDPR Legitimate Interest</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/google-subject-biggest-fine-under-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">Google Subject to the Biggest Fine Under GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/2019-gdpr-privacy-best-wishes-tara-taubman-bassirian-llm/\" target=\"_blank\">2019 GDPR and Privacy Best Wishes</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/website-transparency-cookies-privacy-notice-taubman-bassirian-llm/\" target=\"_blank\">Website Transparency : Cookies and Privacy Notice</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">CNIL - Six months of GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/cnil-published-first-review-6-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">CNIL Published a First Review : 6 Months of the GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privacy-design-tara-taubman-bassirian-llm/\" target=\"_blank\">Privacy And Design</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/memory-forgetfulness-privacy-tara-taubman-bassirian-llm/\" target=\"_blank\">Memory, Forgetfulness and Privacy</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/after-canada-airlines-here-comes-british-airways-tara/\" target=\"_blank\">After Air Canada Breach Here Comes British Airways</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\" target=\"_blank\">The Facebook Fan Page ECJ ruling</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consenting-consent-needs-tara-taubman-bassirian-llm/\" target=\"_blank\">Consenting to Consent Needs Consent?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/gdpr-shooting-messenger-tara-taubman-bassirian-llm/\" target=\"_blank\">GDPR Is Not Shooting The Messenger</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/\" target=\"_blank\">GDPR Material and Territorial Scopes</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/round-up-privacy-data-protection-news-tara-taubman-bassirian-llm/\" target=\"_blank\">Round up of Privacy and Data Protection News</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/end-unsollicited-emails-tara-taubman-bassirian-llm/\" target=\"_blank\">The End Of Unsollicited Emails?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\" target=\"_blank\">The Facebook Fan Page ECJ Ruling</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\" target=\"_blank\">Keeping an Eye</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/\" target=\"_blank\">Law Firm Internet Security and Data Protection</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\" target=\"_blank\">Life Under Digits</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privacy-experts-need-career-path-tara-taubman-bassirian/\" target=\"_blank\">Privacy Experts in Need of Career Path</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/united-airlines-bad-shape-tara-taubman-bassirian-llm/\" target=\"_blank\">United Airlines In Bad Shape</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/challenges-artificial-intelligence-france-tara-taubman-bassirian-llm/\" target=\"_blank\">France Initiatives to Tackle the Challenges of Artificial Intelligence</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\">All You Need to Know About GDPR Compliance</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/jacqueline-sauvage-tara-taubman-bassirian/\" target=\"_blank\">Jacqueline Sauvage</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian/\" target=\"_blank\">Drones, Autonomus Cars, Ethics and Regulation.</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian/\" target=\"_blank\">Wearable Cameras</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/police-3d-printed-murder-victims-finger-unlock-his-taubman-bassirian/\" target=\"_blank\">Police 3D-Printed a murder victim\'s finger to unlock his phone</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/private-company-concentrix-acting-belhaf-hmrc-raising-tara/\" target=\"_blank\">Private Company Concentrix Acting on Behalf of HMRC raising a Number of Issues</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-est-en-deuil-tara-taubman-bassirian/\" target=\"_blank\">Periscope est en deuil</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/navigating-new-eu-data-protection-rules-tara-taubman-bassirian/\" target=\"_blank\">Navigating the new EU Data Protection Rules</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/why-should-we-all-care-panamapapers-tara-taubman-bassirian/\" target=\"_blank\">Why Should We All Care About PanamaPapers ?</a></li><li><a href=\"https://www.linkedin.com/pulse/copyright-claim-deny-freedom-speech-tara-taubman-bassirian/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/pulse/copyright-claim-deny-freedom-speech-tara-taubman-bassirian/\">Copyright Claim to Deny Freedom of Speech</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/welcoming-human-beings-remains-duty-tara-taubman-bassirian/\" target=\"_blank\">Welcoming Human Beings Remains a Duty</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/accueillir-les-immigr%C3%A9s-reste-un-devoir-tara-taubman-bassirian/\" target=\"_blank\">Accueillir les immigrés reste un devoir</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/right-education-tara-taubman-bassirian/\" target=\"_blank\">The Right to Education for the Right Education</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/apple-fbi-battle-security-v-privacy-tara-taubman-bassirian/\" target=\"_blank\">Apple-FBI battle of Privacy v Security</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-lawyers-tara-taubman-bassirian/\" target=\"_blank\">Periscope For Lawyers ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-tara-taubman-bassirian/\" target=\"_blank\">Periscope or not ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/ecj-says-safe-harbor-so-tara-taubman-bassirian/\" target=\"_blank\">ECJ Says Safe Harbor Is Not So Safe</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/right-forgotten-censorship-tara-taubman-bassirian/\" target=\"_blank\">The Right to be Forgotten is no Censorship</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/bigger-than-big-data-processed-information-gold-taubman-bassirian/\" target=\"_blank\">Bigger Than Big Data, Processed Information is Gold</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20141115151647-19096867-teaching-the-skills-for-life-compassion-and-empathy/?published=t\" target=\"_blank\">Teaching The Skills For Life, Compassion And Empathy</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20141019172647-19096867-how-an-online-negative-comment-can-be-positively-exploited/\" target=\"_blank\">How an Online Negative Review Can Be Positively Exploited</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20140816204805-19096867-cadeau/?published=t\" target=\"_blank\">Boyhood You Said? It Was Just Motherhood That I Saw</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20140814210844-19096867-any-hope-for-a-universal-language/?published=t\" target=\"_blank\">Any Hope For a Universal Language ?