Tech

  • Irish Data Protection Commission fines Meta €251 million

    Steve WoodsGDPR, Privacy, Security, Tech

    Irish DPC logoYesterday the Irish Data Protection Commission (DPC) announced its final decisions following two inquiries into Meta Platforms Ireland Limited (‘MPIL’). These inquiries were launched by the DPC following a personal data breach which was reported by MPIL in September 2018.

    New logo as Facebook morphs into MetaThis data breach involved some 29 million Facebook accounts around the world, of which approximately 3 million were based in the EU/EEA. The categories of personal data affected included: user’s full name; email address; phone number; location; place of work; date of birth; religion; gender; posts on timelines; groups of which a user was a member; and children’s personal data. The breach arose from the exploitation by unauthorised third parties of user tokens – i.e. coded identifiers that can be used to verify the user of a platform or utility, and to control access to particular platform features and to personal data of the user and their contacts – on the Facebook platform. The breach was remedied by MPIL and its US parent company shortly after its discovery.

    The DPC submitted a draft decision to the GDPR cooperation mechanism in September 2024, as required under the GDPR’s Article 60. No objections to the DPC’s draft decision were raised.

    The DPC’s final decisions list the following infringements of the GDPR:

    1. Decision 1
      1. Article 33(3) GDPR – By not including in its breach notification all the information required by that provision that it could and should have included. The DPC reprimanded MPIL for failures in regards to this provision and ordered it to pay administrative fines of €8 million.
      2. Article 33(5) GDPR – By failing to document the facts relating to each breach, the steps taken to remedy them, and to do so in a way that allows the Supervisory Authority to verify compliance. The DPC reprimanded MPIL for failures in regards to this provision and ordered it to pay administrative fines of €3 million.
    2. Decision 2
      1. Article 25(1) GDPR – By failing to ensure that data protection principles were protected in the design of processing systems. The DPC found that MPIL had infringed this provision, reprimanded MPIL and ordered it to pay administrative fines of €130 million.
      2. Article 25(2) – By failing in their obligations as controllers to ensure that, by default, only personal data that are necessary for specific purposes are processed. The DPC found that MPIL had infringed these provisions, reprimanded MPIL, and ordered it to pay administrative fines of €110 million.

    DPC Deputy Commissioner Graham Doyle commented as follows:

    “This enforcement action highlights how the failure to build in data protection requirements throughout the design and development cycle can expose individuals to very serious risks and harms, including a risk to the fundamental rights and freedoms of individuals. Facebook profiles can, and often do, contain information about matters such as religious or political beliefs, sexual life or orientation, and similar matters that a user may wish to disclose only in particular circumstances. By allowing unauthorised exposure of profile information, the vulnerabilities behind this breach caused a grave risk of misuse of these types of data.”

  • Rotten Apple claims DMA’s interoperability violates fundamental rights

    Steve WoodsOpen Source, Open Standards, Politics, Tech

    The Free Software Foundation Europe (FSFE) writes that interoperability – a key enabler of software freedom – is under serious threat in the EU from vested US technology interests.

    Apple, rotten to the core.Apple has initiated a legal battle against the European Commission to prevent third-party software developers from accessing essential software and hardware functions of Apple devices. The FSFE believes that control of interoperability should not at the discretion of companies like Apple.

    Consequently the FSFE is taking action, intervening in the EU’s action against Apple to defend interoperability and software freedom. The EU’s Digital Markets Act (DMA) imposes anti-monopoly obligations on very large companies like Apple (they are termed “gatekeepers” in the law. Ed.), forcing the likes of Apple to allow interoperability and granting access seekers (app stores, browsers, payment systems, etc.) free-of-charge access to its APIs. The law mandates the same level of interconnection enjoyed by Apple to third-party software developers – something which Apple is trying to avoid. Apple claims preposterously that interoperability in the DMA violates fundamental rights.

