Legal sources to go through

baltpeter commented 9 months ago

We want to have a comprehensive overview of complaints, court submissions, decisions, recommendations, and legal commentary regarding tracking and especially IDs.

This issue lists the sources that I want to go through.

baltpeter commented 9 months ago

[x] LG Berlin, Urteil vom 15.06.2023, Az. 93 O 167/20 (GRUR-RS 2023, 22723), https://www.vzbv.de/urteile/einsatz-von-cookies-auf-weltde-war-unzulaessig
[ ] ~~https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2023-012&mtc=today~~
[x] https://www.vzbv.de/urteile/einsatz-von-tracking-cookies-auf-focusde-war-rechtswidrig

baltpeter commented 9 months ago

[x] Stellungnahme 4/2007, WP 136, 01248/07/DE der ehemaligen Art. 29-Datenschutzgruppe zum Begriff „personenbezogene Daten“ S. 16 f
[ ] EDSB in seiner Entscheidung vom 5. Jänner 2022, GZ: 2020-1013

"Zwar hat der EDSB die Verordnung (EU) 2018/1725 anzuwenden, die bei der Datenverarbeitung durch die Organe, Einrichtungen und sonstigen Stellen der Union gilt. Da Art. 3 Z 1 der Verordnung (EU) 2018/1725 der Definition von Art. 4 Z 1 DSGVO entspricht, können diese Überlegungen aber ohne weiteres auf den gegenständlichen Fall übertragen werden."

baltpeter commented 9 months ago

[ ] WP29, Opinion 16/2011 on EASA/IAB Best Practice Recommendation on Online Behavioural Advertising, p. 5
[ ] WP29, Opinion 2/2013, p. 5-6 and WP29, Opinion 05/2014 on Anonymisation Techniques, pp 11-12;

baltpeter commented 9 months ago

Most important notes and learnings so far:

We should have a paragraph for each tracker (/adapter?), explaining what it does and what purposes it is marketed for. (https://hypothes.is/a/HvvGwl3cEe6MaRfvDjISnQ, https://hypothes.is/a/9Y0UvmZxEe6XkjccAZ1DCA, https://hypothes.is/a/ZJso1HFvEe6bM1O39Eybxw)
- This should especially reference tracker documentation that itself mentions consent requirements. (https://hypothes.is/a/_rpwNl3eEe6BcsNMdl7yzg)
- Even some DPA decisions and court rulings include such context. (https://hypothes.is/a/IQah3F3kEe6ptQ-fawEwhw, https://hypothes.is/a/hezJal38Ee6_m8ObbkRx9Q, https://hypothes.is/a/Nf0l2F6jEe64XwuwOhdqew, https://hypothes.is/a/XV8EzmD8Ee6ktfcrlNTsDQ, https://hypothes.is/a/2b7NmHJdEe6rPg9uic72zg)
- The DPA of Hesse used a visualisation in a court case that the court found convincing. (https://hypothes.is/a/ibCE9mNREe6P6tNKEYEwng) I guess we could also prepare some general visualisations and include them in the complaints?
Even though I personally don't particularly like this argument, most decisions mention the IP address as (one) argument as for why data transmitted to a tracker is personal data. We should probably mention that too, then. (https://hypothes.is/a/oTjS3F3YEe6w2pv3sdcRZg, https://hypothes.is/a/7p03mF3TEe6NAg9emYC-Qg, https://hypothes.is/a/Zz_g6l6jEe6vGcea7VLNDA, https://hypothes.is/a/g3YWhmZtEe6xbp_SkD0L8g, https://hypothes.is/a/2jmTlnGDEe6Fu9vMK0REXg)
- In one court case, the DPA of Hesse argued that a cookie ID was only personal data in combination with a (full) IP address. (https://hypothes.is/a/ttNGbGNREe6mNEOUNSYVnA) The court agreed.
While some DPAs share our opinion that IDs alone are already personal data, others say that the IDs only become personal data in combination with the other data that is processed (IP address and/or fingerprinting information). (https://hypothes.is/a/ttNGbGNREe6mNEOUNSYVnA, https://hypothes.is/a/sHDY7GZtEe6isFelEihsGA)
According to Art. 7(1) GDPR, it is the controller's burden to prove that consent was given. (https://hypothes.is/a/Gc-bOl3fEe6qeecvEoxBtQ, https://hypothes.is/a/DBQpbHFwEe6CNbNH6jr_8Q) In fact, according to Art. 5(2) GDPR and Art. 24(1) GDPR, the controller has the burden to prove that all their processing is in line with the GDPR (confirmed by ECJ in C-175/20). (https://hypothes.is/a/o13h1mN1Ee6Bi9_Eaq5wcQ, https://hypothes.is/a/2XJphmZyEe6-DacNqArVHA, https://hypothes.is/a/CyCFJmZzEe6Pyh-a9O1VuA, https://hypothes.is/a/zM4PiGaUEe6Bnk8NajdkLQ, https://hypothes.is/a/vZMKcnF7Ee6mLnuj7sUeXw)
- In a decision on Google Analytics, the CNIL put the burden of proof on establishing that an ID is anonymous on the controller. (https://hypothes.is/a/tAGIpF38Ee6Xaoeshuo4rg)
Our complaints should also reference Art. 25 GDPR (data protection by default and by design). (https://hypothes.is/a/YHXvYl3fEe6G-CNQbEoWqQ)
Looking at tracker and/or website privacy policies might be a good method to establish certain IDs as a) IDs and b) personal data.
In decisions and judgements, arguments for why an ID is personal data, are often pretty thin and basic. (https://hypothes.is/a/7p03mF3TEe6NAg9emYC-Qg, https://hypothes.is/a/tMoVcl3YEe61QXsKVwPLPw, https://hypothes.is/a/hnC78mNXEe6vQg_wnTCksw)
IMY mentions important context on the Breyer judgement: "The Breyer judgment was decided under the previously applicable directive 95/46 and the concept of "singling out" according to recital 26 of the current regulation (that knowledge of the actual visitor's name or physical address is not required, since the distinction itself is sufficient to make the visitor identifiable), was not specified in previously applicable directives as a method for identifying personal data." (https://hypothes.is/a/8DHNvmZuEe6caRMsftERrQ)

baltpeter commented 9 months ago

[x] Kühling/Buchner, DSGVO·BDSG3, Art. 4
[x] Taeger/Gabel, DSGVO·BDSG·TTDSG, Art. 4
[x] Kargl in Simits/Hornung/Spiecker, Datenschutzrecht, Art. 4
[x] Taeger/Gabel/Ettig, 4. Aufl. 2022, TTDSG § 25
[x] Ehmann/Selmayr/Heckmann/Paschke, 2. Aufl. 2018, DS-GVO Art. 7
[x] Schantz/Wolff, Das neue Datenschutzrecht, Rn. 292ff. (laut Taeger zustimmend zu IDs als personenbezogenen Daten)

baltpeter commented 8 months ago

[x] https://uitspraken.rechtspraak.nl/#!/details?id=ECLI:NL:RBAMS:2023:6530 (via)

baltpeter commented 1 week ago

Between https://www.datarequests.org/blog/tracking-id-personal-data/ and https://github.com/tweaselORG/ReportHAR/releases/tag/v0.1.0, this is now done.

tweaselORG / meta

Legal sources to go through #38