</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Elsewhere on the net :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/06/09/the-future-of-the-digital-music/\" target=\"_blank\">The Future of the Digital&nbsp;Music</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/02/22/law-enforcement-and-internet-jurisdiction/\" target=\"_blank\">Law Enforcement and Internet&nbsp;Jurisdiction</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/02/17/to-be-or-not-to-be-anonymous-anonymyity-in-the-age-of-big-and-open-data/\" target=\"_blank\">To be or not to be (anonymous)? Anonymity in the age of big and open&nbsp;data</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/01/23/catching-up-with-the-annual-cdpd-conference-in-brussels/\" target=\"_blank\">Catching up with the annual CPDP conference in&nbsp;Brussels</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2014/03/01/copyright-confusion-is-madness/\" target=\"_blank\">Copyright Confusion is&nbsp;Madness</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/12/06/to-nelson-mandela-and-all-brave-men-of-his-kind/\" target=\"_blank\">To Nelson Mandela and all brave men of his&nbsp;kind</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/02/20/the-ecommerce-directive-a-shield-for-isps-or-a-stick-with-which-they-may-be-beaten/\" target=\"_blank\">The eCommerce Directive: A shield for ISPs…. Or a stick with which they may be&nbsp;beaten ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/02/06/the-interests-of-authors-february-6-700-p-m-est/\" target=\"_blank\">The Interests of Authors, February 6, 7:00 p.m.&nbsp;EST</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/01/31/the-copyright-maddness-inflames-the-relationship-between-us-and-antiguabarbuda/\" target=\"_blank\">The Copyright madness inflames the relationship between US and&nbsp;Antigua/Barbuda</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/01/19/humanity-connected-is-god/\" target=\"_blank\">Humanity Connected is&nbsp;God ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.blogspot.com/2010/03/what-week-weak-copyright.html\" target=\"_blank\">What a week! A weak copyright ! </a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/02/jeff-jarvis-tought-me-iomega-sucks.html\">jeff Jarvis tought me iomega sucks</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/01/la-lecture-de-larticle-de-yann-leroux.html\">Des yeux dans le bac a sable, paranoia ou realite. A la recherche d\'un consentement avise</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/01/why-should-we-all-pay-for-music.html\">Why should we all pay for the Music Industry ?</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/12/loi-hadopi-1-2-3.html\">Loi Hadopi 1 + 2 = 3 ?</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/07/amazon-burns-orwells-e-books.html\">Amazon Burns Orwell\'s E-Books</a></li><li><strong><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.blogspot.com/search?updated-max=2009-12-15T13:32:00-08:00&amp;max-results=7&amp;start=7&amp;by-date=false\" target=\"_blank\">IP Addresses and User Privacy</a></strong></li><li>T<a href=\"https://clarinettesblog.blogspot.com/2009/07/technical-explanations-on-hadopi-or-law.html\">echnical explanations on HADOPI or a law in agony</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/05/twitter-suspended-my-account.html\">Twitter suspended my account!!!</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, was initially trained in French Law before settling in the UK. She has a Maitrise of Private Law from the prestigious <a href=\"https://www.u-paris2.fr/fr\" target=\"_blank\" rel=\"noreferrer noopener\">University of Pantheon Assas, Paris 2</a>, before her more recent specialisation in Computer and Communication Law with a Masters at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group&nbsp;<a class=\"\" href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a>&nbsp;with&nbsp;<a class=\"\" href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group <a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":880} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.29.42.png\" alt=\"\" class=\"wp-image-880\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":878} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Champion-Badge.png\" alt=\"\" class=\"wp-image-878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Seen on Twitter</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":252} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-31-at-11.22.40.png\" alt=\"\" class=\"wp-image-252\"/></figure>\n<!-- /wp:image -->','DATARAINBOW - PUBLICATIONS','','inherit','closed','closed','','84-revision-v1','','','2021-08-02 20:39:57','2021-08-02 20:39:57','',84,'https://www.datarainbow.eu/?p=2224',0,'revision','',0),(2225,1,'2021-08-04 09:08:42','2021-08-04 09:08:42','<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>UPDATE  3 August 2021 : Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 - Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- <strong>Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as \"<em>general data protection regulation</em>\" or \"GDPR\", provides that \"<em>any<br>data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em> \"</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2. Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":3} -->\n<ol type=\"1\" start=\"3\"><li>La Quadrature du Net is a not for profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that \"<em>the Association has as a disinterested and non-profit object\", in particular, \"the encouragement of the autonomy of users and their takeover of data concerning them ”as well as“ the defence of the social, cultural, innovation and human development interests of citizens </em>” (1)<ul><li>1. Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu\'accessibles sur</li></ul></li><li>https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net\" target=\"_blank\">via its site</a> so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2- <strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Amazon is criticised for claiming that it is carrying out certain processing of personal data concerning the persons in whose name this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3). 2.1.