    In contrast, the FSFE argues that interoperability is a cornerstone of public interest in digital markets: interoperability ensures that users and developers have the freedom to choose and create solutions that best meet their needs, rather than being locked into a single environment controlled by a dominant market player like Apple. Free software solutions cannot compete with Apple ‘services’ without effective interoperability, as they are denied access to essential functions on Apple devices, resulting in poorer performance and functionality.

  • Schleswig-Holstein wants to continue switch to open source

    Steve WoodsLinux, Open Source, Open Standards, Politics, Tech

    Schleswig-Holstein coat of armsThe government of the German federal state of Schleswig-Holstein is doing further work to implement its aspiration “to consider digital sovereignty holistically” and to switch extensively to free software for its administration, German news site heise reports. Furthermore, it published a strategy (PDF) for “Open Innovation and Open Source” last Monday. The starting signal was the change to LibreOffice as the standard office suite from some 25,000 workstations in April. The new strategy describes the additional measures towards the envisaged “digitally sovereign IT workstation”. This accordingly includes switching to the +1.Linux operating system. This is described as a “suitable and professionally supported” distribution for public sector with a modern, easily adaptable interface.

    In its strategy paper, the government describes the switch to the open ODF (Open Document Format) file format, an open co-operation platform based on NextCloud, as well as Open Xchange groupware with email, calendar and address book as additional measures. In addition to these the plan for “digitally sovereign basic services and specialist services” and a suitable telephony system called Oskar (Open Source Communications Architecture).

    “As frictionless as possible”

    Microsoft Windows, Office, Teams & Co. will be a thing of the past. “The prerequisite for the widespread use of open source products is that the usual functionalities at least function reliably at the same quality,” emphasises Digital Minister Dirk Schrödter (CDU). “We will make the transition as smooth as possible for employees and support the well-planned migration process with training.”

    “Public administration would not be able to function today without smoothly working digital systems,” says Schrödter, promoting the migration. Authorities need “reliable IT components, the purchase of which guarantees freedom of choice, customisation options, competition and control over their own digital infrastructure.” Ensuring digital sovereignty is “at least as important as energy sovereignty”. It is also important to avoid a heavy dependence on proprietary providers.

    “Fundamental change in work culture”

    The state government also hopes for improved IT security, lower costs, more data protection and easier interaction between different systems. An earlier government had set a goal of “completely replacing” Microsoft & Co. in 2017, whilst the previous coalition backed off a bit in 2022, but stuck to the plan in principle.

    The conditions for a switch could hardly be better now, says Schrödter: “The clear trend towards collaborative, location-independent collaboration in the cloud offers a unique opportunity to take the path to digital sovereignty at a time when a fundamental change in work culture is already imminent.”

    Schleswig-Holstein sees the promotion of the regional digital economy as a modern form of industrial policy. “Instead of investing our IT funds in licence fees, we use them to finance development and support contracts,” explains Schrödter. Overall, this strengthens Schleswig-Holstein as a location.

    Other areas of action include the establishment of an Open Source Program Office (OSPO) in the state administration, a strengthening of the DigitalHub.SH, which is intended to connect offices and companies and a stronger focus on more participation via open government with independently verifiable hardware and software. The state also wants to participate in the German Administrative Cloud in order to join the German Centre for Digital Sovereignty (Zendis). The federal government is also pushing ahead with its own open source office suite, openDesk.

  • Tech meets tasty

    Steve WoodsLanguage, Oddities, Social Media, Tech

    First came the emoticon – pictorial representation of a facial expression using characters — usually punctuation marks, numbers and letters — as an adjunct to written language to express a person’s feelings, mood or reaction, without needing to describe it in detail. From the start of the 2000s, this was followed by the emoji, a pictogram, logogram, ideogram, or smiley embedded in text and used in electronic messages and web pages, likewise to express feelings, moods or reactions.

