[Dossier] Les États-Unis, le RGPD et Max Schrems
▻https://rdgp.fr/@rdgp/episodes/les-etats-unis-le-rgpd-et-max-schrems
[Dossier] Les États-Unis, le RGPD et Max Schrems
▻https://s3.castopod.cloud/c73b24d11982c74d67384426dcca4f509/podcasts/rdgp/1731933277_e0d7cde8838879b568f0.mp3
Description de l’épisode
Alors que l’élection présidentielle américaine vient d’avoir lieu, les enjeux liés à la surveillance de masse et aux flux de données transatlantiques n’ont jamais été aussi cruciaux.
À travers la fabuleuse histoire de Max Schrems, étudiant autrichien devenu le visage de la résistance contre Facebook et les accords transatlantiques, nous retraçons les moments clés qui ont marqué la protection des données personnelles.
Liens :
NOYB (None of Your Business) ▻https://noyb.eu/en : Organisation fondée par Max Schrems dédiée à la protection de la vie privée.
Arrêt Schrems I ▻https://curia.europa.eu/juris/document/document.jsf?docid=169195 : Décision de la Cour de justice de l’Union européenne invalidant le Safe Harbour.
Arrêt Schrems II : Décision de la CJUE invalidant le Privacy Shield. ▻https://curia.europa.eu/juris/document/document.jsf?docid=228677
FISA 702 : Section du Foreign Intelligence Surveillance Act autorisant la surveillance électronique. ▻https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act_of_1978_Amendments_Act_of_2008#F
Safe Harbour : Accord encadrant le transfert de données entre l’UE et les États-Unis, invalidé en 2015.
Privacy Shield : Successeur du Safe Harbour, également invalidé en 2020. ▻https://fr.wikipedia.org/wiki/Bouclier_de_protection_des_donn%C3%A9es_UE-%C3%89tats-Unis
Data Privacy Framework : Nouvel accord proposé pour le transfert de données transatlantique. ▻https://fr.wikipedia.org/wiki/Data_Privacy_Framework
Health Data Hub : Plateforme française centralisant les données de santé. ▻https://fr.wikipedia.org/wiki/Dossier_m%C3%A9dical_partag%C3%A9#Le_Health_Data_Hub
Philippe Latombe : Député français très investi dans les questions liées au numérique. ▻https://www.assemblee-nationale.fr/dyn/deputes/PA721984
Austrian DSB : EU-US data transfers to Google Analytics illegal
▻https://noyb.eu/fr/ord-autrichien-les-transferts-de-donnees-entre-lue-et-les-etats-unis-vers-googl
(traduction de : ▻https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal)
Max Schrems: “We expect similar decisions to now drop gradually in most EU member states. We have filed 101 complaints in almost all Member States and the authorities coordinated the response. A similar decision was also issued by the European Data Protection Supervisor last week.”
Voir aussi : ▻https://www.blogdumoderateur.com/google-analytics-rgpd-non-coupable pour la tentative d’évitement de Google (en gros le problème légal ne résiderait pas dans l’application en tant que telle, mais dans l’usage de certains utilisateurs)
Illegal data exchange between address publisher and credit ranking agency
▻https://noyb.eu/en/illegal-data-exchange-between-address-publisher-and-credit-ranking-agency
noyb filed a GDPR complaint against the credit ranking agency CRIF GmbH and the address publisher AZ Direct on March 18, 2021. The companies exchange data which violates the GDPR, as well as Austrian law. Address publishers are only allowed to pass on data for advertising purposes, but not to credit agencies for credit rating. CRIF and AZ Direct : GDPR violation as a common business model. The complainant had submitted an access request under Article 15 GDPR to CRIF. CRIF stated that it (...)
#[fr]Règlement_Général_sur_la_Protection_des_Données_(RGPD)[en]General_Data_Protection_Regulation_(GDPR)[nl]General_Data_Protection_Regulation_(GDPR) #données #finance (...)
##[fr]Règlement_Général_sur_la_Protection_des_Données__RGPD_[en]General_Data_Protection_Regulation__GDPR_[nl]General_Data_Protection_Regulation__GDPR_ ##NOYB
Clearview AI’s biometric photo database deemed illegal in the EU
▻https://noyb.eu/en/clearview-ais-biometric-photo-database-deemed-illegal-eu
Clearview AI is a US company that scrapes photos from websites to create a permanent searchable database of biometric profiles. US authorities use the face recognition database to find further information on otherwhise unknown persons in pictures and videos. Following legal submissions by noyb, the Hamburg Data Protection Authority yesterday deemed such biometric profiles of Europeans illegal and ordered Clearview AI to delete the biometric profile of the complainant. Link to the (...)
#Clearview #algorithme #CCTV #biométrie #procès #[fr]Règlement_Général_sur_la_Protection_des_Données_(RGPD)[en]General_Data_Protection_Regulation_(GDPR)[nl]General_Data_Protection_Regulation_(GDPR) #données #facial #reconnaissance #scraping #NOYB (...)
##[fr]Règlement_Général_sur_la_Protection_des_Données__RGPD_[en]General_Data_Protection_Regulation__GDPR_[nl]General_Data_Protection_Regulation__GDPR_ ##consentement
noyb files complaints against Apple’s tracking code «IDFA»
▻https://noyb.eu/en/noyb-files-complaints-against-apples-tracking-code-idfa
IDFA (Apple’s Identifier for Advertisers) allows Apple and all apps on the phone to track a user and combine information about online and mobile behaviour. Just like for cookies, this would require the users’ consent under EU law. Apple places these tracking codes without the knowledge or agreement of the users. noyb therefore filed two complaints against the company. Complaint filed to the Data Protection Authority Berlin (PDF) Complaint filed to the Spanish Data Protection (...)
