INSERT INTO `wp_posts` (`ID`, `post_author`, `post_date`, `post_date_gmt`, `post_content`, `post_title`, `post_excerpt`, `post_status`, `comment_status`, `ping_status`, `post_password`, `post_name`, `to_ping`, `pinged`, `post_modified`, `post_modified_gmt`, `post_content_filtered`, `post_parent`, `guid`, `menu_order`, `post_type`, `post_mime_type`, `comment_count`) VALUES (2230,1,'2021-08-04 12:24:13','2021-08-04 12:24:13','<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE  3 August 2021 :</strong> Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":32} -->\n<p class=\"has-text-align-center\" style=\"font-size:32px\"><strong>Claim against Amazon Europe</strong><br>Claim lodged:<br>By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online </a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.&nbsp;</li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage, location-based advertising or<br>market research. digital tracing-based&nbsp;</em>”(20) – 16 G29 opinion 03/2013 is available at:&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">here<br></a><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3-&nbsp;<strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 12:24:13','2021-08-04 12:24:13','',2145,'https://www.datarainbow.eu/?p=2230',0,'revision','',0),(2233,1,'2021-08-04 12:34:00','2021-08-04 12:34:00','<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE  3 August 2021 :</strong> Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":32} -->\n<p class=\"has-text-align-center\" style=\"font-size:32px\"><strong>Claim against Amazon Europe</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"left\",\"customFontSize\":23} -->\n<p class=\"has-text-align-left\" style=\"font-size:23px\"><br>Claim lodged By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online </a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3. Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>24. Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”. </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or may not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two conditions alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”. Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can only be authorised if it targets subscribers who have given their prior consent</em>”. The right to object is no longer sufficient: the legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices. First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens. In the near future, advertising could be integrated into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods. </em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of commercial prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable prior consent should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure. In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information brokerage, location-based advertising or<br>market research. digital tracing-based </em>”(20) – 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">here<br></a><br><strong>2.2. Treatments carried out</strong><br><strong>2.2.1. Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>66. La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 12:34:00','2021-08-04 12:34:00','',2145,'https://www.datarainbow.eu/?p=2233',0,'revision','',0),(2231,1,'2021-08-04 12:27:27','2021-08-04 12:27:27','<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE  3 August 2021 :</strong> Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":32} -->\n<p class=\"has-text-align-center\" style=\"font-size:32px\"><strong>Claim against Amazon Europe</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"left\",\"customFontSize\":23} -->\n<p class=\"has-text-align-left\" style=\"font-size:23px\"><br>Claim lodged By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online </a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.&nbsp;</li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage, location-based advertising or<br>market research. digital tracing-based&nbsp;</em>”(20) – 16 G29 opinion 03/2013 is available at:&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">here<br></a><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3-&nbsp;<strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 12:27:27','2021-08-04 12:27:27','',2145,'https://www.datarainbow.eu/?p=2231',0,'revision','',0),(2232,1,'2021-08-04 12:30:48','2021-08-04 12:30:48','<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE  3 August 2021 :</strong> Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":32} -->\n<p class=\"has-text-align-center\" style=\"font-size:32px\"><strong>Claim against Amazon Europe</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"left\",\"customFontSize\":23} -->\n<p class=\"has-text-align-left\" style=\"font-size:23px\"><br>Claim lodged By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online </a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3. Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>24. Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.&nbsp;</li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":48} -->\n<ol type=\"1\" start=\"48\"><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage, location-based advertising or<br>market research. digital tracing-based&nbsp;</em>”(20) – 16 G29 opinion 03/2013 is available at:&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">here<br></a><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3-&nbsp;<strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 12:30:48','2021-08-04 12:30:48','',2145,'https://www.datarainbow.eu/?p=2232',0,'revision','',0),(2235,1,'2021-08-04 16:22:09','2021-08-04 16:22:09','<!-- wp:paragraph -->\n<p><a href=\"https://www.laquadrature.net/2021/07/30/amende-de-746-millions-deuros-contre-amazon-suite-a-nos-plaintes-collectives/\" target=\"_blank\" rel=\"noreferrer noopener\">La Quadrature du Net press release 4th August 2021</a> : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em><strong>Update of August 4, 2021</strong>: we have just received this <a href=\"https://www.laquadrature.net/wp-content/uploads/sites/8/2021/08/CNIL_CLP211124.pdf\">letter from the CNIL</a> giving us more details on the decision rendered in Luxembourg. In summary :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the Luxembourg authority did recognize, as we requested, that Amazon was targeting us for advertising purposes without a legal basis and therefore violated the RGD (Amazon claimed, wrongly, that the contract we entered into with it to use its services could force us to accept this targeting);</em></li><li><em>Amazon has 6 months to correct this defect in the legal basis (that is to say, to end advertising targeting or to obtain our free consent to do so);</em></li><li><em>beyond this period, Amazon will have to pay a penalty payment of € 746,000 per day of delay (this is exactly the measure we requested);</em></li><li><em>the data protection authorities of the other European states had given their agreement to the decision rendered by the Luxembourg authority (this further reinforces the pressure put on the Irish authority for our four other complaints).\"</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>On July 16, 2021</strong>, the Luxembourg personal data protection authority finally ruled on our&nbsp;<a href=\"https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf\">collective complaint</a>&nbsp;filed by 10,000 people against Amazon in May 2018. This decision comes after three years of silence that made us fear the worst ( re-read&nbsp;<a href=\"https://www.laquadrature.net/2021/05/25/les-gafam-echappent-au-rgpd-avec-la-complicite-de-la-cnil/\">our fears</a>&nbsp;which, in the case of Amazon, are therefore now obsolete).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE  3 August 2021 :</strong> Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":32} -->\n<p class=\"has-text-align-center\" style=\"font-size:32px\"><strong>Claim against Amazon Europe</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"left\",\"customFontSize\":23} -->\n<p class=\"has-text-align-left\" style=\"font-size:23px\"><br>Claim lodged By&nbsp;<strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is&nbsp;<a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online </a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>24. Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.&nbsp;</li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage, location-based advertising or<br>market research. digital tracing-based&nbsp;</em>”(20) – 16 G29 opinion 03/2013 is available at:&nbsp;<a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">here<br></a><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3-&nbsp;<strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>66. La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong>&nbsp;Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 16:22:09','2021-08-04 16:22:09','',2145,'https://www.datarainbow.eu/?p=2235',0,'revision','',0),(2234,1,'2021-08-04 16:17:50','2021-08-04 16:17:50','<!-- wp:paragraph -->\n<p><a href=\"https://www.laquadrature.net/2021/07/30/amende-de-746-millions-deuros-contre-amazon-suite-a-nos-plaintes-collectives/\" target=\"_blank\" rel=\"noreferrer noopener\">La Quadrature du Net press release 4th August 2021</a> : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>Update of August 4, 2021: we have just received this <a href=\"https://www.laquadrature.net/wp-content/uploads/sites/8/2021/08/CNIL_CLP211124.pdf\">letter from the CNIL</a> giving us more details on the decision rendered in Luxembourg. In summary :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the Luxembourg authority did recognize, as we requested, that Amazon was targeting us for advertising purposes without a legal basis and therefore violated the RGD (Amazon claimed, wrongly, that the contract we entered into with it to use its services could force us to accept this targeting);</em></li><li><em>Amazon has 6 months to correct this defect in the legal basis (that is to say, to end advertising targeting or to obtain our free consent to do so);</em></li><li><em>beyond this period, Amazon will have to pay a penalty payment of € 746,000 per day of delay (this is exactly the measure we requested);</em></li><li><em>the data protection authorities of the other European states had given their agreement to the decision rendered by the Luxembourg authority (this further reinforces the pressure put on the Irish authority for our four other complaints).\"</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>On July 16, 2021</strong>, the Luxembourg personal data protection authority finally ruled on our <a href=\"https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf\">collective complaint</a> filed by 10,000 people against Amazon in May 2018. This decision comes after three years of silence that made us fear the worst ( re-read <a href=\"https://www.laquadrature.net/2021/05/25/les-gafam-echappent-au-rgpd-avec-la-complicite-de-la-cnil/\">our fears</a> which, in the case of Amazon, are therefore now obsolete).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE  3 August 2021 :</strong> Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":32} -->\n<p class=\"has-text-align-center\" style=\"font-size:32px\"><strong>Claim against Amazon Europe</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"left\",\"customFontSize\":23} -->\n<p class=\"has-text-align-left\" style=\"font-size:23px\"><br>Claim lodged By <strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is <a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online </a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3. Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>24. Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”. </li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or may not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it. With regard to these two conditions alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”. Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can only be authorised if it targets subscribers who have given their prior consent</em>”. The right to object is no longer sufficient: the legal basis for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object. Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices. First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens. In the near future, advertising could be integrated into smart objects connected to the Internet of Things. Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods. </em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent. Once again, to frame the evolution of commercial prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable prior consent should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure. In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information brokerage, location-based advertising or<br>market research. digital tracing-based </em>”(20) – 16 G29 opinion 03/2013 is available at: <a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">here<br></a><br><strong>2.2. Treatments carried out</strong><br><strong>2.2.1. Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3- <strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>66. La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong> Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €750 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 16:17:50','2021-08-04 16:17:50','',2145,'https://www.datarainbow.eu/?p=2234',0,'revision','',0),(2237,1,'2021-08-04 16:32:42','2021-08-04 16:32:42','<!-- wp:paragraph -->\n<p><a href=\"https://www.laquadrature.net/2021/07/30/amende-de-746-millions-deuros-contre-amazon-suite-a-nos-plaintes-collectives/\" target=\"_blank\" rel=\"noreferrer noopener\">La Quadrature du Net press release 4th August 2021</a> : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em><strong>Update of August 4, 2021</strong>: we have just received this <a href=\"https://www.laquadrature.net/wp-content/uploads/sites/8/2021/08/CNIL_CLP211124.pdf\">letter from the CNIL</a> giving us more details on the decision rendered in Luxembourg. In summary :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the Luxembourg authority did recognize, as we requested, that Amazon was targeting us for advertising purposes without a legal basis and therefore violated the RGD (Amazon claimed, wrongly, that the contract we entered into with it to use its services could force us to accept this targeting);</em></li><li><em>Amazon has <strong>6 months to modify th</strong>e lawful legal basis (that is to say, to end advertising targeting or to obtain our free consent to do so);</em></li><li><em>beyond this period, Amazon will have to pay a <strong>penalty payment of € 746,000 per day of delay</strong> (this is exactly the measure we requested);</em></li><li><em>the data protection authorities of the other European states had given their agreement to the decision rendered by the Luxembourg authority (this further reinforces the pressure put on the Irish authority for our four other complaints).\"</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>On July 16, 2021</strong>, the Luxembourg personal data protection authority finally ruled on our&nbsp;<a href=\"https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf\">collective complaint</a>&nbsp;filed by 10,000 people against Amazon in May 2018. This decision comes after three years of silence that made us fear the worst ( re-read&nbsp;<a href=\"https://www.laquadrature.net/2021/05/25/les-gafam-echappent-au-rgpd-avec-la-complicite-de-la-cnil/\">our fears</a>&nbsp;which, in the case of Amazon, are therefore now obsolete).