Lessons from Google's Geographical GDPR Goof

https://www.dmnews.com/data/data-management/data-privacy/article/21047138/dont-be-stupid-3-lessons-from-googles-geographical-gdpr-goof

by CrankyBear • 7 years ago

143 63 7 years ago

dmnews.com

josteink• 7 years ago

Things like this is why Microsoft is still retaining a lot of business-customers which Google will never touch.

They care about addressing the customers need first and foremost, while Google’s #1 priority will always be tracking and ads.

When the EU said processing needed to be done in the EU, Microsoft was fine with that, while Google has been playing nice only on paper.

With rulings like this, guess which one will seem more reliable and dependable (from a business POV) for the EU market?

Not Google. That’s for sure.

amscanne• 7 years ago

The article seems to relate only to data handling for Android, so I'm not sure your comparison and conclusions are relevant.

modzu2• 7 years ago

op only cites it as an example. but there is empirical evidence -- MS holds enterprise market-share even for products google is otherwise competitive in, and privacy impact is absolutely one of the reasons

ipsum2• 7 years ago

Pretty odd comment, considering Windows 10 does a lot of tracking and ads.

Windows 10 Collects Activity Data Even When Tracking Is Disabled, But You Can Block It

https://lifehacker.com/windows-10-collects-activity-data-eve...

We also display advertising in some services, and we’d prefer to show you ads you find interesting.

https://privacy.microsoft.com/en-us/windows10privacy

And the numerous steps you have to take to improve your privacy:

https://github.com/adolfintel/Windows10-Privacy

lubujackson• 7 years ago

I don't see what's odd about the comment. For core philosophy, Google has always about using an algorithm instead of manual labor whenever possible. The mindset they push to developers is always to "think at Google scale". Customer service has 100% been crappy with Google from day 1, and on purpose. This GDPR situation is political and messy and hits them very much in their weak spot.

Microsoft came from (and continued to focus on) the business market, which is all about big deals and playing ball. The entire concept of Windows was meant to bridge the business market with the home market and they've had split business/home pricing for most of their products forever.

Yes, Microsoft also sucks at privacy and has been evil forever like all of these amorphous businesses that reach their tendrils as far and wide as profitable. But selling ads (and privacy) is just another revenue stream for Microsoft, not their core product. And don't forget that Hacker News' favorite search engine, DDG, is based on Bing. Microsoft doesn't really care about privacy but also doesn't really care about ads - they just want money.

emn132• 7 years ago

As it pertains to this complaint though, those are all seem less relevant than the issue of well... plain non-compliance? I mean, if they didn't even have a DPO...

Still, let's not overstate this "recordbreaking" fine. It's not large, at all. It's only of a fraction of profits (not revenue) in France alone. Even if google fully expected to take this hit, it might not have bothered to change its behavior. The fine, by itself, has no impact on google's business. The greater risk, really, is that they've got a record now: if they get caught again, they'll be more likely to suffer more punitive measures that really are relevant to its core business.

Also, they come across as slightly incompetent, really: I'm kind of surprised such a huge organization didn't bother to prepare very well. I mean, for some the law might have come as a surprise, but it's not been unannounced, and it sure looks like google - amongst others might even count as the law's raison d'etre. How exactly did they miss that?

VikingCoder• 7 years ago

Bing operates in China, doesn't it?

bad_user• 7 years ago

Is this like a cheerleading competition?

laurentl2• 7 years ago

Just to highlight that OP was (rightly) talking about business consumers.

As a business, under GDPR I am responsible for the compliance of my subcontractors (which includes Google Cloud or Azure for instance). I read about this Google blunder and I think that I have other sh*t to worry about than how Google is screwing around with my data. On the other hand, Microsoft has demonstrated time and again that they care about their customers’ data. 2 examples: the fight with the DoJ over access to emails stored in Ireland and the fact they subcontract Azure’s operations in Germany to a German company (to avoid having to hand over the keys to the data center to a 3-letter agency: they literally don’t have them).

tpetry• 7 years ago

The german azure location is a joke. Only the most basic services are available, there are so many missing in germany...

twunde• 7 years ago

I don't think I had understood the why behind Google's GDPR fine prior to this. It's also illustrative of the challenges of running a worldwide business with GDPR. Google knew it had a target on its back, is organized and spent a lot of time becoming GDPR compliant and STILL screwed up in a significant way.

icebraining• 7 years ago

I disagree. It only displays the challenges when you're trying to comply with the letter of the law while doing everything you can to evade its purpose. Stuff like pre-selected consent boxes are not just mistakes or misunderstandings.

saulrh• 7 years ago

The only guaranteed way to avoid regulatory attention is to shut down everything and stop operations. There is fundamentally no decision you can make other than "comply with the law while continuing to operate as effectively as possible".

