Last edit: 28 7 2023

Weekly Updates

Google Analytics users under attack

In previous Weekly Update issues we've discussed data protection regulation in Europe and the restrictions on cross-border personal data transfer, especially after the 2020 CJEU decision on Schrems II and last month's decision to issue a 1 billion euros fine against Meta (links here, here, and here). In the issue entitled AI Security, more on Meta's fine, and more on Section 230, we argued:

"Data protection regulations, trying to protect everything, may end up with no legitimacy at all. The real question is whether that will happen before or after the European Union effectively brexits the Internet.”

Today we're exploring another recent case where European Data Protection went to great and tortuous lengths to make sure Europeans don't use US internet services. These three stories tell a cautionary tale about how quickly privacy rights can be turned into privacy duties when data protection is used to limit data owners’ freedom of choice and autonomy under GDPR.

From TechCrunch:

“Sweden’s data protection watchdog has issued a couple of fines in relation to exports of European users’ data via Google Analytics which it found breach the bloc’s privacy rulebook owing to risks posed by U.S. government surveillance. It has also warned other companies against use of Google’s tool.

The fines — just over $1.1 million for Swedish telco Tele2 and less than $30,000 for local online retailer CDON — are notable as they are the first such fines following a raft of strategic privacy complaints targeting Google Analytics (and Facebook Connect) back in August 2020.

The regulator found that so-called supplementary measures applied by Google to European users’ data sent to the U.S. for processing were insufficient to raise the level of protection to the required legal standard. Including Google’s use of IP address truncation (an anonymization measure) as, in the Tele2 case, it said the company did not clarify whether the truncation was performed before or after the transfer of the data to the U.S. so had failed to demonstrate there is “no potential access to the entire IP address before the last octet is truncated”.

If that sounds very targeted, it's because it is. The Sweden data protection authority even published a blog post entitled Companies must stop using Google Analytics and after edited its title and URL to Four companies must stop using Google Analytics (original page accessible here). Our guess is that they wanted to avoid the backlash of a local executive authority on data protection straight out banning the use of one of the most important tools for the internet economy via blog post. The actual repercussion from the four decisions, however, is that European companies are in an incredibly precarious spot since the DPA took the position that they must be able to prove they don't let Google collect personal data at any given point, even if Google anonymizes the data from a US-based location and even if end-users consent with the data processing and sharing.

The important lesson here is that this is not a consent deficiency. EU authorities have the position that consent is not enough to process European personal data. In doing so, law enforcement is now coercing privacy upon their citizens. To illustrate that concept and the philosophy behind it, it's worth mentioning a classic article from Anita Allen, Coercing Privacy, from 1999:

"To speak of 'coercing’ privacy is to call attention to privacy as a foundation, a precondition of a liberal egalitarian society. Privacy is not an optional good, like a second home or an investment account. (…) A hard task seems to lay before us — namely, deciding which forms of privacy are so critical that they should become matters of coercion. (…) Government will have to intervene in private lives for the sake of privacy and values associated with it”.

To be fair, that is not an explicit position from the European authorities, although there is no reference to autonomy as a guiding principle in GDPR. In any case, EU data protection regulators are effectively stripping Europeans from the freedom of choice of service because they don't tolerate that a citizen could accept a different choice of law in exchange for services.

“Choice of law” is a legal term to describe the agreement individuals and companies can place in a contract to define what rules should be applicable to that contract. It's a common practice in commerce and other cross-border deals where it's unclear what law should govern the contract. No doubt, the idea of applying choice of law in a consumer boilerplate contract is considerably more nuanced because of the asymmetries between the two parties. However, the current state of affairs where regulators can decide what version of the internet their citizens can access is no less worrying.

Meta's Threads is not launching in Europe for now

From The Guardian:

"Mark Zuckerberg’s rival to Twitter will not launch in the EU on Thursday amid regulatory uncertainty about the service’s use of personal data.

Sources at Meta, which owns Facebook, Instagram and WhatsApp, said regulations were behind the postponement of an EU launch, amid a series of clashes between the social media group and the bloc.”

