http://www.dn.no/tekno/2013/02/03/amerikanerne-kan-se-hvert-ord-du-skriver
https://firstlook.org/theintercept/2015/07/01/nsas-google-worlds-private-communications/
+
+
+
+anyway, while I have you on the line. I wonder about british privacy law. in norway, it is required to have a data handling agreement in place before asking others to handle personal information on your behalf. are there similar laws in Britain?
+Sat 11:02 AM
+the background is to figure out if alaveteli/whatdotheyknow use in UK require an agreement with google when passing the users IP address to google to fetch javascripts for required functionallity (the captcha and the javascript pdf viewer). I suspect it is required here in Norway, and hope it is required in UK too, to raise the priority of avoiding the google dependency for the core developers. :)
+Sat 11:05 AM
+Very interesting.
+Sat 11:19 AM
+Yes, that requirement exists, but they won't care, because the U.K. ICO will never get on their case for this.
+Sat 11:19 AM
+In general first party websites are responsible for ensuring their whole systems are compliant with data protection laws and can satisfactorily perform all the required actions attached to this.
+Sat 11:21 AM
+There are different means to ensure that, and one of them is an explicit agreement eteeen the two parties.
+Sat 11:22 AM
+Most websites however when you contact them for that issue claim they are compliant and refer to what Google forces them to add to their own privacy policy.
+Sat 11:22 AM
+In effect, Google lawyers have figured out a way to make all those websites complicit: the language added covers the processing done by the website, not that done by Google. But the website is still liable for the processing done by Google.
+Sat 11:24 AM
+So you have to actively show to the website they are failing in their legal duty.
+Sat 11:24 AM
+There is a neat way to do this: access requests.
+Sat 11:24 AM
+(Before I get into Access Requests, it could be argued this extra language in the privacy policy, or the agreement the website has with G is the agreement itself)
+Sat 11:26 AM
+(it could be, as long as it ensures all rights can be respected, including access)
+Sat 11:27 AM
+So the only active tool you have to create the problem is "Access": Ask the website for the data collected by Google through the use of the website. This works especially if the website requires identification and stores Google Analytics values as 1st party cookie. No excuse then.
+Sat 11:27 AM
+Then the website has to somehow find Google, contact them, argue that G respect local laws, etc. G will not bulge. And then, you are good: either the website stops using GA, or they *knowingly* keep on using an illegal service. That's a good basis for a local complaint.
+Sat 11:30 AM
+The wonderful thing is that this scales really really well. And it's also the best way to make adtech more transparent.
+Sat 11:31 AM
+I was thinking of using that strategy with newspapers as first parties, not FOI sites though. :)
+Sat 11:31 AM
+right. was planning to ask for a copy of the agreement with google, which is the approach that has proven slightly effective here in Norway.
+Sat 11:40 AM
+You saw my comment on Mimesbronn about this, right?
+Sat 11:40 AM
+do not remember it, at least. the messages on mimes brønn get in faster than I manage to read them. ~300 messages in my backlog. :)
+Sat 11:41 AM
+I have tried the same with government authorities in Belgium and Switzerland. No one respects the law.
+Sat 11:41 AM
+Right. But there was specific request for Google Analytics stuff.
+Sat 11:41 AM
+If you want I can add any website you wish to PersonalData.IO
+Sat 11:42 AM
+I had some success in <URL: https://www.mimesbronn.no/request/personopplysninger_til_google_sk_2 >, but this was google forms, not google analytics.
+Sat 11:42 AM
+I think that's the one, yes.
+Sat 11:42 AM
+google analytics is going to be a harder nut to crack, as very few understand how it work and that it actually is collecting personal information.
+Sat 11:42 AM
+Google claims it doesn't.
+Sat 11:43 AM
+Can you partner on this with Norwegian consumer org, for them to link with other consumer orgs? That's actually part of what I wanted to talk with Aftenposten.
+Sat 11:43 AM
+well, the norwegian privacy agency (datatilsynet) have decleared IP address to be personal information, so it is hard to get away with such claim...
+Sat 11:43 AM
+No, because Google will claim they don't keep the IP. They only keep part of IP.
+Sat 11:44 AM
+Of course they don't tell you what else they keep. And the whole point of the system is to track people of course.
+Sat 11:44 AM
+How likely is all this to interest people on Tuesday, if I frame it a bit wider?
+Sat 11:45 AM
+the norwegian consumer agencies are using Google Analytics too, so I suspect it will be hard for them to take on the case..
+Sat 11:45 AM
+Right. Then ask them for your data.
+Sat 11:45 AM
+no idea who show up, so I do not know what will interest them. :)
+Sat 11:46 AM
+Seriously this is the best way to force them to look at the law.
+Sat 11:46 AM
+good idea.
+Sat 11:46 AM
+You don't make friends that way though...
+Sat 11:46 AM
+But it is crucial for new forms of journalism and understanding of very complex tools that, as we see, are new forms of power.
+Sat 11:47 AM
+that do not worry me. I follow up several threads in parallell, but my capacity is limited with full time job and kids in the house. :) One thread is google forms use, where I have some limited success. another is iOS copyright terms in schools, where Apple claim the right to collect personal information and the school authority claim it do not apply, and a third is the use of google analytics in 70% of the norwegian web sites.
