
EU parliaments website in violation of GDPR - mgliwka
https://medium.com/matthias-gliwka/eu-parliament-websites-violates-gdpr-200eb2c00e8f
======
deanclatworthy
How is this news? Everyone is scrambling to be GDPR-compliant before the due
date. Probably the people behind this site also.

~~~
candiodari
Well, if the intent behind the legislation was to protect personal data,
presumably they would have modified their own behavior before regulating.

But they haven't. Makes things clear.

They also control the enforcement mechanism. Let's see if they will modify it
to save face or if they'll just ignore it. Or do you think they'll fine the
parliament (not that they haven't exempted themselves, of course) ?

~~~
Tharkun
You're making the incorrect assumption - deliberately, I presume - that the
people writing the legislation have anything to do with how the website
operates. You're wrong, of course. The EU(P) is a very large and very complex
organization, just like many multinationals.

Should they eat their own dog food? Probably. But pretending there's some kind
of hypocrisy going on is stretching it.

~~~
candiodari
Well my opinion is that the EU shouldn't exist. A non-democratic state
controlling democratic states seems to me to be a spectacularly bad idea. But
I'm a consultant and I've worked and work for these people, mostly indirectly.

Let me assure you: there is absolutely no shortage of hypocrisy. You don't
need anything more than to walk around their offices and ask what all those
weird marking on public and private spaces mean. You'll be disgusted, and
cured of any notion that the EU intends to do anything for anyone but
themselves.

But outside of that, there are clear personal status cult being upheld
everywhere around the European organisations, with the biggest distinction
between the "fonctionnaires" and everybody else (although as an employee of
the commission you're still several rungs above "les gens de la rue" (which
does not mean homeless, like in France, it just means normal people of
Brussels). And may God help you if you're working for ISS or any of the
cleaning companies. At that point your status is so low that people routinely
throw things at you just to cool their frustration. This is accepted and
normal behavior, despite how incredibly immoral it is.

(The "European quarter" of Brussels has a ton of public and private spaces,
from "public" parks to a small shopping center (with mostly cafes), and the
highly coveted parkings and parking spaces that are reserved, by law, for
European officials' use only. So does Woluwe, even if they're a lot better
hidden there. To say that these people have no intention to use their power to
improve people's lives is absurd when you walk around their offices)

~~~
tscs37
> A non-democratic state controlling democratic states seems to me to be a
> spectacularly bad idea. But I'm a consultant and I've worked and work for
> these people, mostly indirectly.

The EU isn't a state it's a union of states and there is EU elections
happening.

~~~
candiodari
EU elections aren't selecing the people who make laws. That's the commission
and the EU council.

By that standard the Soviet Union, China and Saudi Arabia are/were democratic
too. They all have/had elections. Elections that do not determine who has
legislative and executive power are not elections.

The reason why is of course simple. People in member states do not care about
the EU. They care about local politics 99% of the time. On top of that member
states electorates do not agree on the issues. Not on what the issues are in
the first place and certainly not on what is to be done about them. There is
no way for politicians to campaign across the EU, it's all done locally.
Therefore the assessment of most fonctionnaires in Brussels is probably
correct: there is no way to have an effective democratic EU. They also asses
that they don't want to do that, as it would not be a unifying force.

[1]
[https://en.wikipedia.org/wiki/Elections_in_the_Soviet_Union](https://en.wikipedia.org/wiki/Elections_in_the_Soviet_Union)

[2]
[https://en.wikipedia.org/wiki/Elections_in_China](https://en.wikipedia.org/wiki/Elections_in_China)

[3]
[https://en.wikipedia.org/wiki/Elections_in_Saudi_Arabia](https://en.wikipedia.org/wiki/Elections_in_Saudi_Arabia)

------
belorn
Reading the GDPR text shows there is a bunch of exceptions for which storing
of example IP-addresses can be done without anonymizing or consent, with one
of the more clear cut being security. If the processing is done exclusively
for security purpose then the site can argue in court that they are in
compliance.

Compliance with the law is always about context. What is gathered, why and how
is it used, and last is there additional factors to consider. Google Analytics
in itself is interesting because it is not clear if Google themselves then
process the data and for what use, especially for the enterprise version.

~~~
hartator
Google Analytics is not a security tool. You can’t even see what an specific
IP has been doing.

~~~
michaelbuckbee
The issue isn't that _you_ can't see what a specific IP is doing, but Google
certainly can, and it's more than that.

The GDPR really spells out that you can't ask for consent / basis to do one
thing and then flip around and do more with it.

Aka, if you consent to signing up for a newsletter they can't turn around and
sell your email to another list, take that list to their next startup that's
unrelated, etc.

For Google this gets tricky, you're consent to using them for analytics (most
everyone on the free, non enterprise, version). Are they also using that to
feed their search engine? Tweak display ads? Check for fraud? Build profiles
of people across sites/browser sessions, and devices?

And while this is about analytics, the same can be said for Maps, Docs,
Domains, Fonts, etc. all of which have a primary use and (for Google) a stack
of juicy secondary uses they can make money off of. Most of it doesn't even
strike me as nefarious (it seems reasonable that they'd index pages that come
up in Google analytics), but it's not disclosed so nobody is exactly sure
what's being done.

Even this anonymize IP business is tricky b/c:

1\. They still get the IP as surely as you browsing to www.google.com 2\. They
may be tracking in other ways (fingerprinting, cookies, etc.) that unique
identify you, so does it matter?

