November 28, 2023
In the last month, Meta has started to give their European users a choice between an account for their services paid in data or one paid in Euros.
Today, noyb has filed a GDPR complaint against Meta over this behavior.
Noyb has very good points to sustain their filing, but I don’t want to delve too much into those since those are very well explained in their press release.
I think there is a deeper problem that they quickly touch but do not address directly, which is the interpretation of the kind of right that privacy is.
Read More 
May 24, 2023
The Irish Data Protection Commission (DPC) has evaluated the legality of Facebook’s (now Meta Platforms) data transfer for over 10 years.
In those 10 years, we have seen the Irish DPC trying to avoid ruling on the matter multiple times and the European Data Protection Board (EDPB) forcing them to do it.
We now have a final ruling on the matter, which is unfavorable to Meta.
In fact, in addition to having to stop the data transfer within 5 months and having to move back all data within 6 months, Meta has to pay a € 1.2 billion fine.
Read More 
September 26, 2022
In the last few months, we have witnessed multiple European Data Protection offices weigh on the legitimacy of Google Analytics.
Back in January, I’ve published a post that touched on the topic but was not really about Google Analytics.
So, let’s start looking at what happened, why Google Analytics seems to be so interesting for the European Privacy authorities, and finish with some guessing on what could happen in the next few months.
Read More 
January 25, 2022
In the last few weeks, there has been a lot of talking about Google Analytics and the GDPR.
I think most of the comments around it have missed the whole picture.
A little bit of history
Our brief history begins at the end of the ’90s when the EU and the US agreed on the International Safe Harbor Privacy Principles. On the 26th July 2000, the European Commission (EC) formalized it with the Commission Decision 2000/520/EC, where it was defined that data could be freely moved from the EU to the US.
The assumption was that the data on US soil would have comparable (or better) protection than the same data on EU soil, and therefore the privacy of European citizens was not at risk.
On 6th October 2015, the European Court of Justice (ECJ) invalidated this decision on the basis that in the US laws were authorizing public authorities to have access on a generalized basis to the content of electronic communications, and this was deemed to be “compromising the essence of the fundamental right to respect for private life” (the quote is from the ECJ decision).
Read More 
January 10, 2022
The CNIL, France’s data regulator, fined Meta (Facebook) and Google for violating the GDPR for a total of 210M€.
More specifically:
- Google LLC (USA) got fined 90M€
- Google Ireland Limited got fined 60M€
- Facebook Ireland Limited got fined 60M€
Also, if the companies will not fix the issue within three months, an additional penalty of 100'000€/day will be added.
There are two facts that I think are very interesting about these fines:
the reason behind the fines
the fines issuer
Read More 
May 31, 2021
Three years passed from the moment the GDPR become binding law in the European Union.
On the one hand, I’m happy that it has already been three years, but on the other hand, I’m impatient to see GDPR fully applied.
Cookies
Cookies are always a hot theme when we talk about GDPR.
I still see websites handing out cookies (first and third parties ones) without a cookie banner or to users who have not pressed the “accept” button on the cookie banner.
Also, speaking about cookie banners, the majority are not compliant since they often make it hard to refuse cookies or pre-select cookie acceptance.
This situation is unfortunate, but we see some movement on this (like the noyb initiative).
If those initiatives continue, as I hope, next year, the cookie situation will be much better!
Read More 
May 25, 2020
As it is becoming a sort of tradition, here we are, after two years from the enactment of GDPR to see how it performs in the real world.
In our previous yearly check, we analyzed the situation from two points of view: the banners and the fines.
Let’s see how those two topics have evolved in the last year.
The Cookie Banners
On the 1st of October 2019, with the judgment in case C-673/17, the European Union Court of Justice clarified that pre-ticketed consent checkboxes are not sufficient since the consent has to be expressed actively by the user.
This requirement was clear to me since my initial approaches to the GDPR, since it was clear that this was the only way to respect the Regulation’s spirit.
Still, it is very nice to see it stated explicitly by the European Union Court of Justice.
Read More 
July 14, 2019
In the last few days, multiple fines related to privacy have been announced.
More specifically:
Even if I talk about them “collectively”, I would like to point out that the third one is very different in nature, in nature and in the jurisdiction, and therefore in the amount of the fine from the first two, which are fairly similar among them.
Read More 
May 25, 2019
One year has passed by the 25/05/2018, the day that the GDPR started to be enforced.
Today I’d like to see how this first year of GDPR went and what we could be expecting for the future given what we have seen so far.
The first consideration that I think is obvious but interesting is that the Internet did not close down on the 25/05/2018 as many were worried.
In fact, not much changed on that day.
A thing that did change a lot is the number of banners asking the authorization to give some cookies to your browser.
This increase of cookie banners is an interesting phenomenon since the differences between the EU cookie law and the GDPR on cookies are minor.
I think this phenomenon can be explained by the fact that now companies are more worried about violating those regulations than before, thanks to the massive fines that they can incur into with the GDPR.
Read More 
(Fabio Alessandro Locati|Fale)'s blog