267 posts • joined 10 May 2011
Re: GDPR ?
>Using it for analytics to help improve their business is also allowed.
If personal information is processed with the justification of carrying out a contract then it may only be processed for that purpose. Doing anything else with it - such as "improve their business" - needs a separate justification, usually consent. The legitimate interest justification could apply, but there is apparently a high bar to using it* - as there should be lest this becomes a general purpose loophole that'd make GDPR internally inconsistent and effectively null and void.
On a related note
The defaults on all browsers to ought to be: session cookies only, no 3rd party cookies.
Facebook insists it has 'no plans' to exploit your personal banking info for ads – just as we have 'no plans' to trust it
This reminds me of Facebook's lying about what they were going to do with WhatsApp's data after the merger (the EU even fined Facebook for this: https://www.theregister.co.uk/2017/05/18/ec_fines_facebook_110m_for_wrong_info/ )
re: Spies Denmark
For a second I was wondering what the local Google affiliate was doing in a list of travel agencies.
While the fine in itself is of no consequence to Facebook this may still come back to bite them down the line: I'd imagine a legal argument against, say, Facebook like / share buttons all over the place would be bolstered by pointing out repeated prior violations.
The default should be no slurp whatsoever. Moreover, no active measures on the part of the would-be slurper to induce the end-user to change that i.e. a facility to opt-in may exist, but the end-user must find and use it on their own.
Re: None of them does
>You opt-in by using the service.
Under the GDPR it doesn't work like that: making the provision of a service conditional on consent to process personal data invalidates the consent (Article 7(4), recitals 42-43 : https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679 )
Re: Washington Post
I saw this too: no 3rd party tracking is promised only as a part of the most expensive subscription. This is in breach of GDPR as giving consent may not be a precondition to providing a service, nor can there be any other disadvantage to those who decline to give consent. (Article 7 point 4, also see recitals 42-43 : https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679, see also: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=623051 )
It also occurred to me that this sort of thing requires using location information which supposedly required explicit consent even before the GDPR.
Also, Facebook is in a business, which is a natural monopoly due to the network effect i.e. a service like it is more valuable to its users the more users it has (like a telephone network where the one with more subscribers is the more useful one): there is a positive feedback loop luring more users (from other similar services) to the biggest one until there is no competition to speak of. This not only means that the first provider to get beyond some critical size is likely to become a de facto monopoly, but also that it is practically impossible to outcompete the monopolist after this. Also the monopolist, as in here, tends to be in a position to buy out or otherwise neutralize anyone who might try, just in case.
> ... too many users who just don't seem to care.
Because they have no idea there is an issue, never mind knowing what it might be (?).
Re: It goes from bad to worse.
>A user in China or Africa cannot claim EU GDPR rules, just because their data is held in Europe.
Actually, I'm not sure of that: as long as the 'processing' in the sense of GDPR (including merely storing it) physically happens in EU it would seem that an EU country has jurisdiction, while the user's country outside the EU would have jurisdiction as well as there in an effect on a user in their jurisdiction - these are not mutually exclusive, but Facebook must abide by both legal regimes. Usually this means going by what is more restrictive for Facebook. If, however, there is no way operate in two jurisdictions without breaking the law in one, then it would seem that Facebook needs to make a choice as to where it wants to do business.
Moreover, regardless where the data is 'processed', the users outside the EU who currently have a contract with Facebook Ireland would seem to have a right to be treated in a way compliant with the GDPR (or the pre-existing data EU data protection regime) on the basis of Facebook Ireland being an legal entity within the EU. Actually, since this effectively means moving vast amounts of data from the EU I'm not so sure this legal as moving data outside of the EU is restricted under the current rules. As the data is going to the US I suppose Facebook could point to Privacy Shield for now, but then it would seem that this will eventually unravel as it is not substantially better than Safe Harbour was.
>The basis of Android is open source ...
Nominally, yes, Android is open source, but actually Google has a monopoly* on it akin to Microsoft's on PC OS: Google has perverted the openness of the system by creating/moving APIs that many apps depend on into proprietary components outside of the AOSP proper, moreover, Google has the only viable app store for Android.
Microsoft's becoming monopoly on PC operating systems depended on the "network effect" where a product or service becomes more valuable the more users it has, which happens because of the closed feedback loop: more/better software available for Windows -> more Windows users -> writing Windows software becomes a better proposition for developers (than writing for competing platforms) -> more/better software available for Windows ... This soon results in a natural monopoly which is practically impossible for a competitor to challenge.
