Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use of Google Analytics declared illegal by French data protection authority

cnil.fr

Post reply on HN
Print view View original

251–260 of 1001 posts

Re: Use of Google Analytics declared illegal by French data protection authority

#251

Post by AndrewDucker »

viro wrote: post #187
AndrewDucker wrote: post #15

Earlier quoted context omitted.

People shouldnt need to be experts in data collection or computing in order to have their data treated fairly. If Google can't protect user's tracking data (and they can't - the US law won't let them) then they shouldn't be allowed to hold it.

Quoted post unavailable.

Nothing to do with warrants. And this was done by the highest level of EU courts, overriding the commission (which allowed data to be transferred)

The decision is here: https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62...

And it's all about warrantless surveillance.

"As regards the limits on intelligence activities, the referring court emphasises the fact that non-US persons are covered only by PPD‑28, which merely states that intelligence activities should be ‘as tailored as feasible’. On the basis of those findings, the referring court considers that the United States carries out mass processing of personal data without ensuring a level of protection essentially equivalent to that guaranteed by Articles 7 and 8 of the Charter."

and

"As regards judicial protection, the referring court states that EU citizens do not have the same remedies as US citizens in respect of the processing of personal data by the US authorities, since the Fourth Amendment to the Constitution of the United States, which constitutes, in United States law, the most important cause of action available to challenge unlawful surveillance, does not apply to EU citizens."

So, basically, the US security services can hoover up data about EU citizens, and those EU citizens aren't allowed any legal redress about it. Which, unsurprisingly, they aren't okay with.

Re: Use of Google Analytics declared illegal by French data protection authority

#252

Post by geitir »

can16358p wrote: post #8

I don't like Google but seriously this whole GDPR thing is getting out of hand. Anyone who's concerned about their data being collected can just block Google-or-like-related domains. Rest is just making life of web developers/admins/tech company owners harder. Especially with these European intentions I frankly believe this is more of a political war against US and US-based companies. (No, I'm not from US as well)

Agreed

Re: Use of Google Analytics declared illegal by French data protection authority

#253

Post by riddleronroof »

Spivak wrote: post #188
KingOfCoders wrote: post #130

Earlier quoted context omitted.

The point is more nuanced: The problem is not the handing over (happens here too), but the fact EU citizens do not get informed this has happend and have no legal way to challenge this (especially concerning FISA/FISC). They have the opportunity to do so in the EU. Yes, this is what will happen with a setup of 3 entities, b/c FANG will not want to miss EU revenue.

Right but the solution is for there to be a treaty between the US and the EU that allows for this. Putting the burden on every foreign company to duplicate their infrastructure is stupid work to solve a human problem.

Agree. That also means no new US or EU company has a chance to go across the pond. BigCos can set this up. Not so easy for a small startup.

Re: Use of Google Analytics declared illegal by French data protection authority

#254

Post by pmontra »

p4bl0 wrote: post #72

Sadly I don't see how this decision can be translated into practice, since I strongly doubt the CNIL will be able (or willing) to send formal notice, and fine after a grace period, all French companies that make use of Google Analytics on their website.

They will know about the ruling [1]. It's up to them what to do next.

[1] https://news.google.com/search?q=Cnil&hl=fr&gl=FR&ceid=FR%3A...

Re: Use of Google Analytics declared illegal by French data protection authority

#255

Post by viro »

jen20 wrote: post #207
viro wrote: post #187

Earlier quoted context omitted.

Quoted post unavailable.

The argument is not that Google shouldn't hand over data with a warrant if it resides in an appropriate jurisdiction. The argument is that Google shouldn't have the data in that jurisdiction to hand over in the first place unless an individual user has given consent for that.

Why should every US tech company be expected to duplicate its infrastructure in the EU? Google isn't special, this applies to EVERY US-based competitor to GA. This gives EU competitors an unfair advantage.... and that's the real point.

Re: Use of Google Analytics declared illegal by French data protection authority

#256

Post by _notathrowaway »

shadowgovt wrote: post #186
martijnvds wrote: post #39

Earlier quoted context omitted.

Self-hosting something is always going to be less complex, but you'll still need to determine what you're tracking and why, write that down in a form people can understand easily, and let people opt in explicitly (with a just-as-easy way to opt out later). People don't have to opt in for you to keep the data for technical reasons, for instance if you keep IP addresses for while to find and block abuse, but you can't…

What's the rule for aggregated data? I track page view counts as simple sums, and it's not feasible to drop an individual user's page counts because I don't have enough info to identify a unique user. In fact, I put no cookies on the user's machine (but that means I have no way to identify a specific user for opt-out purposes for these aggregated page counts).

I am not a legal advisor, but I believe the matter is settled by what you said:

> I don't have enough info to identify a unique user

If it is not user identifying information, then it should not be an issue.

Re: Use of Google Analytics declared illegal by French data protection authority

#257

Post by jen20 »

ssijak wrote: post #42

So I can take follow someone in public, take picture of them in public places from some distance, follow them into stores, see what they are spending and what they are using, etc. Store owners can have cameras, track the behaviour of customers, etc But if I use a service which anonymously tracks which pages they opened on a website they voluntarily visited and are exploring, then I'm in trouble?

a) You can't do that. b) Your analogy does explain how creepy that desire is quite nicely.

Re: Use of Google Analytics declared illegal by French data protection authority

#258

Post by chillfox »

Spivak wrote: post #188
KingOfCoders wrote: post #130

Earlier quoted context omitted.

The point is more nuanced: The problem is not the handing over (happens here too), but the fact EU citizens do not get informed this has happend and have no legal way to challenge this (especially concerning FISA/FISC). They have the opportunity to do so in the EU. Yes, this is what will happen with a setup of 3 entities, b/c FANG will not want to miss EU revenue.

Right but the solution is for there to be a treaty between the US and the EU that allows for this. Putting the burden on every foreign company to duplicate their infrastructure is stupid work to solve a human problem.

How would a treaty solve it when the US has decided to aggressively disrespect the existing agreements?

Basically the US can’t be trusted to keep its word, so why make it easy for US companies to operate in Europe?

Re: Use of Google Analytics declared illegal by French data protection authority

#259

Post by einpoklum »

rebelde wrote: post #210

Taking this to the logical extreme: A French website can not use any American service, right? Because any American services "are not sufficient to exclude the accessibility of this data for US intelligence services".

Indeed, a French website which keeps private information about its users must not - ethically, morally - use US services which are accessible to US intelligence agencies.

That is irrespective of any legislation or court rulings, it's just common sense.

Re: Use of Google Analytics declared illegal by French data protection authority

#260

Post by Spivak »

bo1024 wrote: post #193
Spivak wrote: post #188

Earlier quoted context omitted.

Right but the solution is for there to be a treaty between the US and the EU that allows for this. Putting the burden on every foreign company to duplicate their infrastructure is stupid work to solve a human problem.

Or the US could adopt better privacy laws.

Your tone implies disagreement but that's exactly what I want as part of the treaty.
Post reply on HN