    Nowadays emojis are ubiquitous and not necessarily confined to electronic messages and web pages. They can be found on clothing, trinkets and, as your ‘umble scribe’s social media feed revealed at the weekend, baked goods. 😀

    Fruit biscuit with fruit resembling expression of disappointed emoticon/emoji

  • EU Commission fines Meta €797 mn.

    Steve WoodsPolitics, Privacy, Social Media, Tech

    Meta logoUS technology giants are finding out the hard way that their usual anti-competitive stateside business practices are frowned upon on this side of the Atlantic, particularly in the Berlaymont building in Brussels, headquarters of the EU Commision.

    A few months ago, X, the failing social media site formerly known as Twitter, was notified by the Commission that the latter was in breach of the Digital Services Act (DSA) in areas linked to dark patterns, advertising transparency and data access for researchers (posts passim).

    This week it was the turn of Meta, the parent company of Facebook

    This week the Commission announced it had fined €797.72 million for breaching EU ant-itrust rules by tying its online classified advertising service Facebook Marketplace to its personal social network Facebook and by imposing unfair trading conditions on other online classified advertising service providers.

    The Commission’s investigation found that Meta is dominant in the market for personal social networks, which covers at least European Economic Area (‘EEA’), as well as having national domestic markets for online display advertising on social media.

    In particular, the Commission found that Meta abused its dominant positions in breach of Article 102 of the Treaty on the Functioning of the European Union (‘TFEU’) by:

    • Tying its online classified advertising service Facebook Marketplace to its personal social network Facebook. This means that all Facebook users automatically have access and get regularly exposed to Facebook Marketplace whether they want it or not. The Commission found that competitors of Facebook Marketplace may be foreclosed as the tie gives Facebook Marketplace a substantial distribution advantage which competitors cannot match; and
    • Unilaterally imposing unfair trading conditions on other online classified advertising service providers who advertise on Meta’s platforms, in particular on its very popular social networks, Facebook and Instagram. This allows Meta to use ad-related data generated by other advertisers for the sole benefit of Facebook Marketplace.

    The Commission has ordered Meta to bring the conduct effectively to an end and to refrain from repeating the infringement or from adopting practices with an equivalent object or effect in the future.

    The fine of €797.72 million was set on the basis of the Commission’s 2006 guidelines on fines.

    In setting the level of the fine, the Commission took into account the duration and severity of the infringement, as well as the turnover of Facebook Marketplace to which the infringements relate and which therefore defines the basic amount of the fine. In addition, the Commission considered Meta’s total turnover, to ensure sufficient deterrence for a company with resources as significant as Meta’s.

    Margrethe Vestager, Executive Vice-President in charge of competition policy, said: ” Today we fine Meta €797.72 million for abusing its dominant positions in the markets for personal social network services and for online display advertising on social media platforms. Meta tied its online classified ads service Facebook Marketplace to its personal social network Facebook and imposed unfair trading conditions on other online classified ads service providers. It did so to benefit its own service Facebook Marketplace, thereby giving it advantages that other online classified ads service providers could not match. This is illegal under EU anti-trust rules. Meta must now stop this behaviour.”

  • Torvalds ignores AI hype

    Steve WoodsLinux, Open Source, Tech

    Linus Torvalds headshotLinus Torvalds, the creator and lead developer of the Linux kernel, has been speaking about Artificial Intelligence, according to The Register; and he’s not impressed by what he has witnessed to date.

    Speaking at the Open Source Summit in Vienna last month, Torvalds was asked for his views on modern technologies, specifically Generative Artificial Intelligence, usually abbreviated to GenAI.

    His reply included the following remarks:

    “I think AI is really interesting and I think it is going to change the world and at the same time I hate the hype cycle so much that I really don’t want to go there, so my approach to AI right now is I will basically ignore it.

    I think the whole tech industry around AI is in a very bad position and it’s 90 percent marketing and ten percent reality and in five years things will change and at that point we’ll see what of the AI is getting used for real workloads.