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE  3 August 2021 :</strong> Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":32} -->\n<p class=\"has-text-align-center\" style=\"font-size:32px\"><strong>Claim against Amazon Europe</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"left\",\"customFontSize\":23} -->\n<p class=\"has-text-align-left\" style=\"font-size:23px\"><br>Claim lodged By&nbsp;<strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is&nbsp;<a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online </a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>24. Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.&nbsp;</li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage, location-based advertising or<br>market research. digital tracing-based&nbsp;</em>”(20) – 16 G29 opinion 03/2013 is available at:&nbsp;<a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">here<br></a><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3-&nbsp;<strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>66. La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong>&nbsp;Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €746 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 16:32:42','2021-08-04 16:32:42','',2145,'https://www.datarainbow.eu/?p=2237',0,'revision','',0),(2238,1,'2021-08-04 16:39:49','2021-08-04 16:39:49','','Screenshot-2021-08-04-at-17.35.26','','inherit','open','closed','','screenshot-2021-08-04-at-17-35-26','','','2021-08-04 16:39:49','2021-08-04 16:39:49','',2145,'https://www.datarainbow.eu/wp-content/uploads/2021/08/Screenshot-2021-08-04-at-17.35.26.png',0,'attachment','image/png',0),(2239,1,'2021-08-04 16:39:58','2021-08-04 16:39:58','<!-- wp:paragraph -->\n<p><a href=\"https://www.laquadrature.net/2021/07/30/amende-de-746-millions-deuros-contre-amazon-suite-a-nos-plaintes-collectives/\" target=\"_blank\" rel=\"noreferrer noopener\">La Quadrature du Net press release 4th August 2021</a> : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em><strong>Update of August 4, 2021</strong>: we have just received this <a href=\"https://www.laquadrature.net/wp-content/uploads/sites/8/2021/08/CNIL_CLP211124.pdf\">letter from the CNIL</a> giving us more details on the decision rendered in Luxembourg. In summary :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the Luxembourg authority did recognize, as we requested, that Amazon was targeting us for advertising purposes without a legal basis and therefore violated the RGD (Amazon claimed, wrongly, that the contract we entered into with it to use its services could force us to accept this targeting);</em></li><li><em>Amazon has <strong>6 months to modify th</strong>e lawful legal basis (that is to say, to end advertising targeting or to obtain our free consent to do so);</em></li><li><em>beyond this period, Amazon will have to pay a <strong>penalty payment of € 746,000 per day of delay</strong> (this is exactly the measure we requested);</em></li><li><em>the data protection authorities of the other European states had given their agreement to the decision rendered by the Luxembourg authority (this further reinforces the pressure put on the Irish authority for our four other complaints).\"</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>On July 16, 2021</strong>, the Luxembourg personal data protection authority finally ruled on our&nbsp;<a href=\"https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf\">collective complaint</a>&nbsp;filed by 10,000 people against Amazon in May 2018. This decision comes after three years of silence that made us fear the worst ( re-read&nbsp;<a href=\"https://www.laquadrature.net/2021/05/25/les-gafam-echappent-au-rgpd-avec-la-complicite-de-la-cnil/\">our fears</a>&nbsp;which, in the case of Amazon, are therefore now obsolete).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE  3 August 2021 :</strong> Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2238,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/08/Screenshot-2021-08-04-at-17.35.26-1024x598.png\" alt=\"\" class=\"wp-image-2238\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":32} -->\n<p class=\"has-text-align-center\" style=\"font-size:32px\"><strong>Claim against Amazon Europe</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"left\",\"customFontSize\":23} -->\n<p class=\"has-text-align-left\" style=\"font-size:23px\"><br>Claim lodged By&nbsp;<strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is&nbsp;<a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online </a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>24. Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.&nbsp;</li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage, location-based advertising or<br>market research. digital tracing-based&nbsp;</em>”(20) – 16 G29 opinion 03/2013 is available at:&nbsp;<a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">here<br></a><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3-&nbsp;<strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>66. La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong>&nbsp;Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €746 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 16:39:58','2021-08-04 16:39:58','',2145,'https://www.datarainbow.eu/?p=2239',0,'revision','',0),(2391,1,'2022-08-22 16:37:07','2022-08-22 16:37:07','<!-- wp:heading {\"level\":3} -->\n<h3>The modern Cassandra Complex - By <a href=\"https://www.linkedin.com/in/daniel-aldridge-2a93922b/\">Daniel Aldridge</a> Senior Policy &amp; Programmes Manager at BCS, The Chartered Institute for IT</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Published on March 12, 2021</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I\'m never one to shy away from a niche topic, especially one at the vanguard of politics and technology, so I was happy to speak at the Holyrood Connect event last week on cyber security and data protection post Brexit. <a rel=\"noreferrer noopener\" href=\"https://cybersecurityni.holyrood.com/agenda\" target=\"_blank\">Public Sector Cyber Security Northern Ireland</a> Especially as increasingly I feel that we in the IT and digital communities are are suffering from a modern Cassandra complex where we know there are existential threats that need action, but its so often being put in the too-difficult box.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the panel, I was joined by fellow BCS member, lawyer and Data Protection Consultant, Tara Taubman-Bassirian of Data Rainbow; Joseph Byrne, Privacy Solutions Engineer at OneTrust and the event chair, David Lee, formerly of The Scotsman. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I spent 6 years working in Scottish public policy and campaigns and I’m no stranger to Holyrood Connect as a force for good in addressing the critical digital issues of our times and its place as a strong voice for devolved administrations. Also, the Chartered Institute has sizeable active membership in Scotland, Northern Ireland and Wales and it’s been personal commitment of mine to drive greater engagement and collaboration across the UK’s rich tech landscape so the future of IT and digital technologies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chartered Institute is primarily a network of its people and over the past 12 months it’s been amazing how our members and the wider IT and digital communities have continued to make IT good for society whilst we all face huge and unprecedented threats.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IT workers really are the unsung heroes of the pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s important to note that in the context of rapid service and product delivery changes etc; organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But the problem for many of us working in this area is that so many of our organisations are caught up in this perfect storm without even the awareness they need legal advice and expertise, let alone having it in house.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A big bug bear for me and my colleagues is the absence of CIOs or equivalent at the highest levels of organisational decision making and risk management.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hear often about an encouraging rise in the amount of boards with a dedicated person with responsibility for cyber and data security and protection; but in many situations, it does feel very much like when boards were encouraged to appoint a diversity champion, the person was often not appointed based on real knowledge or expertise and were asked to ‘take on’ the brief. In both cases, the board member often relies almost exclusively on the briefing of the IT team with much lost in translation and debate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When we look at how many Boards include a CIO or equivalent, the picture is problematic, only 10 -20% of NHS organisations for example have a CIO or equivalent at the highest level of decision making and risk management<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the demand is there though for better, tech led decision making!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The past decade has seen a cottage industry grow up around supporting technologists to speak effectively with boards and decision makers; this is why we are so keen to drive professional standards and professional development across the IT world to drive up this capacity to support innovation and mitigate risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A new data regime ushered in by the UK’s Data Strategy will reiterate the need for effective data maintenance and governance while removing obstacles and impediments to innovation, an opportunity to basically clean up our digital processes and make them fit for a more dynamic digital infrastructure. Indeed the new information commissioner’s job specification<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;requires a drive to do just that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This aside, despite the sabre rattling from both sides over the past few months, most of the signs indicate that the UK and EU want to cooperate on a number of key areas such as enforcement, cyber security, copyright infringement, IP, tech sovereignty and certain areas of competition. This may well mean that the ICO will turn its attention more meaningfully to scrutinising data governance procedures, while also calling out over-burdensome procedures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite no clear public desire to needlessly interrupt trade, it’s unclear how long an adequacy agreement, if finally ratified by EU states, can be sustainable. As a third country, the UK will be susceptible to judicial review similar to Schrems 2 and outside the EU, we’ll be held to a higher standard.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To be competitive the UK needs to show it is dynamic and has a commercial edge over the EU in certain areas, data will be one of those areas; the political and legal challenges are however huge!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Make no mistake, privacy campaigners have the UK in their sights and will seek to make this the next battleground, so depending on where and how we plan to flex our independence on things like human rights legislation etc, there will be a need for preparatory action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what can we do…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>listen to and champion your IT and data protection people to help get our houses in order</li><li>Continue to drive up professional standards and champion the mitigation of risk across the economy and civil society</li><li>Raise the issues you care about with your elected officials, I don\'t think there is enough literacy at national, devolved or local government level for us to reap the benefits, we should be aiming to thrive, not just survive</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We’re all learning ‘on the job’ on this so let’s continue to have these conversations, mainstream the issues and make sure we’re ahead of the game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref1\" target=\"_blank\">[1]</a>&nbsp;<a href=\"https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/\" target=\"_blank\" rel=\"noreferrer noopener\">Networks issues open letter to get CCIOs and CIOs on NHS boards</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref2\" target=\"_blank\">[2]</a>&nbsp;<a rel=\"noreferrer noopener\" href=\"https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/\" target=\"_blank\">HM Government Public Appointments</a></p>\n<!-- /wp:paragraph -->','Beyond Brexit: Cyber Security and Data Protection','In the context of rapid service and product delivery changes, organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!','inherit','closed','closed','','2026-revision-v1','','','2022-08-22 16:37:07','2022-08-22 16:37:07','',2026,'https://www.datarainbow.eu/?p=2391',0,'revision','',0),(2241,1,'2021-08-04 22:24:26','2021-08-04 22:24:26','<!-- wp:paragraph -->\n<p><a href=\"https://www.laquadrature.net/2021/07/30/amende-de-746-millions-deuros-contre-amazon-suite-a-nos-plaintes-collectives/\" target=\"_blank\" rel=\"noreferrer noopener\">La Quadrature du Net press release 4th August 2021</a> : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em><strong>Update of August 4, 2021</strong>: we have just received this&nbsp;<a href=\"https://www.laquadrature.net/wp-content/uploads/sites/8/2021/08/CNIL_CLP211124.pdf\">letter from the CNIL</a>&nbsp;giving us more details on the decision rendered in Luxembourg.&nbsp;In summary :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the Luxembourg authority did recognize, as we requested, that Amazon was targeting us for advertising purposes without a legal basis and therefore violated the RGD (Amazon claimed, wrongly, that the contract we entered into with it to use its services could force us to accept this targeting);</em></li><li><em>Amazon has <strong>6 months to modify th</strong>e lawful legal basis (that is to say, to end advertising targeting or to obtain our free consent to do so);</em></li><li><em>beyond this period, Amazon will have to pay a <strong>penalty payment of € 746,000 per day of delay</strong> (this is exactly the measure we requested);</em></li><li><em>the data protection authorities of the other European states had given their agreement to the decision rendered by the Luxembourg authority (this further reinforces the pressure put on the Irish authority for our four other complaints).\"</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The solid arguments developed by La Quadrature du Net and the legal requirement for lawful processing of customers data and direct marketing can be found on these<a rel=\"noreferrer noopener\" href=\"https://fr.slideshare.net/clarinette02/edit_my_uploads\" target=\"_blank\"> Slideshares</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>On July 16, 2021</strong>, the Luxembourg personal data protection authority finally ruled on our <a href=\"https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf\">collective complaint</a> filed by 10,000 people against Amazon in May 2018. This decision comes after three years of silence that made us fear the worst ( re-read <a href=\"https://www.laquadrature.net/2021/05/25/les-gafam-echappent-au-rgpd-avec-la-complicite-de-la-cnil/\">our fears</a> which, in the case of Amazon, are therefore now obsolete).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/ See translationSee translation of this comment\" target=\"_blank\">La Quadrature du Net press release</a> \"<em>CNPD, the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.”