With Android Google not only has an OS monopoly akin to Microsoft's as such, but this is reinforced by its app store monopoly (Microsoft is working on the latter for Windows as well, but not quite there yet). Google's paying for Android and the related services from its advertising revenue makes it even more infeasible for a competitor to succeed and therefore one is unlikely to even emerge: for Google Android is good business as it helps them to rake in advertising revenue, for a potential competitor not so much as it would have to sell the OS as such or embed the cost into price a physical product thereby making those more expensive which means they cannot really compete (as Android is "free"**).
* technically, an overwhelmingly controlling market position, colloquially a monopoly (which is close enough as it is equivalent to an absolute monopoly for most intents and purposes)
** not really free, of course: 1) the consumers ultimately pay for it in higher costs of advertised products and services (only they pay more as there are middlemen) 2) they also pay with their information / loss of privacy and 3) with having to put up with commercial propaganda (=advertising) i.e. getting actively manipulated and misled, which 4) is a systemic problem in a market economy depending on well-informed parties to work efficiently (hence, again, resulting in actual monetary cost because of less efficient economy due to a group of market parties actively working on consumers to be less than well-informed in their decisions)
Re: And that's exactly why...
> ... an amendment to the GDPR such that ...
I don't think an amendment is needed, except maybe for extra clarity. With GDPR and even with the old EU data protection regime consent is required to process an individual's data, which there can't be if the data is purloined from friends' address books and such or, in general, not from the individual him/herself.
An implicit admission ...
... of the extensive communications and data snooping the US government is involved in: the obvious use unique identifiers like social media ids, phone numbers, email addresses is as a selectors for queries into databases containing the snooped stuff.
Re: So what if they don't ?
> Well seize their EU assets ...
I seem to recall that because of Facebook's tax shenanigans their global, non-US revenues go via Ireland (in the EU). I suppose this helps collecting fines and seizing considerable assets. Ultimately I suppose Facebook's Irish subsidiaries through which the global revenue goes could be seized with the effect that said revenue gets permanently seized (the contractual arrangements between Facebook and the subsidiaries created for tax avoidance would surely stay in effect after the seizure?).
Re: NoScript no work
It seems updating to 57 also broke Request Policy (continued). :( This is why I dread updating Firefox. While any apparent change tends be just some rearrangement of the UI (usually pointless and annoying as such) you can be pretty sure that they have somehow managed to make existing addons incompatible and I'm at least forced to update those as well - if I'm lucky - if not, there is no compatible version.
Re: Facebook et al
> ... because I use protection.
Good for you (so do I). However, not everyone does, knows about it or even why it should be used. And, actually, there should be no need, instead collecting, using and transferring personal data (i.e. any data about a person) should be all opt-in (which is pretty much the idea of data protection in a nutshell), such that there is prior, explicit, retractable consent, freely given (i.e. consent is actively given, the default is 'no consent'; consent can't be required to use a product or service).
I suppose it is also relevant that Uber sets the rates the customer pays (thereby controlling what the driver gets after Uber's cut as well); if Uber were merely a real-time market with an app for access matching customers seeking to go from A to B with drivers willing to make that happen for a price agreed between a customer and a driver (or maybe set by a regulator) it would be a different matter.
If we can't have a corporate death penalty (i.e. fines large enough to bankrupt a corporation) for even the most serious misdeeds, could we at least have a penalty where a corporation was forced to issue new shares up to, say, hundred times of its current stock to be sold on a public stock exchange over time with the proceeds going in the public purse. To clarify: the intent is to allow regulators / courts to punish the shareholders of a corporation by wiping out the value of their holdings to a degree proportional to the offense thereby creating an incentive to force proper behavior on the board and top management.
Re: What about...
Thanks, I tried to be very careful with them; a joke of a sort (to a retired (C-)programmer sometimes struggling to balance his parentheses to the satisfaction of (g)cc, anyways) seemed to be emerging as I was writing my short missive, which seemed to ((((perhaps) almost) reasonably) legitimately) call ever more nested parentheses. [Per above I can confirm that unbalanced braces are jarring. :/ (Although I'm not sure if it is (undiagnosed) OCD or merely a result of decades of nagging by cc and her relatives; these may amount to the same thing (or close enough) in practice (?).)]
Re: What about...