    His remarks about the hype cycle are particularly relevant. Those with very long memories will remember the Dot-com bubble of the late 1990s and early two thousands, while those with less of a broad sweep of time may recall the more recent episode of overwhelming enthusiasm generated by the marketing of so-called cloud computing, about which the FSFE was particularly blunt in its opinion (posts passim) – just other people’s computers.

  • Font for fascism

    Steve WoodsLanguage, Politics, Tech

    Convicted serial offender and fascist Stephen Yaxley-Lennon, who for some inexplicable reason prefers to be called Tommy Robinson, has brought out a book with the help of a ghost writer Peter McLoughlin.

    For a day the book entitled Manifesto was top of Amazon UK’s best-seller chart, according to The Guardian, is is currently unavailable on Amazon’s website.

    Cover of Manifesto written by Peter McLoughlin with interference from Stephen Yaxley-Lennon

    Whilst the cover looks like the flag of St George folded in half, the text below the title dubiously claims the book deals with Free Speech, Real Democracy and Peaceful Disobedience, whilst what Yaxley-Lennon and his supporters indulge in is freedom to be racially prejudiced, fascism and violent disorder, as the media have duly reported down the years.

    However, the most salient feature of the cover that caught your correspondent’s eye was that the title and the names of the book’s authors were all written in the Comic Sans font.

    This friendly sans serif font is popular in place like primary schools due inter alia to its assumed legibility. This font, termed notorious by none other than the BBC, has also been in existence for 30 years this year.

    However, the font has not proved universally popular, as is imparted by its Wikipedia page.

    Film producer and The New York Times essayist Errol Morris wrote in an August 2012 posting, “The conscious awareness of Comic Sans promotes—at least among some people—contempt and summary dismissal.” With the help of a professor, he conducted an online experiment and found that Comic Sans, in comparison with five other typefaces (Baskerville, Helvetica, Georgia, Trebuchet MS, and Computer Modern), makes readers slightly less likely to believe that a statement they are reading is true.

    Contempt and summary dismissal are both apposite to anything that comes out of Yaxley-Lennon’s mouth, from his pen (or in his case crayon. Ed.) keyboard or camera.

  • CMA objects to Google’s anti-competitive ad tech practices

    Steve WoodsMedia, Politics, Tech

    Google logoThe Competition and Markets Authority (CMA) has announced today its provisional finding provisionally that Google has abused its dominant positions through the operation of both its publisher ad server and buying tools to restrict competition in the UK.

    The provisional findings relate to how Google gives precedence to its own ad exchange – harming competition and, as a result, advertisers and publishers.

    This action in the UK parallels the actions of US and EU agencies which are also investigating similar concerns in respect of the search behemoth.

    As set out in a statement of objections issued to Google on Friday 6th September, the CMA has provisionally found that when placing digital ads on websites, the vast majority of publishers and advertisers use Google’s ad tech services in order to bid for and sell advertising space.

    The CMA is concerned that Google is actively using its dominance in this sector to give precedence its own services. In so doing, Google disadvantages competitors and prevents them competing on a level playing field to provide publishers and advertisers with a better, more competitive service that supports growth in their business.

    In its 2019 market study of digital advertising, the CMA found that advertisers were spending around £1.8 billion annually on open display ads, marketing goods and services via apps and websites to UK consumers.

    The CMA has found provisionally that, since at least 2015, Google has abused its dominant positions through the operation of both its buying tools and publisher ad server in order to strengthen AdX’s market position and to protect its AdX advertising exchange from competition from other exchanges. Moreover, due to the highly integrated nature of Google’s ad tech business, the CMA has provisionally found that Google’s conduct has also prevented rival publisher ad servers from being able to compete effectively with DFP, harming competition in this market.

    Online advertising process
    Overview of the ad tech stack, key intermediaries and Google’s ad tech products

    This practice is still continuing, according to the CMA. The Authority is therefore considering what may be required to ensure that Google ceases these anti-competitive practices and do not do the same or similar in the future.