</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Bloomberg revealed the fine : <a href=\"https://www.bloomberg.com/news/articles/2021-07-30/amazon-given-record-888-million-eu-fine-for-data-privacy-breach\">Amazon Gets Record $888 Million EU Fine Over Data Violations</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a class=\"\" href=\"https://www.fastcompany.com/90656170/targeted-ads-arent-just-annoying-they-can-be-harmful-heres-how-to-fight-back\">FastCompany : Targeted ads aren’t just annoying, they can be harmful. Here’s how to fight back</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Politico : <a rel=\"noreferrer noopener\" href=\"https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/\" target=\"_blank\">https://www.politico.eu/article/amazon-fine-luxembourg-europe-privacy-champion/</a> <em>With Amazon fine, Luxembourg emerges as Europe’s unlikely privacy champion : \'Amazon has already said it intends to defend itself against Luxembourg\'s decision \"vigorously,\" and said Luxembourg\'s fine was predicated on \"subjective and untested interpretations of European privacy law,\" that are \"entirely out of proportion.”\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The laws of Luxembourg will protect the supervisory authority from any publication of the decision we might never see. Quite ironic of an authority in charge of transparency. I\'ve had the confirmation from La Quadrature du Net that they have not been officially informed by the CPD. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Amazon would have said : Amazon said, \"We believe the CNPD\'s decision to be without merit and intend to defend <em>ourselves vigorously in this matter.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD\'s ruling, and we intend to appeal.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation,\" the company added.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Forbes : <a href=\"https://www.forbes.com/sites/jonathanponciano/2021/07/30/amazon-stock-loses-130-billion-in-market-value-after-885-million-fine-and-dismal-earnings-report/?sh=4ada9ab78922\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Stock Loses $130 Billion In Market Value After $885 Million Fine And Disappointing Earnings Report</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong><em>Interesting news on the Amazon fine, to be confirmed :</em></strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Lawint, the CPDP decision has not been published and will not be published !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There would be an appeal to the administrative court on its way.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, the EDBP would have asked the CPD to m=ultiply the fine by 10.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Affaire à suivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE  3 August 2021 :</strong> Finally, some news from the <a href=\"https://www.cnil.fr/fr/lautorite-luxembourgeoise-de-protection-des-donnees-prononce-lencontre-damazon-europe-core-une\">CNIL</a> ‘A l’issue d’une procédure de collaboration avec la CNIL, la Commission Nationale pour la Protection des Données luxembourgeoise, a prononcé à l’encontre de la société Amazon Europe Core une amende d’un montant de sept cent quarante-six millions d’euros’ CNIL confirms the ‘unprecedented high’ fine decision based on LQDN’s complaint. According to Luxembourg legislation it will only be published once all appeals exhausted.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve been constantly repeating consent has to be freely given, informed, unambiguous and not detrimental to the access to the service.<br>\"the main object of the contract with Amazon when using its website is the buying and selling of goods. This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.\"<br>\"The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.<br>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting by means of \"cookies\", cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.<br>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a quick unofficial translation of the claim by the French NGO La Quadrature du Net that leads to the CNDP Luxembourg\'s decision against Amazon (not published yet). Still working on it but it gives you the essence. You can help me to reformulate some of the expressions that are not the usual english words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2238,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/08/Screenshot-2021-08-04-at-17.35.26-1024x598.png\" alt=\"\" class=\"wp-image-2238\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":32} -->\n<p class=\"has-text-align-center\" style=\"font-size:32px\"><strong>Claim against Amazon Europe</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"left\",\"customFontSize\":23} -->\n<p class=\"has-text-align-left\" style=\"font-size:23px\"><br>Claim lodged By&nbsp;<strong>La Quadrature du Net</strong>, located at 60 rue des Orteaux, 75020 – Paris, France;<br>Against Amazon Europe Core SARL, Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, located at 5 rue Plaetis, L -2338 Luxembourg and Amazon Video Limited located 1 Principal Place, Worship Street, London, EC2A 2FA, UK (ci -after referred to as “Amazon”), as those responsible for processing personal data processed via the Amazon Services.<br>A copy of this complaint is&nbsp;<a rel=\"noreferrer noopener\" href=\"https://gafam.laquadrature.net/wpcontent/uploads/sites/9/2018/05/amazon.pdf\" target=\"_blank\">available online </a>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Article 77, §1, of Regulation 2016/679 of the European Parliament and of the Council of the European Union, relating to the protection of individuals with regard to the processing of personal data and on the free movement of such data. data, hereinafter referred to as “<em>general data protection regulation</em>” or “GDPR”, provides that “<em>any data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State in which is his habitual residence, his place of work or the place where the violation would have been committed, if it considers that the processing of personal data concerning him constitutes a violation of this Regulation</em>&nbsp;“.</li><li>Article 80, §1 of the GDPR provides that “<em>the data subject has the right to mandate a non-profit body, organisation or association, which has been validly constituted in accordance with the law of a Member State, whose statutory objectives are of public&nbsp;interest&nbsp;and is active in the field of the protection of the rights and freedoms of data subjects within the framework of the protection of personal data concerning them, so that he lodges a complaint on his behalf, exercises in its name the rights referred to in Articles 77, 78 and 79 and exercises on its behalf the right to obtain compensation referred to in Article 82 when the law of a Member State so provides</em>”.</li><li>La Quadrature du Net is a not-for-profit association under the 1901 law declared at the prefecture on February 5, 2013. It provides in its statutes that “<em>the Association has as a disinterested and non-profit object”,&nbsp;</em>in particular,&nbsp;<em>“the encouragement of the autonomy of users and their takeover of data concerning them”&nbsp;</em>as well as<em>&nbsp;“ the defence of the social, cultural, innovation and human development interests of citizens&nbsp;</em>” (1)</li><li>From April 16 to May 27, 2018, in application of article 80 of the RGPD, La Quadrature du Net invited any individual residing in France to mandate it&nbsp;<a href=\"https://gafam.laquadrature.net/\" target=\"_blank\" rel=\"noreferrer noopener\">via its site</a>&nbsp;so that it exercises, on their behalf, the rights conferred on it by article 77 of the GDPR, in order to lodge this complaint with the CNIL.</li><li>10,065 people, claiming to use Amazon services, have mandated La Quadrature du Net to do so (the list of their names is attached in Appendix II).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>2-&nbsp;<strong>COMPLAINTS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Amazon is criticised for claiming that it is carrying out processing of personal data concerning the persons in whose names this complaint is made (2.2) without, however, basing this processing on one of the legal bases required by law (2.1), rendering therefore these unlawful (2.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.&nbsp;Legal bases required by the GDPR.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1. GDPR required legal basis</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, of the GDPR lists the six grounds under which personal data can be lawfully processed.&nbsp;Three of these six cases are: the consent of the data subject (2.1.1), the performance of a contract with the data subject (2.1.2);&nbsp;the legitimate interest of the controller or a third party (2.1.3).&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.&nbsp;Consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Article 6, §1, a, of the GDPR provides that processing may be lawful if “<em>the data subject has given consent to the processing of their personal data for one or more specific purposes”</em>.</li><li>To be valid, this consent must be given in an explicit and free manner and requested in a fair manner.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.1.&nbsp;Explicit consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be an “<em>unambiguous indication</em>” expressed “<em>by a statement or by a clear affirmative action</em>”.</li><li><strong>Recital 32</strong>&nbsp;of the GDPR specifies that, since consent is a “<em>positive act</em>“, “<em>there can therefore be no consent in the event of silence, pre-ticked boxes or inactivity should not therefore constitute consent</em>“.&nbsp;</li><li>The “Article 29 Working Group” (G29) clarified the meaning of these provisions in their guidelines on the notion of consent in the GDPR, adopted on April 10, 2018 (guidelines WP259. (2)</li><li>It indicates that “t<em>he GDPR does not authorise data controllers to provide for pre-ticked boxes or opt-out mechanisms which require the data subject to intervene to prevent the agreement</em>”. (3)</li><li>The G29 adds that “<em>the simple fact of continuing the ordinary use of a website is not a behaviour from which one can deduce an expression of an agreement to the proposed processing</em>”. (4)</li><li><strong>Article 4, §11</strong>, of the GDPR requires that, in order to be valid, the consent must be a “<em>freely given, specific, informed and un</em>ambiguous”.</li><li><strong>Article 7, §4</strong>&nbsp;of the GDPR specifies that “<em>when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract</em>”.</li><li><strong>Recital 42</strong>&nbsp;of the GDPR specifies that “<em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>”&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.2.&nbsp;Free consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":18} -->\n<ol type=\"1\" start=\"18\"><li>In the same sense,&nbsp;<strong>recital 43</strong>&nbsp;of the GDPR provides that “<em>consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent being necessary for such performance.</em>”</li><li>The G29 has clearly specified the meaning of these provisions in its guidelines (WP259, cited above), explaining that “<em>the GDPR provides that if the data subject does not have a real choice, feels compelled to consent or will suffer negative consequences if it does not&nbsp;consent, so the consent is not valid</em>”. (5)</li><li>Among the negative consequences that the refusal to consent must not cause, the G29 targets the case where “the use of a service would be detrimental to the access of the service”. (6)<br>It gives as a practical&nbsp;example&nbsp;a mobile application to which the user would refuse to give access to the accelerometer of the phone (for reasons of behavioural analysis) and which, for this reason, would only function in a limited way (see the example 8, given on p.11).&nbsp;For the G29, this would be a negative consequence incompatible with free consent.</li><li>In general, the G29 sums up these requirements by explaining that “<em>the GDPR guarantees that the processing of personal data for which the requested consent cannot become, directly or indirectly, the condition of a contract</em>”.</li><li>This interpretation is moreover in line with the desire that the European Parliament has clearly expressed recently, twice:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>• “<em>No user may be refused access to a service […] on the grounds that he has not consented […] to the processing of his personal data […] not necessary for the provision of the service.&nbsp;”(Article 8, §1 bis, of the version of the“ ePrivacy ”regulation adopted on 23 October 2017);&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>• European law must not “legitimise or encourage a practice of monetising personal data, which&nbsp;personal data cannot be compared to a price, and therefore cannot be considered as a commodity</em>” (recital 13 of the version of the Directive “Digital content” adopted on November 21, 2017).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":23} -->\n<ol type=\"1\" start=\"23\"><li>Finally, it must be emphasised that these requirements already existed in the law prior to the GDPR, the latter having contented itself here with codifying.&nbsp;For example, in France, on December 18, 2017, the CNIL announced that it was notifying an injunction to Whatsapp to stop sharing various data on its users&nbsp;to Facebook&nbsp;, on the grounds that this transmission was based on a non-free consent of users, because ”&nbsp;<em>the data subject refusal concerned to give his consent to the transmission of his data will necessarily have significant&nbsp;negative consequences&nbsp;since he will be forced to delete his account and will not be able to use the WhatsApp application</em>”. (8)&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.1.3.&nbsp;Fairness of the request for consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>24. Article 5, §1, a, of the GDPR provides that “<em>personal data must be […] processed lawfully, fairly and in a transparent manner in relation to the data subject</em>“;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":25} -->\n<ol type=\"1\" start=\"25\"><li>Recital 39 of the GDPR specifies that “<em>The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used</em>” and that “<em>Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing</em>”.</li><li>Article 7, §3 of the GDPR provides that “<em>the data subject has the right to withdraw his consent at any time</em>” and, in application of the principle of lawfulness and transparency, that “<em>the data subject is informed before giving his consent</em>”.</li><li>Therefore, processing would be neither fair nor transparent (nor therefore lawful) if it was based on the consent of the data subject while, at the same time, the controller would&nbsp;allow&nbsp;himself the opportunity to base the processing on another legal basis (for example, to anticipate the event that the data subject withdraws their consent).&nbsp;In fact, in such circumstances, the information given to the data subject as to the right he would have to withdraw his consent would be perfectly misleading: this “<em>right</em>” would not legally have any effect, the processing being able to be based on another legal basis.&nbsp;</li><li>Thus, the processing of personal data can never be lawful if it is based both on the consent of the data subject and on another legal basis, as this would systematically make the information that must be given to the person with regard to the right&nbsp;misleading.&nbsp;to withdraw consent.</li><li>This is the conclusion reached by the G29, explaining that, “<em>if a data controller chooses to base part of its processing on consent, he must be ready to respect this choice and to end this part of the processing. if an individual withdraws their consent.&nbsp;To give the impression that data will be processed on the basis of consent, when in fact it will&nbsp;be processed on&nbsp;another legal basis, would be fundamentally unfair to individuals.