Indeed. No third party cookies. In fact, no cookies other than session cookies. These should be the default settings of any browser (by law (with draconian punishment for violations (and something even worse for anything that could be construed as an attempt to circumvent (the letter or (especially) the intent of) the law))).
I'm having mixed feelings as to whether I would like to try some of what those responsible for the EU side of this 'deal' have been smoking.
Oh dear, oh dear
Too bad. (not)
Session cookies only. Separate session for each tab.
Re: 15 years of history?
This could be meant to be impossibly onerous in practice without being strictly impossible in theory i.e. a de facto travel ban (v 3). As a bonus, if someone still manages to get visa approval, they have most likely left something out in the application and this can be used as a pretext to jail and/or deport them at will (neatly working around pesky legal constraints that might apply to a person physically in the US with a valid visa).
> In fact, any country can ...
I suppose any country can also put anyone against the wall when there, or have someone assassinated while in another country. That something can be done doesn't make it right. For this reason most countries have chosen to limit what they can do by domestic law and by signing international treaties. In this context the US used be an ardent proponent of human rights; sadly, this has given way to seeking legalistic loopholes to work around them* in the sense that human rights apply simply because one is a human being.
* e.g. Gitmo, drone strikes, entirely unfettered mass surveillance of foreigners
Re: Noob question
I suppose args has a similar purpose to argc and argv in C main(): the program gets the arguments it is invoked with (if any) trough this. In your example they are not used for anything, but they could be so they are part of the interface / function signature of Kotlin's main().
Re: EU Competition Commissioner said:
Indeed. 110 M € in this context is too small by two to three orders of magnitude. In general, I suppose fines to companies should be such that getting several within a few years would result in bankruptcy. If they are meant to have an effect, that is.
weaken Privacy Shield?
Fear not, for Privacy Shield is about shielding US corps from having to give a hoot about the privacy of us EU plebs.
>I'm curious to know how this was argued.
"Now Mr Congressman, about that campaign contribution ..."
I'll have to object to the idea (a tautology, really) that being a spy organization legitimizes spying: in civilized countries this is illegal without a warrant (for a good reason). Moreover, a spy organization operating outside its native country / jurisdiction cannot legitimately have such a warrant.
Re: WhatsApp / Signal
I don't think any app is safe against local root access, never mind an exploit that allows running code in kernel mode i.e. unfettered access to the hardware: with these the attacker has access to everything the user has (and more).
The only place that mentions "cookie" in 2009/136/EC* is (66):
"Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities."
From this I'd gather that cookies needed for shopping carts and such are ok, as are session cookies in general as they are not (permanently) stored on user equipment. "Analytics cookies", if they mean 3rd party tracking cookies, would seem to fall foul of this as they are stored on user equipment and are a privacy menace amounting to spyware. If anything, the latter should be more clearly and categorically banned (at least without explicit consent and a right to refuse without affecting the service).
Unless they have radically changed their ways recently Apple's claimed "26% tax rate on its worldwide earnings" doesn't seem credible or at least it is very much at odds with the findings of the 2013 US Senate investigation which found that Apple had managed to arrange to be tax resident nowhere for its earnings outside the US.
Re: I'm not sure how he thinks this will work on an iPhone 6
@Steve Todd: Well, I'd be delighted to be wrong about this if it means that things are better documented or at least better known by now (or always were). Last time what information was around (using an hour or three to look for it with the benefit of a background as a seasoned embedded systems SW engineer) left me with the above impression (admittedly with some of my own speculation having most likely blurred to the info by now). I wouldn't mind seeing a quote from the above link attesting to the secure enclave's nature as a physically separate, tamperproof* subsystem, in particular it having its own persistent, but mutable storage, physically separate from the general purpose flash (without which it is still vulnerable to this sort of attack); this is the main point where I had to rely on speculation (i.e. Apple very likely minding the BOM / extra size / complexity from an extra chip / ... too much to implement a feature the finer points of which the general public would be unlikely to appreciate).
* one aspect of this would be whether the secure enclave's firmware is immutable (failing which makes the kind of hack FBI was demanding of Apple possible)
Re: I'm not sure how he thinks this will work on an iPhone 6
Um ... as I seem to recall (from the time this was last an issue), the A6 already has the arrangement where a 256-bit constant is baked in the SoC only wired to the internal AES circuits (i.e. no direct software access). This means that cloning the flash and running the firmware in a VM won't work, but cloning the flash and running that with the actual hardware does (assuming that the only mutable storage in the device is the flash): this way at least the retry counter can be defeated by restoring the flash contents.