    The CMA may impose a financial penalty on any business found to have infringed the Chapter II prohibition of up to 10% of its annual worldwide group turnover.

  • New point release for LibreOffice 24.2

    Steve WoodsLinux, Open Source, Open Standards, Privacy, Tech

    The blog of The Document Foundation (TDF) has today announced the sixth point release of LibreOffice 24.2 for Linux MacOS and Windows, which it is describing as “the best choice for privacy-conscious users and digital sovereignty“.

    LibreOffice 24.2.6 banner

    This point release includes over 40 bug and regression fixes over LibreOffice 24.2.5 to improve the software’s stability, plus interoperability with legacy and proprietary document formats. LibreOffice 24.2.6 is aimed at mainstream users and business environments.

    LibreOffice for business

    For business use, TDF strongly recommends the LibreOffice Enterprise family of applications from ecosystem partners with a range of dedicated value-added features, long-term support and other benefits such as SLAs.

    Next week, power users and technology enthusiasts will be able to download LibreOffice 24.8.1, the first minor release of the recently announced new version with many bug and regression fixes.

    As per usual, LibreOffice users, free software advocates and community members are invited to support The Document Foundation with a donation.

    Download LibreOffice 24.2.6. Please note that the minimum requirements for proprietary operating systems are Windows 7 SP1 and macOS 10.15.

  • US firm fined by Dutch for illegal facial recognition data gathering

    Steve WoodsGDPR, Privacy, Security, Tech

    Autoriteit Persoonsgegevens logoThe Dutch Autoriteit Persoonsgegevens (Personal Data Protection Authority) has announced today that it has imposed a fine of €30.5 mn. on the US company Clearwiew AI, as well as a non-compliance penalty in excess of €5 mn.

    Stylised facial recognitionClearview is an American company that offers facial recognition services, which has, inter alia, built up an illegal database with billions of photos of faces, including those of Dutch citizens. Furthermore, the authority has warned that using the services of Clearview is also prohibited.

    Clearview offers facial recognition services to intelligence and investigative services. Moreover, Clearview customers can provide camera images to find out the identity of people shown in the images. To this end, Clearview has a database with more than 30 billion photos of people, which it has scraped automatically from the internet and then converted into a unique biometric code per face, all without the knowledge and consent of its victims.

    According to the authority’s chair Aleid Wolfsen, “Facial recognition is a highly intrusive technology, that you cannot simply unleash on anyone in the world. If there is a photo of you on the internet – and doesn’t that apply to all of us? – then you can end up in the database of Clearview and be tracked. This is not a doom scenario from a scary film. Nor is it something that could only be done in China. This really shouldn’t go any further. We have to draw a very clear line at incorrect use of this sort of technology.’

    Clearview says that it provides services to intelligence and investigative services outside the European Union (EU) only.

    Clearwiew’s services illegal and in breach of the the GDPR

    Clearview has seriously violated the privacy law General Data Protection Regulation (GDPR) on several points: the company should never have built the database and is insufficiently transparent. It should never have built the database with photos, the unique biometric codes and other information linked to them. This especially applies to the codes. Like fingerprints, these are biometric data. Collecting and using them is prohibited. There are some statutory exceptions to this prohibition, but Clearview cannot rely on them.

    Clearview is an American company without an established presence n Europe. Other data protection authorities have already fined Clearview on various earlier occasions, but the company has not changed its conduct. For this reason the Dutch regulator is investigating ways to ensure the violations stop, including whether the company’s directors can be held personally liable for data protection violations.

    Wolfsen: ‘Such [a] company cannot continue to violate the rights of Europeans and get away with it. Certainly not in this serious manner and on this massive scale. We are now going to investigate if we can hold the management of the company personally liable and fine them for directing those violations. That liability already exists if directors know that the GDPR is being violated, have the authority to stop that, but omit to do so, and in this way consciously accept those violations.’

    Clearview has not objected to the decision and is therefore unable to appeal against the fine.