&nbsp;In other words, the data controller cannot exchange consent with other legal bases.&nbsp;For example, it is not allowed to retrospectively use the legitimate interest in order to justify a treatment when difficulties have arisen concerning the validity of the consent&nbsp;</em>”(9) (p.23 of the WP259 guidelines mentioned above).</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.1.2.&nbsp;Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":30} -->\n<ol type=\"1\" start=\"30\"><li>Article 6, §1, b, of the GDPR provides that processing may be lawful if “<em>necessary for the performance of a contract to which the data subject is party</em>”.</li><li>This provision is identical to that already provided for in Article 7, b, of Directive 95/46 / EC, which the GDPR has replaced.&nbsp;It has thus already been detailed by the G29 in its opinion 06/2014, issued on November 25, 2014 (10), as “<em>to be interpreted strictly and not to cover cases where the processing is not really necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller</em>”. (11)</li><li>The G29 added that “<em>the fact that certain data processing operations are covered by a contract does not automatically mean that these processing operations are necessary for its execution.&nbsp;For example, article 7, b, is not a suitable legal basis for profiling the tastes and lifestyles of a user based on his browsing experience on a website and the products he has. purchased.&nbsp;Indeed, the contract was not concluded to carry out a profile, but to provide certain goods or certain services, for example.&nbsp;Even if these treatments were specifically mentioned in the details of the contract, this fact alone would not make them ‘necessary’ for the execution of the contract</em>”. (12)</li><li>These requirements perfectly reflect those imposed in terms of free consent, in order to achieve the same result: the purpose pursued by the data subject by entering into a relationship with the data controller must not lead to the authorisation of another, independent&nbsp;purpose&nbsp;than the data subject. does not wish to continue. Indeed, not to reflect these contract requirements would be tantamount to nullifying the conditions of validity of the consent (seen earlier), since they could be entirely circumvented based on this other legal basis (the contract).&nbsp;</li><li>This reflection between “<em>contract</em>” and “<em>consent</em>” is found in the recent WP259 guidelines dedicated to consent (cited earlier), where the G29 integrates its 2014 position into the GDPR: “<em>In accordance with G29 opinion 06/2014,&nbsp;</em>the expression&nbsp;“<em>necessary for the execution of a contract” must be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract individually with each of the data subjects […] There must be a direct and objective link between the processing of data and the purpose of the performance of the contract</em>”. (13)</li><li>In practice, these requirements have for example found application in the sanction issued, in France, by the CNIL against Facebook, on April 27. The CNIL then considers that “<em>the main object of the service is the provision of a social network […], that the combination of user data for the purposes of advertising targeting does not correspond either to the main object of the contract nor to the expectations. reasonable users [and, thus,] that companies [cannot] rely on the necessity of performing a contract</em>”.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.1.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":35} -->\n<ol type=\"1\" start=\"35\"><li>Article 6, §1, f of the GDPR provides that processing may be lawful if it “<em>is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>”.&nbsp;</li><li>Recital 47 of the GDPR provides that “<em>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</em>”</li><li>Without directly defining the criteria so that prospecting may or&nbsp;may&nbsp;not meet a legitimate interest, the GDPR here echoes the encain its opinion 06/2014 dedicated to the notion of legitimate interest (15) takes precisely the evolution of this framework as an educational example illustrating the balance to be sought in order to find a procedssing on this legal basis (p. 51 and following).</li><li>In 1995, Directive 95/46 / EC provided, via its article 14, b, that processing for prospecting purposes was lawful if the data subject was informed and could object to it.&nbsp;With regard to these two conditions&nbsp;alone, the G29 understands that the legal basis given to this processing was the legitimate interest (no prior consent being required).</li><li>In 2002, the G29 explained that, “to take account of new technological advances, this provision was subsequently supplemented by specific provisions of the “<em>privacy and electronic communications directive</em>”.&nbsp;Article 13, §1, of this directive (Directive 2002/58 / EC) now provides that, in principle, the use of “<em>electronic mail for direct marketing purposes can&nbsp;only&nbsp;be authorised if it targets subscribers who have given their prior consent</em>”.&nbsp;The right to object is no longer sufficient: the legal&nbsp;basis&nbsp;for prospecting has shifted from legitimate interest to consent.</li><li>It is only as an exception that Article 13, §2, of Directive 2002/58 / EC still provides for a specific case where the legitimate interest remains valid (and where the simple right of opposition, without prior consent, suffices): in the case of “<em>direct prospecting for similar products or services that it itself provides</em>“.</li><li>At the same time, this same directive first provided, in its article 5, §3, that the storage and access to information on the terminal of a user were authorised if the data subject was informed and could object.&nbsp;Once again, it is here the legitimate interest that was initially chosen as the legal basis.</li><li>The G29 traces the evolution that followed: “<em>Technologies have evolved, requiring similar, relatively simple solutions which follow a similar logic for new prospecting practices.&nbsp;First, the way prospecting material is disseminated has evolved: instead of just emails arriving in mailboxes, targeted behavioural ads now also appear on smartphone and computer screens.&nbsp;In the near future, advertising could be integrated into smart objects connected to the Internet of Things.&nbsp;Second, advertisements are becoming more and more specifically targeted: instead of relying on simple customer profiles, they draw It started with tracking consumer activity which is increasingly kept online and offline and analysed using more sophisticated automated methods.&nbsp;</em>“</li><li>The G29 thus concludes that “<em>this change in the dominant business model and the valuation of personal data as an asset for commercial companies explain the recent requirement for consent in this context</em>“.</li><li>In 2009, in fact, article 5, §3, of directive 2002/58 / CE was amended by directive 2009/136 / CE so that access and deposit of information on the terminal of the user can no longer rely on legitimate interest, but only on consent.&nbsp;Once again, to frame the evolution of commercial&nbsp;prospecting, the legal basis has shifted from legitimate interest to consent.</li><li>In view of these developments, it appears obvious that no other form of behavioural analysis for advertising purposes can experience a fate different from that of “<em>cookies</em>”: to be lawful only with the prior consent of the persons concerned.</li><li>This is the path taken by the G29 in appendix II of its opinion 03/2013 (16), on Big Data and Open Data: “<em>free, specific, informed and unmistakable&nbsp;prior consent&nbsp;should almost always be required</em>” therefore that an “organisation specifically wishes to analyse or predict the personal preferences, behaviour and attitudes of individual customers, which will then serve to guide ‘actions or decisions’ taken with respect to those customers”. (17)</li><li>The G29 specifies that these “<em>‘measures or decisions’ do not cover only formal decisions and measures taken in a formal procedure.&nbsp;In other words: any relevant effect on particular individuals – whether positive or negative – should be avoided</em>”. (18)</li><li>He gives as an example of such “<em>measures and decisions</em>” the dissemination of “<em>personalised discounts, special offers and targeted advertising based on the customer’s profile</em>”. (19)</li><li>The G29 clearly concludes that ‘<em>consent should above all be required, for example, for tracking and profiling for the purposes of direct marketing, behavioural advertising, information&nbsp;brokerage, location-based advertising or<br>market research. digital tracing-based&nbsp;</em>”(20) – 16 G29 opinion 03/2013 is available at:&nbsp;<a rel=\"noreferrer noopener\" href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\" target=\"_blank\">here<br></a><br><strong>2.2.&nbsp;Treatments carried out</strong><br><strong>2.2.1.&nbsp;Data processed</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":51} -->\n<ol type=\"1\" start=\"51\"><li>Amazon describes in its Notice “<em>Protection of your personal information</em>‘ (21) the data that it processes when providing its services.</li><li>Without being exhaustive as to the data processed, which are all relevant to establish the complaints invoked, it is useful to point out that Amazon declares that it processes, with regard to its users:<br>• the products, content or services sought or consulted;<br>• orders placed;<br>• information and documents relating to identity and status;<br>• images, videos or any other file uploaded to an Amazon service;<br>• Playlists, favourites lists, wish lists, gift lists;<br>• the IP (Internet Protocol) address of the device;<br>• connection data, e-mail addresses and passwords;<br>• information about the computer, the device and the Internet connection such as, for example, the applications of the device, the type and<br>version of the browser, the categories and versions of browser plug-ins, the operating system or setting time zones;<br>• the location of the device or computer;<br>• information on interactions with content, such as downloads of content, streaming content and viewing details, including duration and the number of streaming, simultaneous downloads, the details of the system for streaming, and the quality of the download, including information relating to the internet service provider;<br>• information concerning interactions on a page (“scrolling”, clicks, mouse movements);<br>• information on interactions with third party companies to which Amazon provides technical, logistical, payment, advertising or other services.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.2.&nbsp;Processing performed</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":53} -->\n<ol type=\"1\" start=\"53\"><li>In that same notice, Amazon states: “<em>We use your personal information to serve you interest-&nbsp;based advertisements&nbsp;for features, products and services that may be of interest to you.”&nbsp;He then refers to his Notice “Advertisements based on your interests”. (22</em>)</li><li>This notice states: “<em>In order to show you ads based on your interests, we use information such as that relating to your use of Amazon&nbsp;sites, content or services&nbsp;</em>.”&nbsp;In addition, on the page https://www.amazon.fr/adprefs, Amazon allows its users to “<em>Do not display advertisements from Amazon based on my interests</em>“, this option being unchecked by default.</li><li>From this different information, it appears that Amazon processes personal data in order to carry out behavioural analyses and targeted advertisement.&nbsp;Amazon is the data controller of these operations, the purpose of which is to allow the advertisements disseminated by Amazon to be displayed to the users most likely to be receptive to them.<br><br><strong>2.2.3.&nbsp;Legal basis</strong><br><strong>2.2.3.1 Consent</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":56} -->\n<ol type=\"1\" start=\"56\"><li>No document published by Amazon suggests that it intends to base its behavioural analysis and advertising targeting treatments on the consent of its users.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br><strong>2.2.3.2 Contract</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":57} -->\n<ol type=\"1\" start=\"57\"><li>Amazon’s “<em>Terms of Service</em>” (23) provide: “<em>As part of the Amazon Services, we will recommend features, products and services, including third-party advertising, that may be of interest to you, we will identify your preferences and we will personalise your experience</em>&nbsp;”.</li><li>By this, Amazon could indicate that its behavioural analysis and advertising targeting processing would be provided for in the contract it enters into with its users, the execution of which would make them necessary.</li><li>However, submitting to this behavioural analysis and advertising targeting is not the goal that Amazon users pursue when using its services.&nbsp;To quote the CNIL, “<em>the combination of user data for targeted advertising purposes corresponds neither to the main object of the contract nor to the reasonable expectations of users</em>” (decision SAN-2017-006 mentioned above).</li><li>Typically, the main object of the contract with Amazon when using its website is the buying and selling of goods.&nbsp;This purpose can perfectly be pursued without establishing behavioural profiles and without targeted advertising on the basis of them.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.2.3.3.&nbsp;Legitimate interest</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":62} -->\n<ol type=\"1\" start=\"62\"><li>Amazon does not explicitly invoke its legitimate interest as the basis for its behavioural analysis and advertising&nbsp;targeting processing&nbsp;.&nbsp;As explained above in section 2.1.3, it would be impossible to do so in accordance with the GDPR.<br></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2.3.&nbsp;Unlawfull processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\",\"start\":63} -->\n<ol type=\"1\" start=\"63\"><li>The behavioural analysis and advertising targeting treatments implemented by Amazon on its services, as described above, cannot be based on the need to perform a contract with users.</li><li>They cannot be based on a legitimate interest either, because their purpose is to analyse the behaviour and to establish a profile of the users for purposes of advertising targeting which, no more than the targeting<br>by means of “<em>cookies</em>“, cannot be authorised without the prior&nbsp;consent&nbsp;of the person concerned.</li><li>In the absence of a legal basis, this processing is therefore illegal, putting Amazon in violation of the GDPR, in particular its article 6.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>3-&nbsp;<strong>Requests</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>66. La Quadrature du Net, on behalf of the people it represents, calls for the following measures to be pronounced against Amazon:<br>• the prohibition of the behavioural analysis and advertising targeting treatments described above, in application of article 58, §2, f, of the GDPR;<br>• an administrative fine which, due to the massive, lasting and obviously deliberate nature of the violation found, be as high as possible, in application of article 83, §§2 and 5, of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":31} -->\n<p class=\"has-text-align-center\" style=\"font-size:31px\"><strong>NOTES :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Les statuts de La Quadrature du Net sont joints en Annexe I ainsi qu’accessibles sur&nbsp;<a href=\"https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf\">https://www.laquadrature.net/files/nouveauxstatuts-vf-pourAG03042017.pdf</a></li><li><em>G29 guidelines WP259 is available at: http://ec.europa.eu/newsroom/article29/document. cfm? action = display &amp; doc_id = 51030</em></li><li><em>p.