~~~
candiodari
> The GDPR really spells out that you can't ask for consent / basis to do one
> thing and then flip around and do more with it.

That's not how reality works. Laws, despite god knows how many attempts, don't
change that. If you have the information, you can use it.

> Aka, if you consent to signing up for a newsletter they can't turn around
> and sell your email to another list, take that list to their next startup
> that's unrelated, etc.

Ok. When the spam problem stops, I'll believe this. Until then, I reserve
judgement.

> For Google this gets tricky, you're consent to

Sure, but with a chunk of their operating expenses ($9 billion a year) spent
on lawyers ... tricky is not a problem. For everyone else, it is.

It gives them a legal way to destroy any company they don't like, it's a land-
grab for both their own jurisdiction (as opposed to member nations'
jurisdictions), it's land-grab for global jurisdiction, it's a (partial)
denial of private contracting rights and it's explicitly designed for
selective enforcement.

What more could one want in a big new law ?

~~~
frockington
Your points made me think that this law is likely just going to solidify
market monopolies and ensure competition can't exist legally, similar to large
banks in the US

~~~
candiodari
Well, yes. However, we should look at illegally: it's going to make it much
easier for sites to exist in areas where there won't be any enforcement. So
it's going to kill European sites, not anything else.

Effectively European companies below a certain size can't allow for forums
anymore.

Obviously this will impact things like newspaper forums, tech support, webfora
on specific topics, ...

------
tephra
I don't have the text in front of me but I'm pretty sure there is an exception
for member states government agencies (if they choose to have the exception).
I wouldn't be surprised if this covers EU agencies and institutions as well.

~~~
mgliwka
They're excluded from the fines, but not from the regulation itself.

------
PunchTornado
I thought IPs are not considered personal identifiable information.

~~~
muro
Yes it is - it's in the FAQ:

[https://www.eugdpr.org/gdpr-faqs.html](https://www.eugdpr.org/gdpr-faqs.html)

What constitutes personal data?

Any information related to a natural person or ‘Data Subject’, that can be
used to directly or indirectly identify the person. It can be anything from a
name, a photo, an email address, bank details, posts on social networking
websites, medical information, or a computer IP address.

~~~
wtfstatists
I like this definiton better. IANAL Warning.

Personal Data:

    
    
      - PII is Personal Data.
    
      - If a user has PII, then all of the userdata is Personal Data.
    

So HN posts would not be Personal Data for the users that have email field
empty. And even email (and any other user-entered data) can be made non-PII if
ToU explicitly required to be so.

My advice would be to legally and technically isolate PII and other_userdata.
GDPR/etc compliance become quite easier this way.

~~~
dogma1138
ToU don’t change what PII is or isn’t under the GDPR.

The GDPR also states that consent alone isn’t a legal reason to collect or
process PII and “advises” against relying and structuring terms of service to
collect PII.

Basically you can’t build a service ask people for their data and then relying
on their consent for the legal reasoning of having that data. You need an
actual legal basis e.g. a regulatory requirement or a business requirement to
collect that data, and in all cases the requirements unless stated in law must
be evaluated against the best interests of those you collect data from.

~~~
wtfstatists
> ToU don’t change what PII is or isn’t under the GDPR.

ToU can by prohibiting user from entering any PII. In case of email, ToU would
say that only non-identifying email can be used.

For the rest of your comment, I dont see any relevance here. There is no need
for consent for non-PII userdata. All PII userdata is behind legal and
technical wall and cannot be accessed by the processor/controller of non-PII
userdata.

~~~
dogma1138
There is no such thing as a “non-identifiable” email. You cannot use ToU to
bypass GDPR.

~~~
wtfstatists
Ok here is my email: 1373f84998986cf8@tutanota.com. Identify me! Know that I
wont used the email elsewhere.

> You cannot use ToU to bypass GDPR.

Just to clarify this is not buried in ToU but laid out clearly.

So the website says dont give PII. User still does. And GDPR would penalize
the website ? Citation please.

~~~
dogma1138
Are you serious? the fact that your email isn't yourname@mailprovider.com
doesn't make it any less identifiable. My IP address is 192.168.1.1 identify
me... It also doesn't matter if you think the information is identifiable or
not what matters is how the GDPR defines it.

The GDPR defines PII and there isn't anything you can do about it you can't
ask users to make a throwaway email account and hope that you can pass GDPR by
claiming that it's not PII this isn't how regulation works.

What matters isn't that the email address reveals your name is that someone
can use it to identify additional information about you such as if you are
subscribed to a specific service or not.