Unlike the A6, the A7 (and later) has the 'secure enclave'. However, rather than a physically separate processor with a dedicated mutable storage this appears* to be a virtual one sharing the system's flash chips as its only mutable storage. This is primarily geared at keeping someone with remote access (say, an exploit delivered via browser) at bay rather than someone with physical access (i.e. it keeps the iOS user and even kernel space isolated from the key storage, which is a worthy thing to have, of course). It seems Apple has not actually managed the latter; this would take your assumed separate tamperproof security processor with its dedicated mutable storage to keep the keys. This - afaik - Apple don't currently have. Hence, my impression is that there is no fundamental reason the technique (i.e. using a cloned flash with the original HW) wouldn't work on a iPhone 6 (or later).
* Apple seems to rely on obscurity for security here, afaik this is not properly (that is, publicly) documented
A no-brainer ?
I wonder if Apple's lawyers and accountants knew full well that this could happen, but went ahead anyway: it seemed likely to work and the worst that could happen was that they'd have to pay the tax they owed in the first place.
re: Google and others
The Commission needs to start somewhere. Actually it started with Amazon, BASF, Fiat and Starbucks. I trust Google. Microsoft, ... will be dealt with as well.
re: tax deals
There should be none, really. Instead, corporations pay tax on their profits at the non-negotiable corporate tax rate, same for any and all, where the bookkeeping rules for calculating the profit are likewise non-negotiable, same for any and all. As far as I can see this is what EU Commission is after here so that competition is not distorted due to company specific deals amounting to state aid.
re: von Neumann
What I'd recall was that von Neumann got involved in the US war time computer programs (most importantly EDVAC as far as the eponymous computer architecture is considered) and put together an excellent memo of what he learned as a result. As the memo got somewhat wide distribution despite being about a secret wartime program and was about the only source of such quality right after the war, von Neumann got pretty much all the credit, much of which should have gone to John Mauchly and J. Presper Eckert, at least. (Actually, for a long time, the Americans got all the credit, despite Konrad Zuse's earlier work and that in the UK on the Colossus. Sadly, these are still rather poorly known.)
re: protects EU citizens, their privacy
Humbug. US corps, morelike, from having to give a hoot of the same.
It seems strange that a Belgian court would not have jurisdiction of what physically happens in Belgium: if the user / browser / computer (or other device) is in Belgium the hard disk (flash chip, ...) on which the cookie is written is also in Belgium.
re: "Modern data protection legislation which assumes that metadata is anonymous would need to be rewritten."
Re-writing would be ideal, of course. Then again what there is in the EU already covers this if interpreted with the law's purpose (privacy, self-determination) in mind. In this sense the the Schrems decision is very encouraging: the ECJ actually considers privacy and data protection fundamental rights to be protected as such.
>This goes against the entire reason Android was created. ...
Probably. Google bought Android Inc. in 2005, though.
Re: If it works for Apple...
While I wouldn't (at all) mind the wall around Apple's walled garden to suffer a fate akin to the structure that once circled West Berlin there is a crucial difference between Google and Apple: Google has a dominant market position in the EU (with Android, search, ...) while Apple doesn't (of course, Apple has monopolies within its own ecosystem, but then that isn't the dominant one within the general market(s), so, while I wish this could be acted upon it might not be possible under EU law ?).
In effect Android is proprietary already ...
... because GMS is. Most importantly Google's stranglehold is cemented by GooglePlay, which at this points enjoys an unsurmountable advantage due to network effect*. (Not that coming up with the other components (browser, maps, ...) would be trivial, never mind something phone manufacturers on razor thin margins were likely to pull off or even try.)
* i.e. the value of a product or service to an user increases as the number of users increase, which in this case happens because of the feedback loop of: more GooglePlay users -> more developers using GooglePlay (exclusively) -> more GooglePlay users -> ...
Indeed. Like its predecessor "Privacy Shield" simply amounts to US firms being exempt from EU data protection. This is plain unacceptable as data protection is a fundamental right. Also, being exempt gives US firms a rather unfair competitive advantage.
Quite. The US to needs to adopt proper data protection legislation like just about any other advanced country. In the meantime I suppose the only realistic solution is to keep EU citizens' data out of the US.