&nbsp;16, free translation of “the GDPR does not allow controllers to offer pre-ticked boxes or opt-out constructions that require an intervention from the data subject to prevent agreement”.</em></li><li><em>p.&nbsp;17, free translation of “merely continuing the ordinary use of a website is not conduct from which one can infer an indication of wishes by the data subject to signify his or her agreement to a proposed processing operation”</em></li><li><em>p.5, free translation of” the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid ”.&nbsp;</em></li><li><em>p.&nbsp;11, free translation of “the performance of the service being downgraded to the detriment of the user”&nbsp;</em></li><li><em>p.&nbsp;8, free translation of “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract”.&nbsp;</em></li><li><em>Decision n ° MED-2017- 075 of 27 November 2017 giving notice to the company WHATSAPP&nbsp;.</em></li><li><em>Free translation of “if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.&nbsp;Sending out the message that data will be processed on the basis of consent, while actually some other lawful basis is relied on, would be fundamentally unfair to individuals. In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent ».</em></li><li><em>&nbsp;L’avis 06/2014 du G29 est accessible sur : http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp224_en.pdf</em></li><li><em>&nbsp;</em><em>p.&nbsp;16, free translation of “the provision must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”</em></li><li><em>p.&nbsp;17, free translation of “also the fact that some data processing is covered by a contract does not automatically mean that the processing is necessary for its performance. For example, Article 7(b) is not a suitable legal ground for building a profile of the user’s tastes and lifestyle choices based on his click-stream on a website and the items purchased. This is because the data controller has not been contracted to carry out profiling, but rather to deliver particular goods and services, for example. Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract»</em>.&nbsp;</li><li>p.&nbsp;8, free translation of “<em>According to Opinion 06/2014 of WP29, the term “necessary for the performance of a contract ” needs to be interpreted strictly.&nbsp;The processing must be necessary to fulfil the contract with each individual data subject. (…) There needs to be a direct and objective link between the processing of the data and the purpose of the execution of the contract&nbsp;</em>”.</li><li>Deliberation of the restricted formation SAN-2017-006 of April 27, 2017 pronouncing<br>a financial penalty against the companies FACEBOOK INC.&nbsp;and FACEBOOK IRELAND very specific that commercial prospecting has received in European law during the various technological developments.&nbsp;The G29</li><li>Opinion 06/2014 of the G29&nbsp;<a href=\"http://%20/ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp217_en.pdf%2011/19\" target=\"_blank\" rel=\"noreferrer noopener\">is accessible here</a></li><li>L’avis 03/2013 du G29 est accessible sur : accessible&nbsp;<a href=\"http://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf\">here</a></li><li>p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;p.&nbsp;28, free translation of “‘<em>measures or decisions’ do not only cover formal decisions and measures in a formal procedure.&nbsp;In other words: any relevant impact on particular individuals – either negative or positive – should be avoided</em>&nbsp;»</li><li>&nbsp;p.&nbsp;45, free translation of “<em>personalised discounts, special offers and targeted advertisements based on the customer’s profile</em>”&nbsp;</li><li>&nbsp;p.&nbsp;46, translation given in G29 opinion 06/2014, p.&nbsp;52</li><li>&nbsp;The leaflet “Protecting your personal information ”from Amazon is published&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909010\" target=\"_blank\" rel=\"noreferrer noopener\">here</a><br>as well as attached in Appendix III to this<br>complaint, where it is described as of May 28, 2018</li><li>&nbsp;The Amazon “<em>Ads based on your interests</em>” Notice is&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%25%202A%20=%201%20&amp;%25%202Aentries%20%25%202A%20=%200%20&amp;%20nodeId%20=%20201149360\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;as attached in Appendix IV of this complaint, where it is described on May 28, 2018</li><li>&nbsp;The Amazon Terms of Service are&nbsp;<a href=\"https://www.amazon.fr/gp/help/customer/display.html/ref=hp_left_v4_sib?%20ie%20=%20UTF8%20&amp;%20nodeId%20=%20201909000\" target=\"_blank\" rel=\"noreferrer noopener\">published here</a>&nbsp;, here described as of May 28, 2018.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph {\"align\":\"center\",\"customFontSize\":53} -->\n<p class=\"has-text-align-center\" style=\"font-size:53px\"><strong>Annexes&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix I:&nbsp;</strong>Statutes of La Quadrature du Net&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Annex II:</strong>&nbsp;List of persons who mandated La Quadrature du Net to bring this claim against Amazon&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix III:</strong>&nbsp;The Notice “Protecting Your Personal Information” from Amazon published on https://www.amazon.fr/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&amp;nodeId=201909010, copy as of May 28, 2018&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Appendix IV:</strong>&nbsp;Notice “Interest-Based Ads” amazon published on https://www.amazon.fr/gp/help/customer/display.html?ie=UTF8&amp;%2AVersion%2A=1&amp;%2Aentries%2A=0&amp;nodeId=201149360 , copy dated May 28, 201</p>\n<!-- /wp:paragraph -->','Luxembourg Slaps Record €746 Million Fine on Amazon','Following a complaint by the French  not for profit Association La Quadrature du Net, The Lead Supervisory Authority of Luxembourg Luxembourg Slaps Record €750 Million Fine on Amazon','inherit','closed','closed','','2145-revision-v1','','','2021-08-04 22:24:26','2021-08-04 22:24:26','',2145,'https://www.datarainbow.eu/?p=2241',0,'revision','',0),(2261,1,'2021-09-16 10:20:23','2021-09-16 10:20:23','<!-- wp:heading -->\n<h2><a href=\"https://www.pearltrees.com/t/non-material-damage/id43827224\" target=\"_blank\" rel=\"noreferrer noopener\">Non-Material Damage Compensation</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a> has created a right for compensation and edict the liability <span style=\"font-size: revert; color: initial; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Roboto, Oxygen-Sans, Ubuntu, Cantarell, &quot;Helvetica Neue&quot;, sans-serif;\">as a result of an infringement of this Regulation</span>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Any person who has <strong>suffered material or non-material damage as a result of an infringement of this Regulation</strong> shall have the right to receive <strong>compensation</strong> from the controller or processor for the damage suffered.</em></p><p><em>Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only <strong>where it has not complied with obligations of this Regulation</strong> specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.</em></p><p><em>A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.</em></p><p><em>Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.</em></p><p><em>Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.</em></p><p><em>Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in <a href=\"https://gdpr-info.eu/art-79-gdpr/\">Article 79</a>(2).</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://ukgdpr.fieldfisher.com/recitals/\" target=\"_blank\" rel=\"noreferrer noopener\">Recital 146</a> add :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The controller or processor should <strong>compensate any damage which a person may suffer as a result of processing that infringes this Regulation</strong>. The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. The concept of damage should be <strong>broadly interpreted</strong> in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation. This is without prejudice to any claims for damage deriving from the violation of other rules in Union or Member State law. Processing that infringes this Regulation also includes processing that infringes delegated and implementing acts adopted in accordance with this Regulation and Member State law specifying rules of this Regulation. Data subjects should receive full and effective compensation for the damage they have suffered. Where controllers or processors are involved in the same processing, each controller or processor should be held liable for the entire damage. However, where they are joined to the same judicial proceedings, in accordance with Member State law, compensation may be apportioned according to the responsibility of each controller or processor for the damage caused by the processing, provided that full and effective compensation of the data subject who suffered the damage is ensured. Any controller or processor which has paid full compensation may subsequently institute recourse proceedings against other controllers or processors involved in the same processing.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several national jurisdictions have added specific criminal liabilities into their legislation. In France for instance, <a href=\"https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000037825509/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 226-16</a> and following has created a criminal offense for unauthorised processing of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A data controller that process personal data directly or trough a data processor, should do so lawfully and in accordance with the six principles of data protection. If a damage is caused to data subjects in due course, the controller should be held liable for compensation. This goes in pair with the obligation of security stated in <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\">article 32 GDPR</a>. Processing data :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate</em>\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Pseudonymisation and encryption</strong> of personal data come in first on the list of appropriate measures to consider. In this Specific context of the pandemic, working from home and sharp rise of cyberattacks and ransomware, it\'s an important duty for professionals, especially when bound by <strong>confidentiality,</strong> to use all existing measures to keep data secure during storage and transfers. Encryption is still missed by many legal professionals exchanging large amount of personal data. Access to data should be limited to the strict minium. Using external data processors require privacy audit and DPIA. How can legals use free accounts for large file transfers without DPIA or clarifying the access to these files is a mystery. The rising number of law firms or other legal professionals cyberattack and ransomware is highly concerning due to the large amount of sensitive data they hold. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When data breach occurs, the damage is not immediate and measurable. A cyber attack can take possession and data that goes trough a cycle of data monetisation before ending as it has happened in various cases, dumped in the dark net. It can take a while before a data subject victim could realise how the data has been misused and measure the magnitude of the damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The obligation of keeping data secure demonstrated by a privacy impact assessment plays a key role in determining liabilities. If a professional has been negligent, its liability should be engaged. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I should be discussing the subject of GDPR compliance, data protection and data security in law firms on<strong> <a href=\"https://infogovworldexpo.sched.com/event/mutZ/an-ig-discussion-data-protection-privacy-security-in-law-firms\" target=\"_blank\" rel=\"noreferrer noopener\">Friday 17th September at InfoGovWorld EXPO 2021</a></strong><a href=\"https://infogovworldexpo.sched.com/event/mutZ/an-ig-discussion-data-protection-privacy-security-in-law-firms\" target=\"_blank\" rel=\"noreferrer noopener\"> </a>with the security expert <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/\" target=\"_blank\">Alexandre Blanc</a> and French IT lawyer <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/marc-antoine-ledieu-a040917/\" target=\"_blank\">Marc-Antoine Ledieu.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So far, national courts have been rather reluctant or inconsistant at allowing compensation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One case of referral to the ECJ concerns a non encrypted email sent to a lawyer in Germany. The Court affirmed that the sending of an unencrypted e-mail might infringe <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\">Article 32 GDPR</a>. The view that the sending of an unencrypted e-mail might violate <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\">Article 32 GDPR</a> is also the opinion of the Data Protection Authority of North Rhine-Westphalia (DPA NRW), which says the following on its website:<strong>\"<em>The communication by e-mail requires at least the transport encryption, as it is offered by the considerable European providers by default. ... It must be taken into account that in the case of transport encryption the e-mails are available on the e-mail servers in plain text and can basically be viewed. In the case of particularly sensitive data (e.g. account transaction data, financing data, health status data, client data from lawyers and tax consultants, employee data), transport encryption alone may not be sufficient\"</em>.</strong> (DPA NRW, Technical Requirements for Technical and Organisational Measures for E-Mail Sending, <a rel=\"noreferrer noopener\" href=\"https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand.html\" target=\"_blank\">available here</a> in German)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>14 January 2021, the German Federal Constitutional Court considering that the <strong>materiality threshold has neither been subject to an interpretation by the CJEU (acte éclairé) nor was the application of EU law so obvious to leave no room for reasonable doubt (acte clair)</strong> and the GDPR does not clarify the extent of compensation for immaterial damage following data privacy violations. The Federal Constitutional Court held German authors had not yet adopted a uniform approach on the scope of GDPR damage claims. For these reasons, the Federal Constitutional Court determined the concrete scope of <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 of the GDPR</a> remains unclear. Therefore referred to the EUROPEAN Court of Justice.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The Austrian Supreme Court referred the following three questions to the CJEU this August 2021:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><br><em>1- Is it necessary that the plaintiff has suffered damages or is the breach of provisions of the GDPR itself sufficient to award damages under Art. 82 GDPR?</em></p><p><em>2- Are there any other requirements for the assessment of damages in addition to the principles of effectiveness and equivalence under European law?