+Sat 11:49 AM
+In Europe you can also ask for "logic of processing" which would include details on how the third party processes data on behalf of the first party.
+Sat 11:49 AM
+(Details they of course don't have)
+Sat 11:49 AM
+Europa as in EU?
+Sat 11:49 AM
+Yes, EU.
+Sat 11:50 AM
+Okay, for focusing but make it personal too: ask for your data from those sites as well, as it will make the issue of noncompliance clearer.
+Sat 11:50 AM
+Access is basically the only right that you have that is active enough that you can *prove* noncompliance.
+Sat 11:51 AM
+I am not too eager to ask for my personal data, as it create a new problem - how to prove I am who I am and have the right to ask for a given set of data...
+Sat 11:51 AM
+That s part of what I use with CA, bit of course there they are first party websites.
+Sat 11:51 AM
+I try to starve my digital twin, not spread information about my person more places...
+Sat 11:52 AM
+Yes, it does. I can help you with that. You send the first party site ID, your identifier for the site, and your third party cookie values
+Sat 11:52 AM
+It's not your twin. It's part of you.
+Sat 11:53 AM
+You actually have many twins if you want to use that analogy. Big Other, not Big Brother.
+Sat 11:53 AM
+what do you mean by "first party site id" and my "identifier for the site"?
+Sat 11:53 AM
+I see it as no different to smiling in front of a CCTV camera and asking for the pictures afterwards. In ther words you can make the requests based on interactions you had in a sanitized environment.
+Sat 11:54 AM
+well, that nice cctv law is not in norway. besides, I prefer to cover my face with a hat and avoid cctv cameras. :) when considering to register with a web site, I read the terms and normally conclude that they are unacceptable - and thus do not register.
+Sat 11:56 AM
+Well you ask WhatDoTheyKnow for the data associated to your usage of the account "ThrowawayJustToBeAPain" on their site, including data collected on their behalf by Google, given that you found the value "UAXXXXX"
+In the first party cookies.
+Sat 11:56 AM
+I'm a software developer. I can not sign away my right to reverse engineer, for example, as I might need it in the future... :)
+Sat 11:57 AM
+Concerning CCTV, I see what you mean. But do you walk differently every day of the week so you can't be track by gait analysis?
+Sat 11:58 AM
+Or will you learn to fly so you don't have to step on smart mats that analyse stepping patterns?
+Sat 11:58 AM
+nope. just raising the cost to track me, do not have the budget to make it impossible. :)
+Sat 11:59 AM
+I am *all* for raising the costs, but part of that strategy is also to make yourself -- briefly -- visible to generic surveillance and make full exercise of your rights then.
+Sat 12:00 PM
+That raises costs now, and progressively changes the calculation long term.
+Sat 12:00 PM
+but I'll try the approach for whatdotheyknow. do you have any law URLs I can read to see what the framework is?
+Sat 12:00 PM
+Makes sense?
+Sat 12:00 PM
+sure. and I some times do it, but would not do so by accepting an unacceptable terms of use.
+Sat 12:01 PM
+Nope. What I told you is not written up except in the law.
+Sat 12:01 PM
+Right. I get it.
+Sat 12:01 PM
+Also why it is important to share those ideas on strategy: I wouldn't care about giving away my right to reverse engineering a website in Norwegian to help you for instance.
+Sat 12:02 PM
+Is there an English translation of Norwegian data protection law?
+Sat 12:05 PM
+not that I am aware of. <URL: https://lovdata.no/dokument/NL/lov/2000-04-14-31 > is the law.
+Sat 12:08 PM
+Relevant words to look for are "third party", "processor" or similar
+Sat 12:09 PM
+ah, datatilsynet have one linked from <URL: https://www.datatilsynet.no/Regelverk/Lover-og-regler/ >, <URL: https://www.datatilsynet.no/English/Regulations/Personal-Data-Act-/ >.
+Sat 12:09 PM
+Cool
+Sat 12:10 PM
+Do you know by the way if there is a register of Norwegian data controllers?
+Sat 12:10 PM
+not a complete one, but <URL: https://melding.datatilsynet.no/melding/report_search.pl > allow search in reported personal data handlers. not quite sure what 'data controller' is, but suspect it is those that need to notify datatilsynet about their processing of personal data.
+Sat 12:12 PM
+but now I have to attend a kids birthday party. see you later. :)
+Sat 12:15 PM
+Only some data controllers need to report. It's those deciding what is to be done with the data.
+Sat 12:16 PM
+Google claims not to be data controller but only processor for the Google Analytics service. Shields them more from liability.
+Sat 12:17 PM
+Sections 13, 14 and 15 are what is relevant to the (non-)transfer of liabilities from the website to Google.
+Sat 12:18 PM
+In short:
+Sat 12:18 PM
+Absent a specific contract, the website is liable for any processing done by Google on their behalf (e.g. Analytics). This means they have to fulfill access requests and give more information about the processing done by Google than what Google has ever disclosed. Impossible.
projects / homepage.git / blobdiff