&nbsp;Legal bases required by the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3). </li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li><li></li><li><br><strong>2.1.1.1.&nbsp;Explicit consent</strong></li><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be an “<em>expression of will</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li>Recital 32 of the GDPR specifies that, since consent is a \"<em>positive act</em>\", \"<em>there can therefore be no consent in the event of silence, boxes checked by default or inactivity</em>\". </li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259(2).</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>” (3)</li><li>The G29 adds that \"<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>\" (4).<ul><li><em>2. G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>3. p.&nbsp;16, free translation of \"the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement\".</em></li><li><em>4</em>. <em>p.&nbsp;17, free translation of \"merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation\"</em><br></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":6} -->\n<ol type=\"1\" start=\"6\"><li>Article 4, §11, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous ”.</li><li>Article 7, §4 of the GDPR specifies that “<em>when assessing whether consent is freely given, the utmost<br>account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data. that is not necessary for the performance of that contract </em>”.</li><li>Recital 42 of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\" </li><li></li><li></li><li></li><li>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.<strong>1.2.&nbsp;Free consent</strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense, recital 43 of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.&nbsp;<sup>2</sup>Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid </em>”(5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service” (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function<br>in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that \"<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em> ”<ul><li><em>5. p.5, free translation of\" the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”. </em></li><li><em>6. p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user” </em></li></ul></li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:<ul><li>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017); </em></li><li><em>• European law must not “legitimise or encourage a practice of monetising personal data, which <em>personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em></em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</li></ul></li><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because \" <em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8) <ul><li><em>7. p.&nbsp;8, free translation of \"the GDPR ensures that the processing of personal data for<br>which consent is sought cannot become directly or indirectly the counter-performance of a contract\". </em></li><li><em>8. Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP </em></li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>\";</li><li>Recital 39 of the GDPR specifies that \"<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>\" and that \"<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.</em> ”</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent </em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this \"<em>right</em>\" would not legally have any effect, the processing being able to be based on another legal basis. </li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject<br>and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, \"<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent </em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em> ”(11)<ul><li><em>9. Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>10. L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>11. p.&nbsp;16, free translation of \"the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller\"</em></li></ul></li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them \'necessary\' for the execution of the contract</em> ”(12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract). </li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014, the expression</em> “necessary for the execution of a contract ”must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract ” (13)<ul><li><em>12. p.&nbsp;17, free translation of \"also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website<br>and the items purchased. This is because the data controller has not been contracted to carry out profiling, but  rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>. </li><li>13. p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “ necessary for the performance of a contract ”needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract </em>”.</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on  the necessity of performing a contract</em> ”.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it“<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.  </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to found a treatment on this legal basis (p. 51 and following).<ul><li>14. Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29,</li><li>15. Opinion 06/2014 of the G29 <a rel=\"noreferrer noopener\" href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\">is accessible here</a>.<br></li></ul></li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the“ privacy and electronic communications&nbsp;”directive&nbsp;”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of \"<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent , suffices): in the case of \"<em>direct prospecting for similar products or services that it itself provides</em>\".</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>\"</li><li>The G29 thus concludes that \"<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>\".</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the The user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting&nbsp;, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “<em>organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide \'actions or decisions\' taken with respect to those customers</em>” (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>\'measures or decisions\' do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals - whether positive or negative - should be avoided</em> ”(18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer\'s profile</em>” (19)</li><li>The G29 clearly concludes that \'<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage&nbsp;, location-based advertising or<br>market research. digital tracing-based </em>”(20) - 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">accessible here<br></a> <ul><li>16. L’avis 03/2013 du G29 est accessible sur : accessible sur http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf</li><li>17. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>18. p.&nbsp;28, free translation of \"\'<em>measures or decisions\' do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals - either negative or positive - should be avoided</em> » </li></ul><ul><li>19. p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer\'s profile</em>” </li><li>20. p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52<br><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ul></li><li>Amazon describes in its Notice “<em>Protection of your personal information</em>\' (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favorites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such<br>as downloads of content, streaming content and<br>viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system<ul><li>21. The leaflet \"Protecting your personal information ”from Amazon is published <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" data-type=\"URL\" data-id=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy? ie = UTF8 &amp; nodeId = 201909010\" target=\"_blank\">here</a><br> as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies<br>to which Amazon provides technical, logistical, payment, advertising or other services.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: \"<em>We use your personal information to serve<br>you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.\"&nbsp;He then refers to his Notice “Advertisements based on your interests\". (22</em>)<ul><li>22. The Amazon “<em>Ads based on your interests</em>” Notice is <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%%202A%20=%201%20&amp;%%202Aentries%20%%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\">published here</a> as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li></ul></li><li>This notice states: \"<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.\"&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to \"<em>Do not display advertisements from Amazon based on my interests</em>\", this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.<br><strong>2.2.3.2 Contract</strong></li><li>Amazon\'s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features,<br>products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em> ”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of<br>users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without   targeted advertising on the basis of them.<ul><li>23. The Amazon Terms of Service are <a rel=\"noreferrer noopener\" href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib? ie = UTF8 &amp; nodeId = 201909000\" target=\"_blank\">published here</a> , here described as of May 28, 2018</li></ul></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioral analysis and<br>advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br><ul><li><strong>2.3.&nbsp;Unlawfull processing</strong></li></ul></li><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of \"<em>cookies</em>\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found,   be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"textAlign\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Annexes </h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I: </strong>Statutes of La Quadrature du Net </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong> List of persons who mandated La Quadrature du Net to bring this claim against Amazon </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong> The Notice \"Protecting Your Personal Information\" from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice \"Interest-Based Ads\" amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 2018</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 09:08:42','2021-08-04 09:08:42','',2145,'https://www.datarainbow.eu/?p=2225',0,'revision','',0),(2228,1,'2021-08-04 12:17:44','2021-08-04 12:17:44','<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>UPDATE  3 August 2021 : Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By&nbsp;<strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is&nbsp;<a href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.&nbsp;</li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage, location-based advertising or<br>market research. digital tracing-based&nbsp;</em>”(20) – 16 G29 opinion 03/2013 is available at:&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">here<br></a><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3-&nbsp;<strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 12:17:44','2021-08-04 12:17:44','',2145,'https://www.datarainbow.eu/?p=2228',0,'revision','',0),(2227,1,'2021-08-04 12:08:25','2021-08-04 12:08:25','<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>UPDATE  3 August 2021 : Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By&nbsp;<strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is&nbsp;<a href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.&nbsp;</li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage, location-based advertising or<br>market research. digital tracing-based&nbsp;</em>”(20) – 16 G29 opinion 03/2013 is available at:&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">here<br></a><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3-&nbsp;<strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 12:08:25','2021-08-04 12:08:25','',2145,'https://www.datarainbow.eu/?p=2227',0,'revision','',0),(2229,1,'2021-08-04 12:19:18','2021-08-04 12:19:18','<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE  3 August 2021 :</strong> Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":32} -->\n<p class=\"has-text-align-center\" style=\"font-size:32px\"><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By&nbsp;<strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is&nbsp;<a href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">available online at</a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.&nbsp;</li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage, location-based advertising or<br>market research. digital tracing-based&nbsp;</em>”(20) – 16 G29 opinion 03/2013 is available at:&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">here<br></a><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3-&nbsp;<strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 12:19:18','2021-08-04 12:19:18','',2145,'https://www.datarainbow.eu/?p=2229',0,'revision','',0);