</em></p><p><em>3- Does an award of immaterial damage require that the infringement has consequences of at least some weight which goes beyond the distress caused by the infringement? Interestingly, in the reasoning for initiating the preliminary reference procedure the Supreme Court refers to the judgment of the German Constitutional Court (1 BvR 2853/19). In this case, the Constitutional Court decided that the right to a fair trial (Art. 6 ECHR) was infringed because the lower Court of Goslar did not refer the question regarding the interpretation of Art 82 GDPR for a preliminary ruling to the CJEU, even though the interpretation was not clear enough. The Austrian Supreme Court stated that it does not share this point of view, but for the sake of a more coherent interpretation of European law it nevertheless refers the above-mentioned questions to the CJEU.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Case C-340/21: Request for a preliminary ruling from the Varhoven administrativen sad (Bulgaria) lodged on 2 June 2021 — VB v Natsionalna agentsia za prihodite</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The Consiglio di Stato (Italy) lodged a request for a preliminary ruling on 31 May 2021</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Questions referred: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>1. Are Articles 24 and 32 of GDPR to be interpreted as meaning that unauthorised disclosure of, or access to, personal data within the meaning of point 12 of Article 4 of GDPR by persons who are not employees of the controller’s administration and are not subject to its control is sufficient for the presumption that the technical and organisational measures implemented are not appropriate?</em></p><p><em>2. If the first question is answered in the negative, what should be the subject matter and scope of the judicial review of legality in the examination as to whether the technical and organizational measures implemented by the controller are appropriate pursuant to Article 32 of GDPR?</em></p><p><em>3. If the first question is answered in the negative, is the principle of accountability under Article 5(2) and Article 24 of Regulation (EU) 2016/679, read in conjunction with recital 74 thereof, to be interpreted as meaning that, in legal proceedings under Article 82(1) of Regulation (EU) 2016/679, the controller bears the burden of proving that the technical and organizational measures implemented are appropriate pursuant to Article 32 of that regulation? Can the obtaining of an expert’s report be regarded as a necessary and sufficient means of proof to establish whether the technical and organisational measures implemented by the controller were appropriate in a case such as the present one, where the unauthorised access to, and disclosure of, personal data are the result of a ‘hacking attack’?</em></p><p><em>4. Is Article 82(3) of Regulation (EU) 2016/679 to be interpreted as meaning that unauthorised disclosure of, or access to, personal data within the meaning of point 12 of Article 4 of Regulation (EU) 2016/679 by means of, as in the present case, a ‘hacking attack’ by persons who are not employees of the controller’s administration and are not subject to its control constitutes an event for which the controller is not in any way responsible and which entitles it to exemption from liability? 5. Is Article 82(1) and (2) of Regulation (EU) 2016/679, read in conjunction with recitals 85 and 146 thereof, to be interpreted as meaning that, in a case such as the present one, involving a personal data breach consisting in unauthorized access to, and dissemination of, personal data by means of a ‘hacking attack’, the worries, fears and anxieties suffered by the data subject with regard to a possible misuse of personal data in the future fall per se within the concept of non-material damage, which is to be interpreted broadly, and entitle him or her to compensation for damage where such misuse has not been established and/or the data subject has not suffered any further harm?</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The Regional Court of <strong>Feldkirch</strong> had held that it was sufficient for the purposes of <a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 82 GDPR</a> that there was an unlawful processing of the plaintiff’s party preferences by the <strong>Austrian Postal Service</strong>, but the Higher Regional Court of Innsbruck reversed, holding that the plaintiff must actually feel impaired or distressed in order to be able to claim compensation for non-material damages: “<em>A data protection violation must in any case intervene in the emotional sphere of the victim, … a minimum level of personal impairment will have to be required for the existence of non-material damage</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The aim of the <a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 GDPR</a> should be to compensation this non-material damage - or in some translation moral damage - that is not tangible. Otherwise the non-material liability provision of the article 82 would render inefficient. Germany, Austria and Italian courts have each submitted a preliminary question to the European Court of Justice to clarify the conditions of this liability. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":2256,\"href\":\"https://www.datarainbow.eu/wp-content/uploads/2021/09/GDPR_NonMaterialDamage.pdf\",\"displayPreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/GDPR_NonMaterialDamage.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"Embed of GDPR_NonMaterialDamage.\"></object><a href=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/GDPR_NonMaterialDamage.pdf\">GDPR_NonMaterialDamage</a><a href=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/GDPR_NonMaterialDamage.pdf\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p>My all time advice : consider data minimisation as your best friend. <a href=\"https://www.linkedin.com/pulse/consider-personal-data-hot-potato-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Handle personal data like a hot potato</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Thanks for the beautiful GDPR text created by <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/wkhon/\" target=\"_blank\">Dr W Kuan Hon</a> from Fieldfisher.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also thanks to <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/dr-carlo-piltz-631571b/\" target=\"_blank\">Dr Carlo Piltz</a>, German Lawyer, Partner at Piltz Legal, for his summary and translations of German cases.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further read : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/law-firm-internet-security-and-data-protection-2/\" target=\"_blank\" rel=\"noreferrer noopener\">Law Firm Internet Security and Data Protection</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/les-professionnels-du-droit-lere-numerique-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\">Les Professionnels du Droit à l\'Ère du Numérique</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/post/edit/6779781384849375232/\" target=\"_blank\" rel=\"noreferrer noopener\">Lawyer Cloud Act : quel cloud pour les cabinets d\'avocats ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/zoom-videoconferencing-privacy-and-liability/\" target=\"_blank\" rel=\"noreferrer noopener\">ZOOM VIDEOCONFERENCING PRIVACY AND LIABILITY</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/601-2/\" target=\"_blank\" rel=\"noreferrer noopener\">Zoom Visio-conférence Pour Les Juristes</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\" target=\"_blank\" rel=\"noreferrer noopener\">Websites surreptitiously tracking and reporting on visitors</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a <a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','GDPR Individuals Right to Redress','','inherit','closed','closed','','2255-revision-v1','','','2021-09-16 10:20:23','2021-09-16 10:20:23','',2255,'https://www.datarainbow.eu/?p=2261',0,'revision','',0),(2268,1,'2021-09-17 12:07:39','2021-09-17 12:07:39','','InfoGovWorld2021_datainLawFirms','','inherit','open','closed','','infogovworld2021_datainlawfirms','','','2021-09-17 12:07:39','2021-09-17 12:07:39','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/InfoGovWorld2021_datainLawFirms.pptx',0,'attachment','application/vnd.openxmlformats-officedocument.presentationml.presentation',0),(2269,1,'2021-09-17 12:10:30','2021-09-17 12:10:30','','InfoGovWorld2021_datainLawFirms-1','','inherit','open','closed','','infogovworld2021_datainlawfirms-1','','','2021-09-17 12:10:30','2021-09-17 12:10:30','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/InfoGovWorld2021_datainLawFirms-1.pptx',0,'attachment','application/vnd.openxmlformats-officedocument.presentationml.presentation',0),(2270,1,'2021-09-17 12:15:40','2021-09-17 12:15:40','','InfoGovWorld2021_datainLawFirms-2','','inherit','open','closed','','infogovworld2021_datainlawfirms-2','','','2021-09-17 12:15:40','2021-09-17 12:15:40','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/InfoGovWorld2021_datainLawFirms-2.pptx',0,'attachment','application/vnd.openxmlformats-officedocument.presentationml.presentation',0),(2273,1,'2021-09-17 12:31:08','2021-09-17 12:31:08','','Screenshot-2021-09-17-at-13.29.47','','inherit','open','closed','','screenshot-2021-09-17-at-13-29-47','','','2021-09-17 12:31:08','2021-09-17 12:31:08','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.29.47.png',0,'attachment','image/png',0),(2274,1,'2021-09-17 12:31:13','2021-09-17 12:31:13','','Screenshot-2021-09-17-at-13.29.10','','inherit','open','closed','','screenshot-2021-09-17-at-13-29-10','','','2021-09-17 12:31:13','2021-09-17 12:31:13','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.29.10.png',0,'attachment','image/png',0),(2275,1,'2021-09-17 12:31:21','2021-09-17 12:31:21','','Screenshot-2021-09-17-at-13.29.00','','inherit','open','closed','','screenshot-2021-09-17-at-13-29-00','','','2021-09-17 12:31:21','2021-09-17 12:31:21','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.29.00.png',0,'attachment','image/png',0),(2276,1,'2021-09-17 12:31:26','2021-09-17 12:31:26','','Screenshot-2021-09-17-at-13.28.51','','inherit','open','closed','','screenshot-2021-09-17-at-13-28-51','','','2021-09-17 12:31:26','2021-09-17 12:31:26','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.28.51.png',0,'attachment','image/png',0),(2277,1,'2021-09-17 12:31:32','2021-09-17 12:31:32','','Screenshot-2021-09-17-at-13.28.41','','inherit','open','closed','','screenshot-2021-09-17-at-13-28-41','','','2021-09-17 12:31:32','2021-09-17 12:31:32','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.28.41.png',0,'attachment','image/png',0),(2278,1,'2021-09-17 12:31:36','2021-09-17 12:31:36','','Screenshot-2021-09-17-at-13.27.14','','inherit','open','closed','','screenshot-2021-09-17-at-13-27-14','','','2021-09-17 12:31:36','2021-09-17 12:31:36','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.27.14.png',0,'attachment','image/png',0),(2279,1,'2021-09-17 12:31:40','2021-09-17 12:31:40','','Screenshot-2021-09-17-at-13.27.06','','inherit','open','closed','','screenshot-2021-09-17-at-13-27-06','','','2021-09-17 12:31:40','2021-09-17 12:31:40','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.27.06.png',0,'attachment','image/png',0),(2280,1,'2021-09-17 12:31:43','2021-09-17 12:31:43','','Screenshot-2021-09-17-at-13.26.58','','inherit','open','closed','','screenshot-2021-09-17-at-13-26-58','','','2021-09-17 12:31:43','2021-09-17 12:31:43','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.58.png',0,'attachment','image/png',0),(2281,1,'2021-09-17 12:31:48','2021-09-17 12:31:48','','Screenshot-2021-09-17-at-13.26.51','','inherit','open','closed','','screenshot-2021-09-17-at-13-26-51','','','2021-09-17 12:31:48','2021-09-17 12:31:48','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.51.png',0,'attachment','image/png',0),(2315,1,'2022-01-03 20:54:01','2022-01-03 20:54:01','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay initiated a security research using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\" rel=\"noreferrer noopener\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\" rel=\"noreferrer noopener\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-03 20:54:01','2022-01-03 20:54:01','',2311,'https://www.datarainbow.eu/?p=2315',0,'revision','',0),(2282,1,'2021-09-17 12:31:54','2021-09-17 12:31:54','','Screenshot-2021-09-17-at-13.26.44','','inherit','open','closed','','screenshot-2021-09-17-at-13-26-44','','','2021-09-17 12:31:54','2021-09-17 12:31:54','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.44.png',0,'attachment','image/png',0),(2283,1,'2021-09-17 12:31:58','2021-09-17 12:31:58','','Screenshot-2021-09-17-at-13.26.37','','inherit','open','closed','','screenshot-2021-09-17-at-13-26-37','','','2021-09-17 12:31:58','2021-09-17 12:31:58','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.37.png',0,'attachment','image/png',0),(2284,1,'2021-09-17 12:32:04','2021-09-17 12:32:04','','Screenshot-2021-09-17-at-13.26.30','','inherit','open','closed','','screenshot-2021-09-17-at-13-26-30','','','2021-09-17 12:32:04','2021-09-17 12:32:04','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.30.png',0,'attachment','image/png',0),(2285,1,'2021-09-17 12:32:11','2021-09-17 12:32:11','','Screenshot-2021-09-17-at-13.26.22','','inherit','open','closed','','screenshot-2021-09-17-at-13-26-22','','','2021-09-17 12:32:11','2021-09-17 12:32:11','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.22.png',0,'attachment','image/png',0),(2286,1,'2021-09-17 12:32:17','2021-09-17 12:32:17','','Screenshot-2021-09-17-at-13.26.16','','inherit','open','closed','','screenshot-2021-09-17-at-13-26-16','','','2021-09-17 12:32:17','2021-09-17 12:32:17','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.16.png',0,'attachment','image/png',0),(2287,1,'2021-09-17 12:32:24','2021-09-17 12:32:24','','Screenshot-2021-09-17-at-13.26.08','','inherit','open','closed','','screenshot-2021-09-17-at-13-26-08','','','2021-09-17 12:32:24','2021-09-17 12:32:24','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.08.png',0,'attachment','image/png',0),(2288,1,'2021-09-17 12:32:28','2021-09-17 12:32:28','','Screenshot-2021-09-17-at-13.26.00','','inherit','open','closed','','screenshot-2021-09-17-at-13-26-00','','','2021-09-17 12:32:28','2021-09-17 12:32:28','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.00.png',0,'attachment','image/png',0),(2289,1,'2021-09-17 12:32:32','2021-09-17 12:32:32','','Screenshot-2021-09-17-at-13.25.53','','inherit','open','closed','','screenshot-2021-09-17-at-13-25-53','','','2021-09-17 12:32:32','2021-09-17 12:32:32','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.53.png',0,'attachment','image/png',0),(2290,1,'2021-09-17 12:32:48','2021-09-17 12:32:48','','Screenshot-2021-09-17-at-13.25.44','','inherit','open','closed','','screenshot-2021-09-17-at-13-25-44','','','2021-09-17 12:32:48','2021-09-17 12:32:48','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.44.png',0,'attachment','image/png',0),(2291,1,'2021-09-17 12:33:10','2021-09-17 12:33:10','','Screenshot-2021-09-17-at-13.25.37','','inherit','open','closed','','screenshot-2021-09-17-at-13-25-37','','','2021-09-17 12:33:10','2021-09-17 12:33:10','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.37.png',0,'attachment','image/png',0),(2292,1,'2021-09-17 12:33:16','2021-09-17 12:33:16','','Screenshot-2021-09-17-at-13.25.30','','inherit','open','closed','','screenshot-2021-09-17-at-13-25-30','','','2021-09-17 12:33:16','2021-09-17 12:33:16','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.30.png',0,'attachment','image/png',0),(2293,1,'2021-09-17 12:33:26','2021-09-17 12:33:26','','Screenshot-2021-09-17-at-13.25.20','','inherit','open','closed','','screenshot-2021-09-17-at-13-25-20','','','2021-09-17 12:33:26','2021-09-17 12:33:26','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.20.png',0,'attachment','image/png',0),(2294,1,'2021-09-17 12:33:53','2021-09-17 12:33:53','','Screenshot-2021-09-17-at-13.25.12','','inherit','open','closed','','screenshot-2021-09-17-at-13-25-12','','','2021-09-17 12:33:53','2021-09-17 12:33:53','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.12.png',0,'attachment','image/png',0),(2295,1,'2021-09-17 12:34:15','2021-09-17 12:34:15','','Screenshot-2021-09-17-at-13.25.03','','inherit','open','closed','','screenshot-2021-09-17-at-13-25-03','','','2021-09-17 12:34:15','2021-09-17 12:34:15','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.03.png',0,'attachment','image/png',0),(2296,1,'2021-09-17 12:34:22','2021-09-17 12:34:22','','Screenshot-2021-09-17-at-13.24.31','','inherit','open','closed','','screenshot-2021-09-17-at-13-24-31','','','2021-09-17 12:34:22','2021-09-17 12:34:22','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.31.png',0,'attachment','image/png',0),(2297,1,'2021-09-17 12:34:35','2021-09-17 12:34:35','','Screenshot-2021-09-17-at-13.24.39','','inherit','open','closed','','screenshot-2021-09-17-at-13-24-39','','','2021-09-17 12:34:35','2021-09-17 12:34:35','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.39.png',0,'attachment','image/png',0),(2266,1,'2021-09-17 12:05:40','2021-09-17 12:05:40','<!