Even more unfortunately, bureaucracies, including every modern corporation and government, are UnFriendly AIs. You must comply with the letter of the law because not a single agent involved, not the regulators writing the law nor the courts that will interpret the law nor your competitors that will bring complaints against you nor even the users of the products involved, knows or cares what the spirit is. They don't have the correct value systems, experiences, philosophical frameworks, or cognitive architectures to execute the "comprehend human values" step that would be required to interpret the "spirit" of the law. That incapability is why an even minimally functional justice system needs things like checks and balances and case law and jurisprudence and rules of evidence and all of those things. But we do need those things, because history has proven universally that the letter of the law is the only thing that matters.

On the one hand, this means we literally can't trust any organization composed of more than approximately two people. You often can't even trust organizations with one person, simply because bureaucracy is a force-multiplier even for single humans; think about things like bug trackers and source-control systems and apply them to other workflows. On the other hand, this means that it's pretty much worthless to try to do anything about any individual corporation. Up to the point where you entirely obliterate their industry you're stuck. Which is, coincidentally, what an antitrust action really is - antitrust actions happen exactly when a single agent has taken over an entire industry, and making sure that that an identical bad actor doesn't reappear requires not just breaking it up but also obliterating its industry and introducing a new one with similar features but substantially different (non-agglutinative) dynamics.

Standard disclaimers: Views don't represent employer, etc.

ocdtrekkie2• 7 years ago

To be clear, this isn't even necessarily about "how Google violated GDPR". This is "why the case didn't go through a country favorable to Google".

Aka, Google would've still likely been violating GDPR if they had a proper DPO in Ireland, but given how favorable Ireland is to the international companies it harbors the EU legal entities for, it's possible Google would've more successfully evaded punishment, had they been set up to ensure the case got handled in Ireland, rather than France.

kasey_junk• 7 years ago

Frankly, jurisdiction shopping was one of the big questions surrounding GDPR. You can be sure that legal teams are using this ruling to shore up their own documentation to make sure a random DPA can't bring case against them.

Always better to be engaged with an enforcement agency in a country that collects revenue from you.

ggggtez2• 7 years ago

IMO, it seemed that the purpose of GDPR was to create a legal arrangement to tax/fine Google (and other big US tech companies). The fine was going to happen one way or another, the question was just how big it would be in the end.

For some context on why: consider those "cookie" notices you see on every site now. The notices are often obtrusive, usually don't have a "no" button, don't make it clear how to withdraw your consent if you do click "yes"... So if every company is in violation, and no one knows how to do it correctly even with millions of reasons why... Then how exactly is it going to protect user privacy in the real world?

jacquesm4• 7 years ago

If that is what you got from the available materials and the track record of the EU DPAs to date then you should probably do some more reading.

EU companies have as much or more stake in being compliant than the few US tech giants active on EU soil.

I see the impact of the GDPR on EU based companies every week and it is definitely moving the needle towards more secure operations and a much better attitude towards stewardship of data-subject related data.

stordoff2• 7 years ago

For some context on why: consider those "cookie" notices you see on every site now.

That's the 'cookie law'[1], not the GDPR. As I understand it, you don't have to provide a way to say no. You just have to notify people before doing it.

[1] Privacy and Electronic Communications Directive 2002

Mirioron6• 7 years ago

IMO, it seemed that the purpose of GDPR was to create a legal arrangement to tax/fine Google (and other big US tech companies). The fine was going to happen one way or another, the question was just how big it would be in the end.

This is what I think as well. The attitude EU politicians (especially German and French) have taken against foreign tech companies is incredibly hostile. I assume they do this because we don't have many large tech companies in the EU. If they hurt foreign tech companies enough then perhaps there's a chance we might get some in the EU ourselves. What they don't understand is that the reason the EU doesn't have many major tech companies is because the environment is hostile towards them.

Think back on when Zuckerberg was at the EU Parliament and he was asked to name an EU competitor to Facebook to show that they're not a monopoly.

amenod• 7 years ago

I have a very difficult time understanding any of this. I mean, yes, for most of the SME 50 mio dollars would be some money, but for Google? Peanuts. Who cares if they messed up? If this is the penalty for it, bring it on... It was cheap school for them (not on how to do GDPR properly, but how to get better at avoiding penalties in the future).

Seriously, I hope EU can do better than that. We could really use some real privacy protections, especially from the likes of Google, Facebook, Microsoft, Apple, Amazon,...

jiveturkey• 7 years ago

It's not the size of the fine. It's that there's a fine at all. It's a warning shot across the bow.

Also, this isn't a fine as "cost of doing business". Google still has to address the issues. If they don't, you can be sure the next fine will be 10x.

Macha• 7 years ago

If you look at some of the GDPR fearmongering (Particularly stuff like "Oh no my designated DPO left and it took us a week to find a replacement." or "Oh no, my 1 person company with no automated process got a GDPR request while I was on holiday in the bahamas and I took too long" leading to 4% of revenue fines, one of the points made is that the EU tends to not apply the maximum penalty immediately based on the severity of the offence and whether it's a repeat offender. So this is (a) Google's first offence and (b) it seems the finding is about a technicality that could be a genuine mistake (1 day after GDPR Google's TOS didn't mention Google Ireland yet), so it's understandable that they didn't pull out the 4% of global revenue fine. Even though ultimately the Google behavior is the target of the legislation, not giving Google the same "first time's a warning" type behavior of local SMEs sounds like a good way to start a trade war.