#Apple #cookies #iPhone #smartphone #consentement #[fr]Règlement_Général_sur_la_Protection_des_Données_(RGPD)[en]General_Data_Protection_Regulation_(GDPR)[nl]General_Data_Protection_Regulation_(GDPR) #écoutes #profiling #surveillance (...)
##[fr]Règlement_Général_sur_la_Protection_des_Données__RGPD_[en]General_Data_Protection_Regulation__GDPR_[nl]General_Data_Protection_Regulation__GDPR_ ##NOYB
101 Complaints on EU-US transfers filed
▻https://noyb.eu/en/101-complaints-eu-us-transfers-filed
A quick analysis of the HTML source code of major EU webpages shows that many companies still use Google Analytics or Facebook Connect one month after a major judgment by the Court of Justice of the European Union (CJEU) - despite both companies clearly falling under US surveillance laws, such as FISA 702. Neither Facebook nor Google seem to have a legal basis for the data transfers. Google still claims to rely on the “Privacy Shield” a month after it was invalidated, while Facebook continues (...)
#Google #GravyAnalytics #Microsoft #Facebook #[fr]Règlement_Général_sur_la_Protection_des_Données_(RGPD)[en]General_Data_Protection_Regulation_(GDPR)[nl]General_Data_Protection_Regulation_(GDPR) #données #BigData #PrivacyShield #CJUE (...)
##[fr]Règlement_Général_sur_la_Protection_des_Données__RGPD_[en]General_Data_Protection_Regulation__GDPR_[nl]General_Data_Protection_Regulation__GDPR_ ##NOYB
CJEU Judgment - First Statement
▻https://noyb.eu/en/cjeu
CJEU invalidates “Privacy Shield” in US Surveillance case. SCCs cannot be used by Facebook and similar companies. Facebook and similar companies may also not use “SCCs” to transfer data as DPC must stop transfers under this instrument. Schrems : “We need US surveillance reform. The Court has clarified that there cannot be any transfer of data in violation of EU law.” Max Schrems’ (chair of noyb.eu and party to the case) first reaction to the judgment : Schrems : “I am very happy about the (...)
#procès #données #BigData #SafeHarbor #PrivacyShield #surveillance #[fr]Règlement_Général_sur_la_Protection_des_Données_(RGPD)[en]General_Data_Protection_Regulation_(GDPR)[nl]General_Data_Protection_Regulation_(GDPR) #CJUE (...)
##[fr]Règlement_Général_sur_la_Protection_des_Données__RGPD_[en]General_Data_Protection_Regulation__GDPR_[nl]General_Data_Protection_Regulation__GDPR_ ##GAFAM
Complaint filed against Google Tracking ID
▻https://noyb.eu/en/complaint-filed-against-google-tracking-id
Google : If you don’t want us to track your phone – just get another tracking ID ! Today noyb.eu filed a formal GDPR complaint against Google for tracking users through an “Android Advertising ID” without a valid legal basis. The data collected with this unique tracking ID is passed on to countless third parties in the advertising ecosystem. The user has no real control over it : Google does not allow to delete an ID, just to create a new one. Complaint filed against the Google Tracking (...)
#Google #Android #tracker #GPS #géolocalisation #[fr]Règlement_Général_sur_la_Protection_des_Données_(RGPD)[en]General_Data_Protection_Regulation_(GDPR)[nl]General_Data_Protection_Regulation_(GDPR) #publicité (...)
##[fr]Règlement_Général_sur_la_Protection_des_Données__RGPD_[en]General_Data_Protection_Regulation__GDPR_[nl]General_Data_Protection_Regulation__GDPR_ ##publicité ##NOYB
Facebook witness : 9 ½ hours of “we don’t know”
▻https://noyb.eu/en/facebook-witness-9-12-hours-we-dont-know
After more than 9 hours, the Vienna Regional Court for Civil Matters (LGfZRS) closed the oral hearing in the data protection case against Facebook. The judgement will be issued in writing within the next months. The witness of Facebook (Cecilia Alvarez) emphasized repeatedly that data protection on Facebook would be easy to understand – just to say that she did not understand what the platform does with the data whenever a concrete question was posed. If there was any answer, it was usually (...)
#Facebook #[fr]Règlement_Général_sur_la_Protection_des_Données_(RGPD)[en]General_Data_Protection_Regulation_(GDPR)[nl]General_Data_Protection_Regulation_(GDPR) #BigData (...)
##[fr]Règlement_Général_sur_la_Protection_des_Données__RGPD_[en]General_Data_Protection_Regulation__GDPR_[nl]General_Data_Protection_Regulation__GDPR_ ##CJUE
Complaint : Amazon doesn’t allow baseline TLS security
▻https://noyb.eu/en/complaint-amazon-doesnt-allow-baseline-tls-security
Baseline email security missing. During their route to the recipient, emails are handled by different entities, nodes and service providers which may intercept, manipulate and unlawfully use the content. In order to reduce these risks, it is a baseline industry standard to use so-called TLS encryption. Surprisingly the Amazon servers reject TLS connections in certain cases, for example when third party sellers on Amazon communicate with customers vie email. This means that millions of (...)
#Amazon #procès #[fr]Règlement_Général_sur_la_Protection_des_Données_(RGPD)[en]General_Data_Protection_Regulation_(GDPR)[nl]General_Data_Protection_Regulation_(GDPR) #écoutes (...)
##[fr]Règlement_Général_sur_la_Protection_des_Données__RGPD_[en]General_Data_Protection_Regulation__GDPR_[nl]General_Data_Protection_Regulation__GDPR_ ##SSL/TLS