Notices by Alexander Hanff (thatprivacyguy@eupolicy.social)

European Court of Human Rights bans weakening of #E2EE - a death knell for #ChatControl

https://hudoc.echr.coe.int/eng/?i=001-230854 (para 76 onwards)

#privacy #security #confidentiality #humanrights #fundamentalrights #surveillance

@ErikJonker it doesn't matter where it rolls out, EU persons communicate with people outside of the EU all the time, which is why I have called on the DPC to issue a global ban, because even in jurisdictions where all party consent is not required (such as jurisdictions which only require single party consent) Eu persons messages will be intercepted and as such their rights will still be subject to a breach.

As such, today, I filed an open letter complaint with the Irish Data Protection Commission calling for an immediate global ban on Alphabet's plans in order to protect the confidentially of hundreds of billions of private communications.

Sadly I cannot post the letter here as my Mastodon instance doesn't allow for pdf attachments, but you can read it here:

https://www.linkedin.com/posts/alexanderhanff_open-letter-to-irish-dpc-over-alphabets-bard-activity-7157651449101877251-xAds

#privacy

cc @eu_edpb @echo_pbreyer @EDPS @euractiv_politics

In what can only be seen as Alphabet's blatant refusal to obey EU law, it was announced over the weekend that they would introduce Bard to Android Messages App and intercept all messages (past and future) for the purpose of training it - in breach of EU's rules on interception of communications under Article 5(1) of Directive 2002/58/EC.

To make it worse Alphabet know this is illegal after they were caught intercepting WiFi communications in 2010 with their Streetview cars.

#privacy

@mikarv probably a bad idea to use this given that so many sites still unlawfully enabling the non-existent legal basis of Legitimate Interest under their TCF banners. Rejecting consent on these banners does not unset the LI toggles.

Fun start to my day - up at 4:30am to head to hospital for surgery on my left hand. Currently in pre-op after just receiving anesthetic - should be going in in about 5 minutes.

Currently looking to file a criminal complaint against Meta on the basis that their processing of personal data (which has already been declared as illegal under the two legal bases they chose since 2018) breached criminal law with regards to computer trespass and misuse of computing resources.

The scripts they placed on our devices for the purpose of tracking our behaviour were criminal trespass (accessing a computer without consent and use of computing resources without consent).

#privacy

EDPB sends binding instruction to Irish DPC to ban Meta's processing of personal data for behavioural advertising permanently across the EU/EEA.

According to a press release by the Norwegian DPA, the ban will include Facebook and Instagram and prevents Meta from using the legal bases of 6(1)(b) (Contract) or 6(1)(f) (Legitimate Interest) under GDPR and must instead obtain consent.

Norwegian DPA also states that Meta's plans to introduce paid subscription would be illegal.

Lot's of people asking me why I filed a complaint against #YouTube for their illegal deployment of #spyware to detect #adblockers instead of simply paying for YouTube Premium.

The answer is simple - YouTube Premium has no ads but Google still use it to profile you for advertising on their other products.

I refuse to pay for *any* service which doesn't respect my fundamental rights.

And so should everyone else, because until they do, Alphabet will continue with their illegal #surveillance.

@feld @AlgorithmWolf yes and you think they found themselves for me? Please do go do one - I am not your research assistant.

@feld @AlgorithmWolf sure I charge 400 euros per hour for legal research - send me your billing info and I will get right to it (on Wednesday when I get back from speaking at the EU Parliament about privacy law)

@feld @AlgorithmWolf @helvick again... this is not about personal data, personal data is irrelevant, the ePrivacy Directive has no concern about personal data (that is GDPR).

I have explained exactly what the issue is many, many times, I have provided references of EU case law, I have provided a link to the legal opinion of the EU Commission.

I can lead you to water but I cannot force you to drink. Open your eyes, clear sight is a beautiful thing.

To all the people crying about "Why shouldn't YouTube be allowed to make money from ads!"

If I print a newspaper entirely funded through advertising revenue - and you pick up a free copy, do you think it is ok for me to break in to your house to make sure you are looking at the ads?

Because that is what YouTube are doing when they deploy their spyware to detect #adblockers
#privacy is a #fundamentalright - fight for it or lose it.

@feld @AlgorithmWolf @helvick incorrect the javascript to present the consent request would be considered as strictly necessary and therefore exempt because it is required to meet a legal obligation - you really need to actually read the law to be able to comment because so far I am seeing a lot of utter nonsense arguments based on complete ignorance.

@AlgorithmWolf oh and I have a Masters in Law focused on privacy and data protection laws and am an expert advisor to multiple EU institutions on matters of privacy/data protection and cybersecurity law and technologies.

I am also a computer scientist with 30 years experience and a sociologist with my studies focused on the impact of technology on society (with a specific focus on privacy and related human rights) and my computer science degree was a double major with psychology

@AlgorithmWolf so I am pretty clued up on these issues (to say the least) and am regarded as one of the foremost experts in the world on this particular law.

As such, please don't try to teach me how to suck eggs :)

@AlgorithmWolf well you need to start by reading the correct law and stop framing this around GDPR (which is not the relevant law).

@AlgorithmWolf in order for YouTube to detect the use of adblockers, they are using javascript in the client to detect various behaviours.

The deployment of that js file itself requires consent, the running of the javascript within the browser to ascertain how the browser is behaving also requires consent - there is no other legal basis available under the relevant law.

There is no escape clause here for YouTube, we have EU case law which is binding on *all* Member States supporting this.

@4bz @AlgorithmWolf no it uses js on the client

You can help by filing your own complaint here:

https://forms.dataprotection.ie/contact

The more complaints the DPC receives - the quicker they will act.

You can use my complaint to help write your own (attached).

#privacy #surveillancecapitalism #advertising #cookies #consent #law