The next GDPR violation Google is accused of, they will now be a repeat offender and more likely to get a higher fine, until they either become compliant or end up at the 4% of revenue fine.

laurentl2• 7 years ago

it seems the finding is about a technicality that could be a genuine mistake (1 day after GDPR Google's TOS didn't mention Google Ireland yet)

To clarify, the fine is due to the consent mechanism in Android. The fact that the action was led by the French regulator rather than the Irish one is due to this technicality and others (no DPO in Google Ireland for instance)

Mirioron6• 7 years ago

one of the points made is that the EU tends to not apply the maximum penalty immediately based on the severity of the offence and whether it's a repeat offender.

But this is how it's done because it's standard practice, not because the law stops them from doing it.

anonymousab• 7 years ago

It's peanuts now. Less so on the tenth or hundredth time they get hit.

stordoff2• 7 years ago

The goal of the DPAs is to ensure compliance. If a small fine is enough to do that, great; if not, they'll fine you more next time.

theyinwhy3• 7 years ago

We are currently struggling with firebase cloud messaging as the instance id has been deemed personally identifying by our laywers which google clearly does not think is the case (they don't even offer a data processing contract for firebase). So, if you are currently using Firebase cloud messaging, there is a big chance you are in violation of gdpr.

dantiberian• 7 years ago

Google Cloud has a DPA if I remember correctly, that would cover Firebase usage?

theyinwhy3• 7 years ago

The google cloud DPA unfortunately does not cover Firebase.

ogeidix• 7 years ago

Are you familiar with [1] and [2]?

1. https://firebase.google.com/support/privacy/

2. https://firebase.google.com/support/privacy/manage-iids

theyinwhy3• 7 years ago

I was told the main problem is that google's view on things is not en par with gdpr. Google claims that "Data associated with Instance IDs is generally not personally-identifying" (see 2.) which our lawyers say they clearly are. In that regard, google does not talk about instance ids or, worse, data processing in between APNs and the sending backend (see 1).

The current legal situation does not allow us to use firebase cloud messaging.

ggm4• 7 years ago

We (staffers) wanted to consider google g suite for integrated mail/calendar. We couldn't because as an Asia-Pacific entity, we felt we wanted a guarantee our data was in Asia-Pacific (preferably Australian) DC and under local law.

What we found, is that only the US State and federal governments can demand US located data from Google. All other economies and agencies can ask for local, but cannot have it a checkbox requirement: Google retain the right to host you wherever they decide, subject to laws they decide.

Somebody else has noted that Microsoft, for all their faults, actually looked at customers in Europe and said "you know what: we can declare hosting in ireland is subject to EU laws and we will (at the right price) guarantee your data is in the EU, subject to EU law" and for that, I salute them.

I think Google got this wrong. I think microsoft got this right.

We didn't go with G Suite. We went another direction with mail and calendar.

eitally• 7 years ago

This is not true anymore, at least not the second part. It's not possible to select JAPAC data location (yet).

https://support.google.com/a/answer/7630496?hl=en&ref_topic=...

ggm4• 7 years ago

You can select US or Europe or no preference. So, you cannot select LatAM or Asia.

Google are getting better, sure. EU feels like they did a reaction to GDPR extra-territoriality issues. The thing is there is either zero selectivity, or there is n+ because nobody codes a two value toggle for this: They clearly have intent to add more. How many more?

dmurray• 7 years ago

as an Asia-Pacific entity, we felt we wanted a guarantee our data was in Asia-Pacific (preferably Australian) DC and under local law.

I don't understand why you would want a generic Asia/Pacific location. It makes sense that you might want it to be in a particular jurisdiction for legal purposes, so I understand specifying Australia, in the same way other businesses specify EU or US or China. But why would you ever want to say "put our data somewhere in this hemisphere, Australia or Malaysia or Korea are all OK but don't let it be in Ireland or the USA"?

rozenmd• 7 years ago

Probably latency requirements?

ggm4• 7 years ago

Ideally we wanted OZ. Google hadn't even come onshore at that point. We wanted in our hemisphere, we'd have settled for JP or SG probably. It wasn't on offer: Google didn't sell "put my data in my chosen jurisdiction" it sold "we put it where we want to, unless you are the US government in which case yes sir whatever you want sir"

Being told they do "now" is great. 5+ years too late. And, the evidence about this is that Google cave to intercept requests far faster than microsoft do. Microsoft ask for strong evidence you have jurisdiction. Google don't make any public noise about this, and about how they act.

I am not a hater btw. I use a lot of google product.

(to latency: a lot of fiber in Asia goes odd paths. being in Japan or SG wasn't actually a good guarantee it would be faster than from the USA)

Lessons from Google's Geographical GDPR Goof

Related Stories