>So the website says dont give PII. User still does. And GDPR would penalize
the website ? Citation please.

If the website asks for an email address that is PII under the GDPR.

~~~
wtfstatists
IP is not a user-entered data and cannot be freely selected, unlike email
addresses.

> the fact that your email isn't yourname@mailprovider.com doesn't make it any
> less identifiable.

The only official guidelines about email I could find are in here [1]. It does
not say all email addresses are PII. It just says "name.surname@company.com"
type addresses are PII and "info@company.com" type addresses are NOT PII. So
even "yourname@mailprovider.com" may be non-PII.

> someone can use it to identify additional information about you such as if
> you are subscribed to a specific service or not.

Thats not enough. The service need to have PII. That is, if none of the
services has PII, the email address is not PII.

> you can't ask users to make a throwaway email account

Throwaway is not needed. At best an individual need 2 email accounts. One
address for the services where he is identified (eg bank website) and one
address for where he is not (eg random forum).

So this is not an onerous condition at all. If thats the case you are making.

> If the website asks for an email address that is PII under the GDPR.

This is not a (official) citation.

[1] [https://ec.europa.eu/info/law/law-topic/data-
protection/refo...](https://ec.europa.eu/info/law/law-topic/data-
protection/reform/what-personal-data_en)

------
adamsurak
They'll use legitimate interest as a reason.

------
repolfx
This is a reasonable observation but I doubt anyone will care. Moreover it
misses the point of GDPR.

The goal is not to improve people's privacy. It's too vague to achieve that.
Obviously the EU doesn't care as even its own websites aren't in compliance -
assuming this guy's definition of compliance is the same as theirs. How likely
is it the rest of the EU's operations are? Zero likelyhood of that.

But that's OK. GDPR doesn't even have a concrete notion of what privacy or
personal information actually are. The goal is not to improve privacy, that's
just a fig leaf. The goal is to grant the EU large new powers over the private
sector and in particular over American tech firms, who will repeatedly be
fined and treated as, effectively, a new source of tax income. GDPR is so
vague and open ended that there's no way they can ever be compliant, meaning
the EU has a new source of cash for years to come. Very useful at a time when
they are asking for budget _increases_ despite years of austerity, and facing
a budget hole due to Brexit, _and_ member states are getting upset at their
financial demands.

GDPR enforcement will be very similar to EU anti-trust policy - deeply
political and immediately controversial. It is best understood not as a law
but as a political move, sort of like how China uses laws against pornography
to justify blocking foreign search engines, or how it uses a law against
'spreading rumours' to censor domestic social media.

~~~
yulaow
This is stupid, if they wanted to give the finger to American tech firms they
could have wrote the GDPR as affecting only foreign firms using EU citizen
data without requiring the same level of control over the EU-based tech firms,
far easier.

~~~
frockington
Are there any EU based tech firms? As an American I honestly can't think of
any besides Nokia and that's more manufacturing

~~~
diggan
Makes sense, as Americans tend to live in a bubble :)

Some of them from the top of my head, that you might or might not recognize:
Asos, JustEat, Skyscanner, SoundCloud, LastFM, DailyMotion, Raspberry PI
(foundation more than company though), Shazam, Mojang, Skype, King, Spotify,
Klarna, Trivago, Xing and BlaBlaCar. I'm pretty sure some of these are quite
popular in even the US.

(maybe some of them are not having their HQ in EU anymore, but they certainly
had at one point)

~~~
repolfx
You probably shouldn't insult Americans and then make statements you already
know to be erroneous.

As you are apparently well aware, Skype is owned by Microsoft. It's an
American product now (from the perspective of who pays any fines). Mojang sold
to Microsoft. It and Minecraft are owned by the Americans now.

Asos is an online fashion and beauty retailer. Having a website doesn't make
you a tech firm. Ditto for JustEat.

Raspberry Pi - as you note - isn't even a firm at all, let alone a tech firm.

Shazam is in the process of being bought by Apple, although the EU appear to
be trying to block it.

You tried to name tech firms that are based inside the EU and mostly ended up
listing firms that either aren't tech firms by any conventional definition, or
are now owned by US companies. I think that proves the original point.

~~~
diggan
The companies started out being non-american, then they ended up being bought
up by US companies. I don't think that says "there is no EU based tech firms"
but rather "There are EU based tech firms! But some of them get bought up by
US companies and some stay, but at one point they were all EU based". So
doesn't at all prove the original point.

~~~
repolfx
In context it is equivalent. This thread is about why the EU wouldn't write a
law that only affects US based tech firms, if that was the intention. Someone
answered that there's no need because there are no EU based tech firms worth
anything (no significant employment or tax revenue).

That point was correct. The responses all ended up naming either firms that
are tiny, or which aren't any longer based in the EU (so there's no need to
protect them from the effects of bad laws that primarily affect tech firms).
Where they _started_ is irrelevant to the discussion because what matters is
_who pays fines today_.