Also according to The Guardian, a few hours after the announcement of Threads’ launch date Elon Musk got on Twitter to voice concerns about the potential data collection Meta disclosed on their App Store listing. According to Independent.ie, the Ireland’s Data Protection Commission (DPC) they confirmed they "had been in contact about the new service and that it would not be rolled out in the EU 'at this point'". And although "it is understood that the DPC has not actively blocked the service", Meta would "not yet prepared the service for a European launch outside the UK".

According to Time Magazine, however, under the EU Digital Markets Act, "Meta must await approval from the European Commission, the E.U.’s executive arm, before it can launch Threads in E.U. countries". So one way or another it is safe to say that the regulatory landscape in the block is behind the decision not to launch.

According to Reuters, Threads reached 30 million users in one day, signaling the level of interest in a Twitter alternative. Meanwhile, users from the European Union were blocked from testing the app by their own regulators.

This links to the point we made in Google and the regulators' triple miss about the asymmetric nature of the EU data protection regulation. Back then we discussed the competition-related effects of EU regulators’ decision to halt Google Bard's launch in Europe while ChatGPT operates freely. In that issue, we said:

“The data protection regulation in Europe is so broad and restrictive that is simply impossible for national and European regulators to timely supervise and enforce all its provisions against all the Europe-facing internet. That means regulators will always have to choose where they put their efforts, leading to an asymmetric application of the law that is bound to benefit some parts of the market over others. In short, legislators are writing checks law enforcement cannot cash in a coherent way.

That's the typical scenario of a case-by-case executive enforcement instead of a systemic outcome-focused approach. That is typically associated with a perception that the law has an untapped power to conform reality. It often leads to the point where bending other's behavior to the regulator's will becomes more important than reaching a positive outcome for the people the law was supposed to protect.”

Apart from the competition concerns, one consequence that becomes increasingly salient from this kind of approach from European regulators is that it curbs the freedom of choice from end-users. Once again, this is not an issue of disclosure or consent. The app hadn't even launch yet. And still regulators decide it's best for Europeans not to be exposed to such option. This is paternalism at its core.

Meanwhile… E2E encryption backdoors and chat control are still very much on the menu

From BBC:

“Most governments and security agencies reluctantly accepted the technology's rise - until four years ago, when Mr Zuckerberg announced on stage the Messenger app and then Instagram would move to end-to-end encryption as standard. (…)

Authorities in the UK, Australia, Canada, New Zealand, the United States, India, Turkey, Japan and Brazil - plus law-enforcement agencies such as Interpol - have criticised the technology.

But no government in the democratic world has risked passing a law that will interfere with these popular apps - until now.

Making technology companies build in some sort of technical backdoor to allow messages to be scanned for illegal material is one of the central tenets of the UK's wide-reaching Online Safety Bill, which looks likely to be passed into law in the near future.”

The article continues:

“Also on Wednesday, as if to highlight the passions on both sides of the debate, 68 prominent security and privacy researchers have published a letter saying the Online Safety Bill would effectively break end-to-end encryption.

The bill puts the onus on tech firms to find a way to implement child safety measures whilst maintaining privacy for users but the experts say this is impossible.

"Our concern is that surveillance technologies are deployed in the spirit of providing online safety," the letter says.

"This act undermines privacy guarantees and, indeed, safety online."

It also sets a precedent for repressive regimes around the world to monitor and control what people are sharing, experts say.”

We already discussed the E2EE bans here. What we want to highlight now is the connection between the privacy coercion mentioned before and the privacy restrictions associated with law enforcement. These bans are being discussed everywhere, including in Spain, who has this week taken the rotating Presidency of the Council of Ministers of the European Union. From Wired:

“Of the 20 EU countries represented in the document leaked to WIRED, the majority said they are in favor of some form of scanning of encrypted messages, with Spain’s position emerging as the most extreme. “Ideally, in our view, it would be desirable to legislatively prevent EU-based service providers from implementing end-to-end encryption,” Spanish representatives said in the document.”

Our take on this is that regulators in Europe are trying to dictate every aspect of how and when citizens must exercise or waive their privacy rights. That's just insane. Privacy, or the right to a private life, was literally conceptualized as the right to a sphere out of the eyes of the state, which was then amplified in some extension to protect against prying eyes of private persons as well. If we need to ask the government when we must and when we cannot exercise that right, the term privacy loses its literal meaning.

Edits:

28 7 2023 - This article was edited to clarify the reasons behind Threads' postponement in the EU.

Coercing Privacy in Europe