-- wp:heading -->\n<h2><a href=\"https://www.pearltrees.com/t/non-material-damage/id43827224\" target=\"_blank\" rel=\"noreferrer noopener\">Non-Material Damage Compensation</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a> has created a right for compensation and edict the liability <span style=\"font-size: revert; color: initial; font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Roboto, Oxygen-Sans, Ubuntu, Cantarell, &quot;Helvetica Neue&quot;, sans-serif;\">as a result of an infringement of this Regulation</span>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Any person who has <strong>suffered material or non-material damage as a result of an infringement of this Regulation</strong> shall have the right to receive <strong>compensation</strong> from the controller or processor for the damage suffered.</em></p><p><em>Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation.&nbsp;A processor shall be liable for the damage caused by processing only <strong>where it has not complied with obligations of this Regulation</strong> specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.</em></p><p><em>A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.</em></p><p><em>Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.</em></p><p><em>Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.</em></p><p><em>Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in&nbsp;<a href=\"https://gdpr-info.eu/art-79-gdpr/\">Article 79</a>(2).</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://ukgdpr.fieldfisher.com/recitals/\" target=\"_blank\" rel=\"noreferrer noopener\">Recital 146</a> add :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The controller or processor should <strong>compensate any damage which a person may suffer as a result of processing that infringes this Regulation</strong>.&nbsp;The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage.&nbsp;The concept of damage should be <strong>broadly interpreted</strong> in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation.&nbsp;This is without prejudice to any claims for damage deriving from the violation of other rules in Union or Member State law.&nbsp;Processing that infringes this Regulation also includes processing that infringes delegated and implementing acts adopted in accordance with this Regulation and Member State law specifying rules of this Regulation.&nbsp;Data subjects should receive full and effective compensation for the damage they have suffered.&nbsp;Where controllers or processors are involved in the same processing, each controller or processor should be held liable for the entire damage.&nbsp;However, where they are joined to the same judicial proceedings, in accordance with Member State law, compensation may be apportioned according to the responsibility of each controller or processor for the damage caused by the processing, provided that full and effective compensation of the data subject who suffered the damage is ensured.&nbsp;Any controller or processor which has paid full compensation may subsequently institute recourse proceedings against other controllers or processors involved in the same processing.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several national jurisdictions have added specific criminal liabilities into their legislation. In France for instance, <a href=\"https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000037825509/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 226-16</a> and following has created a criminal offense for unauthorised processing of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A data controller that process personal data directly or trough a data processor, should do so lawfully and in accordance with the six principles of data protection. If a damage is caused to data subjects in due course, the controller should be held liable for compensation. This goes in pair with the obligation of security stated in <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\">article 32 GDPR</a>. Processing data :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate</em>\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Pseudonymisation and encryption</strong> of personal data come in first on the list of appropriate measures to consider. In this Specific context of the pandemic, working from home and sharp rise of cyberattacks and ransomware, it\'s an important duty for professionals, especially when bound by <strong>confidentiality,</strong> to use all existing measures to keep data secure during storage and transfers. Encryption is still missed by many legal professionals exchanging large amount of personal data. Access to data should be limited to the strict minium. Using external data processors require privacy audit and DPIA. How can legals use free accounts for large file transfers without DPIA or clarifying the access to these files is a mystery. The rising number of law firms or other legal professionals cyberattack and ransomware is highly concerning due to the large amount of sensitive data they hold. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When data breach occurs, the damage is not immediate and measurable. A cyber attack can take possession and data that goes trough a cycle of data monetisation before ending as it has happened in various cases, dumped in the dark net. It can take a while before a data subject victim could realise how the data has been misused and measure the magnitude of the damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The obligation of keeping data secure demonstrated by a privacy impact assessment plays a key role in determining liabilities. If a professional has been negligent, its liability should be engaged. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I should be discussing the subject of GDPR compliance, data protection and data security in law firms on<strong> <a href=\"https://infogovworldexpo.sched.com/event/mutZ/an-ig-discussion-data-protection-privacy-security-in-law-firms\" target=\"_blank\" rel=\"noreferrer noopener\">Friday 17th September at InfoGovWorld EXPO 2021</a></strong><a href=\"https://infogovworldexpo.sched.com/event/mutZ/an-ig-discussion-data-protection-privacy-security-in-law-firms\" target=\"_blank\" rel=\"noreferrer noopener\"> </a>with the security expert <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/\" target=\"_blank\">Alexandre Blanc</a> and French IT lawyer <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/marc-antoine-ledieu-a040917/\" target=\"_blank\">Marc-Antoine Ledieu.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So far, national courts have been rather reluctant or inconsistant at allowing compensation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One case of referral to the ECJ concerns a non encrypted email sent to a lawyer in Germany. The Court affirmed that the sending of an unencrypted e-mail&nbsp;might&nbsp;infringe <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\">Article 32 GDPR</a>. The view that the sending of an unencrypted e-mail might violate <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\">Article 32 GDPR</a> is also the opinion of the Data Protection Authority of North Rhine-Westphalia (DPA NRW), which says the following on its website:<strong>\"<em>The communication by e-mail requires at least the transport encryption, as it is offered by the considerable European providers by default. ... It must be taken into account that in the case of transport encryption the e-mails are available on the e-mail servers in plain text and can basically be viewed. In the case of particularly sensitive data (e.g. account transaction data, financing data, health status data, client data from lawyers and tax consultants, employee data), transport encryption alone may not be sufficient\"</em>.</strong> (DPA NRW, Technical Requirements for Technical and Organisational Measures for E-Mail Sending,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand.html\" target=\"_blank\">available here</a>&nbsp;in German)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>14 January 2021, the German Federal Constitutional Court considering that the <strong>materiality threshold has neither been subject to an interpretation by the CJEU (acte éclairé) nor was the application of EU law so obvious to leave no room for reasonable doubt (acte clair)</strong> and the GDPR does not clarify the extent of compensation for immaterial damage following data privacy violations. The Federal Constitutional Court held German authors had not yet adopted a uniform approach on the scope of GDPR damage claims. For these reasons, the Federal Constitutional Court determined the concrete scope of <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 of the GDPR</a> remains unclear. Therefore referred to the EUROPEAN Court of Justice.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The Austrian Supreme Court referred the following three questions to the CJEU this August 2021:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><br><em>1- Is it necessary that the plaintiff has suffered damages or is the breach of provisions of the GDPR itself sufficient to award damages under Art. 82 GDPR?</em></p><p><em>2- Are there any other requirements for the assessment of damages in addition to the principles of effectiveness and equivalence under European law?</em></p><p><em>3- Does an award of immaterial damage require that the infringement has consequences of at least some weight which goes beyond the distress caused by the infringement? Interestingly, in the reasoning for initiating the preliminary reference procedure the Supreme Court refers to the judgment of the German Constitutional Court (1 BvR 2853/19). In this case, the Constitutional Court decided that the right to a fair trial (Art. 6 ECHR) was infringed because the lower Court of Goslar did not refer the question regarding the interpretation of Art 82 GDPR for a preliminary ruling to the CJEU, even though the interpretation was not clear enough. The Austrian Supreme Court stated that it does not share this point of view, but for the sake of a more coherent interpretation of European law it nevertheless refers the above-mentioned questions to the CJEU.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Case C-340/21: Request for a preliminary ruling from the Varhoven administrativen sad (Bulgaria) lodged on 2 June 2021 — VB v Natsionalna agentsia za prihodite</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The Consiglio di Stato (Italy) lodged a request for a preliminary ruling on 31 May 2021</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Questions referred:&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>1. Are Articles 24 and 32 of GDPR to be interpreted as meaning that unauthorised disclosure of, or access to, personal data within the meaning of point 12 of Article 4 of GDPR by persons who are not employees of the controller’s administration and are not subject to its control is sufficient for the presumption that the technical and organisational measures implemented are not appropriate?</em></p><p><em>2. If the first question is answered in the negative, what should be the subject matter and scope of the judicial review of legality in the examination as to whether the technical and organizational measures implemented by the controller are appropriate pursuant to Article 32 of GDPR?</em></p><p><em>3. If the first question is answered in the negative, is the principle of accountability under Article 5(2) and Article 24 of Regulation (EU) 2016/679, read in conjunction with recital 74 thereof, to be interpreted as meaning that, in legal proceedings under Article 82(1) of Regulation (EU) 2016/679, the controller bears the burden of proving that the technical and organizational measures implemented are appropriate pursuant to Article 32 of that regulation? Can the obtaining of an expert’s report be regarded as a necessary and sufficient means of proof to establish whether the technical and organisational measures implemented by the controller were appropriate in a case such as the present one, where the unauthorised access to, and disclosure of, personal data are the result of a ‘hacking attack’?</em></p><p><em>4. Is Article 82(3) of Regulation (EU) 2016/679 to be interpreted as meaning that unauthorised disclosure of, or access to, personal data within the meaning of point 12 of Article 4 of Regulation (EU) 2016/679 by means of, as in the present case, a ‘hacking attack’ by persons who are not employees of the controller’s administration and are not subject to its control constitutes an event for which the controller is not in any way responsible and which entitles it to exemption from liability? 5. Is Article 82(1) and (2) of Regulation (EU) 2016/679, read in conjunction with recitals 85 and 146 thereof, to be interpreted as meaning that, in a case such as the present one, involving a personal data breach consisting in unauthorized access to, and dissemination of, personal data by means of a ‘hacking attack’, the worries, fears and anxieties suffered by the data subject with regard to a possible misuse of personal data in the future fall per se within the concept of non-material damage, which is to be interpreted broadly, and entitle him or her to compensation for damage where such misuse has not been established and/or the data subject has not suffered any further harm?</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The Regional Court of <strong>Feldkirch</strong> had held that it was sufficient for the purposes of <a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 82 GDPR</a> that there was an unlawful processing of the plaintiff’s party preferences by the <strong>Austrian Postal Service</strong>, but the Higher Regional Court of Innsbruck reversed, holding that the plaintiff must actually feel impaired or distressed in order to be able to claim compensation for non-material damages: “<em>A data protection violation must in any case intervene in the emotional sphere of the victim, … a minimum level of personal impairment will have to be required for the existence of non-material damage</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The aim of the <a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 GDPR</a> should be to compensation this non-material damage - or in some translation moral damage - that is not tangible. Otherwise the non-material liability provision of the article 82 would render inefficient. Germany, Austria and Italian courts have each submitted a preliminary question to the European Court of Justice to clarify the conditions of this liability. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:file {\"id\":2262,\"href\":\"https://www.datarainbow.eu/wp-content/uploads/2021/09/GDPR_NonMaterialDamage_V2.pdf\",\"displayPreview\":true} -->\n<div class=\"wp-block-file\"><object class=\"wp-block-file__embed\" data=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/GDPR_NonMaterialDamage_V2.pdf\" type=\"application/pdf\" style=\"width:100%;height:600px\" aria-label=\"Embed of GDPR_NonMaterialDamage_V2.\"></object><a href=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/GDPR_NonMaterialDamage_V2.pdf\">GDPR_NonMaterialDamage_V2</a><a href=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/GDPR_NonMaterialDamage_V2.pdf\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->\n\n<!-- wp:paragraph -->\n<p>My all time advice : consider data minimisation as your best friend. <a href=\"https://www.linkedin.com/pulse/consider-personal-data-hot-potato-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Handle personal data like a hot potato</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Thanks for the beautiful GDPR text created by <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/wkhon/\" target=\"_blank\">Dr W Kuan Hon</a> from Fieldfisher.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also thanks to <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/dr-carlo-piltz-631571b/\" target=\"_blank\">Dr Carlo Piltz</a>, German Lawyer, Partner at Piltz Legal, for his summary and translations of German cases.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further read : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/law-firm-internet-security-and-data-protection-2/\" target=\"_blank\" rel=\"noreferrer noopener\">Law Firm Internet Security and Data Protection</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/les-professionnels-du-droit-lere-numerique-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\">Les Professionnels du Droit à l\'Ère du Numérique</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/post/edit/6779781384849375232/\" target=\"_blank\" rel=\"noreferrer noopener\">Lawyer Cloud Act : quel cloud pour les cabinets d\'avocats ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/zoom-videoconferencing-privacy-and-liability/\" target=\"_blank\" rel=\"noreferrer noopener\">ZOOM VIDEOCONFERENCING PRIVACY AND LIABILITY</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/601-2/\" target=\"_blank\" rel=\"noreferrer noopener\">Zoom Visio-conférence Pour Les Juristes</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\" target=\"_blank\" rel=\"noreferrer noopener\">Websites surreptitiously tracking and reporting on visitors</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','GDPR Individuals Right to Redress','','inherit','closed','closed','','2255-revision-v1','','','2021-09-17 12:05:40','2021-09-17 12:05:40','',2255,'https://www.datarainbow.eu/?p=2266',0,'revision','',0),(2298,1,'2021-09-17 12:34:36','2021-09-17 12:34:36','','Screenshot-2021-09-17-at-13.24.55','','inherit','open','closed','','screenshot-2021-09-17-at-13-24-55','','','2021-09-17 12:34:36','2021-09-17 12:34:36','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.55.png',0,'attachment','image/png',0),(2299,1,'2021-09-17 12:34:51','2021-09-17 12:34:51','','Screenshot-2021-09-17-at-13.24.48','','inherit','open','closed','','screenshot-2021-09-17-at-13-24-48','','','2021-09-17 12:34:51','2021-09-17 12:34:51','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.48.png',0,'attachment','image/png',0),(2300,1,'2021-09-17 12:34:52','2021-09-17 12:34:52','','Screenshot-2021-09-17-at-13.24.48-1','','inherit','open','closed','','screenshot-2021-09-17-at-13-24-48-1','','','2021-09-17 12:34:52','2021-09-17 12:34:52','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.48-1.png',0,'attachment','image/png',0),(2301,1,'2021-09-17 12:35:23','2021-09-17 12:35:23','','Screenshot-2021-09-17-at-13.24.39-1','','inherit','open','closed','','screenshot-2021-09-17-at-13-24-39-1','','','2021-09-17 12:35:23','2021-09-17 12:35:23','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.39-1.png',0,'attachment','image/png',0),(2302,1,'2021-09-17 12:35:30','2021-09-17 12:35:30','','Screenshot-2021-09-17-at-13.24.31-1','','inherit','open','closed','','screenshot-2021-09-17-at-13-24-31-1','','','2021-09-17 12:35:30','2021-09-17 12:35:30','',0,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.31-1.png',0,'attachment','image/png',0),(2311,1,'2022-01-03 20:53:13','2022-01-03 20:53:13','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay launched a research program using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database. Data was left on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: <strong>data minimisation</strong> and <strong>storage limitation</strong>. Possibly <strong>data accuracy </strong>as part of the data stored would have become inaccurate after time. <strong>Purpose limitation </strong>could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2330,\"width\":449,\"height\":253,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Art5_Principles-1024x577.png\" alt=\"\" class=\"wp-image-2330\" width=\"449\" height=\"253\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients concerning the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s only on October the 21<sup>st</sup>, 8 months after the initial notification, that the CNIL enquired about their notifications to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021, the case was instructed by the ‘<em>commission restreinte</em>’ (restricted commission) for the <strong>infringement of articles <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">28-3 and 28-4</a>, <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">32</a> and <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-34-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">34 GDPR</a></strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was accepted that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the <strong>lack of compliant data processing agreements (<a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art 28-3 GDPR</a>)</strong>, the <strong>obligation of securing the data (<a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\">Art 32 GDPR</a>)</strong> and <strong>absence of data subject notification.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">28-3 GDPR</a></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be compliant with the requirements of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 28 GDPR</a> in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art 28-4</a> : <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does not comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">art 28 para 3 and 4</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL logically considered that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Something to remember whenever you use a third party to share personal data with, make sure you assess their GDPR compliance and put in place appropriate DPAs. This is a requirement for any processor such as an IT supplier or any kind of data processing tools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. <strong>On the obligation to ensure the security of the data</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on <strong><a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32 GDPR</a></strong>, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"type\":\"a\"} -->\n<ul type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted. Always check if you have correctly limited access to data to the strict minimum.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Vainly, Slimpay argued a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did considered irrelevant the fact that the data had been accessed or not, the only fact that the data was easily accessible to unauthorised readers was deemed sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued the security flaw was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Notwithstanding an actual damaged caused to data subjects, the lack of security is in itself a breach of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 32</a>. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as <a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 GDPR</a> allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be in itself a breach of data as rarely data subjects can prove immediate harm after data are compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing are real, including for an ID theft. (see below the ID and financial theft cited by the EDPB).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of a negligent employee was not retained as in any case it\'s the company\'s duty to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>--&gt; Last week, <a rel=\"noreferrer noopener\" href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>--&gt; Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accepted Slimpay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-34-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 34 GDPR</a></strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the <strong><a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-83-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 83 GDPR</a></strong>, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance for securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they had omitted the notifications <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-34-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 34</a> to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits in 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains <strong>Civil damages <a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 GDPR</a></strong> for data subjects whose data have been negligently handled. <strong><a rel=\"noreferrer noopener\" href=\"https://gdpr-info.eu/recitals/no-146/\" target=\"_blank\">Recital 146</a></strong> allows data subjects to sue the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Where controllers or processors are involved in the same processing, each controller or processor should be held liable for the entire damage.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Art 79 (1) of the GDPR&nbsp;provides:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the <strong>criminal offense </strong>of not complying with the obligations of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 32 GDPR</a>. See below the various laws applying in France</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2334,\"width\":386,\"height\":260,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-20-at-19.01.22-1024x689.png\" alt=\"\" class=\"wp-image-2334\" width=\"386\" height=\"260\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2313,\"width\":840,\"height\":878,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\" width=\"840\" height=\"878\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 28 </a>to his professional accounts, which lacks transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the<a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\"> invalidation of the Privacy Shield</a>. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the client\'s  warning about the particular sensitivity of the personal and financial data included in the documents. They had refused encryption despite all <a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\" target=\"_blank\">recommendations by the CNIL</a> and any IT security in breach of article 32 GDPR. They took a long time and several requests before they notify the breach to the CNIL, so far no notification to data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO had mentioned they use secured means of document exchange. The other law firm plays with Wetransfer links to escape the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To demonstrate how a data breach can cause harm, here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the&nbsp;<a href=\"https://www.linkedin.com/company/eu-edpb/\">European Data Protection Board</a>\'s Guidelines 01/2021 on Examples regarding Personal Data&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">Breach</a>&nbsp;Notification under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">GDPR</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2325,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png\" alt=\"\" class=\"wp-image-2325\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/law-firm-internet-security-and-data-protection-2/\" target=\"_blank\" rel=\"noreferrer noopener\">Lawyers or other legal professionals</a> bound by attorney client privilege or confidentiality should be more careful when handling documents containing personal or financial data. This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a> fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --> € 300\'000</em></p><p><em>The french <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a> authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a> and to object to receiving <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a> prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a> against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a> data (<a href=\"https://ukgdpr.fieldfisher.com/chapter-3/article-12/\" target=\"_blank\" rel=\"noreferrer noopener\">Art. 12 </a>and <a href=\"https://ukgdpr.fieldfisher.com/chapter-3/article-15-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">15</a> of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a> to respect the right to <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a> of the persons concerned (<a href=\"https://ukgdpr.fieldfisher.com/chapter-3/article-12/\" target=\"_blank\" rel=\"noreferrer noopener\">Art. 12 </a>and<a href=\"https://ukgdpr.fieldfisher.com/chapter-3/article-21-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\"> 21</a> of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a> (<a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-25-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art. 25 of the GDPR</a>), as the company continued to send invoices to complainants for telephone lines whose <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a> had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a> of personal data (<a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art. 32 of the GDPR</a>), since the company transmitted by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a> - in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a> situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Securing data is a duty. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of third party apps without assessment and a Data Protection Agreement <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 28 GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel.&nbsp;</em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr&nbsp;</strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit&nbsp;&nbsp;&nbsp; à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','publish','open','open','','cnil-fined-slimpay-for-lack-of-security','','\nhttps://www.datarainbow.eu/law-firm-internet-security-and-data-protection-2/','2022-01-27 14:47:29','2022-01-27 14:47:29','',0,'https://www.datarainbow.eu/?p=2311',0,'post','',0),(2312,1,'2022-01-03 20:38:56','2022-01-03 20:38:56','Lake District by Tara Taubman-Bassirian','Screenshot 2022-01-03 at 20.38.29','','inherit','open','closed','','screenshot-2022-01-03-at-20-38-29','','','2022-01-03 20:39:35','2022-01-03 20:39:35','',2311,'https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-03-at-20.38.29.png',0,'attachment','image/png',0),(2313,1,'2022-01-03 20:43:31','2022-01-03 20:43:31','','Screenshot-2021-12-16-at-19.18.28','','inherit','open','closed','','screenshot-2021-12-16-at-19-18-28','','','2022-01-03 20:43:31','2022-01-03 20:43:31','',2311,'https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28.png',0,'attachment','image/png',0),