wp-plugin-hostgator
domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init
action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114ol-scrapes
domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init
action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114Source:https:\/\/techcrunch.com\/2023\/06\/22\/adtech-giant-criteo-his-with-revised-e40m-fine-by-french-data-privacy-body-over-gdpr-breaches\/<\/a><\/br> French advertising technology<\/span> giant Criteo<\/a> has been issued<\/a> with a revised fine of \u20ac40 million ($44 million) over failings to garner users\u2019 consent around targeted advertising.<\/p>\n The case in question dates back to 2018 when Privacy International<\/a> filed a formal complaint<\/a>\u00a0with the Commission nationale de l\u2019informatique et des libert\u00e9s (CNIL<\/a>), France\u2019s data privacy watchdog, using GDPR regulations<\/a> that had recently been introduced across the European Union. Privacy International said it was \u201cgravely concerned\u201d at the data processing activities of several players in the data broking and adtech industry, one of which was Criteo. None of Your Business (NOYB<\/a>), an Austria-based nonprofit co-founded by lawyer and privacy activist Max Schrems<\/a>, also later added its name to the complaint.<\/p>\n The crux of the issue centered on what Privacy International referred to as a \u201cmanipulation machine,\u201d vis-\u00e0-vis how Criteo used various tracking and data-processing techniques to profile internet users for more granular ad targeting, such as using prior online activity to predict which products an online shopper might want to buy \u2014 this is known as \u201cbehavioral retargeting<\/a>.\u201d<\/p>\n Privacy International and NOYB asserted that Criteo didn\u2019t have a proper legal basis for this tracking, with the CNIL launching a formal investigation<\/a> in 2020.<\/p>\n Fast-forward to August 2022, and the CNIL reached a preliminary decision<\/a> that Criteo had indeed breached GDPR and slapped the Paris-based company with a \u20ac60 million fine. In the intervening months, however, Criteo sought to reduce the figure.<\/p>\n In a summary document<\/a> made public today, Criteo argued that its actions were non-deliberate and did not result in any harm. It said (translation via DeepL<\/a>):<\/p>\n The company believes that better consideration of the criteria set out in Article 83(2<\/a>) of the GDPR, in particular with regard to the absence of evidence of harm, the non-deliberate nature of the breaches, the measures taken to mitigate harm, the cooperation it says it has shown with the supervisory authority and the categories of personal data concerned, which present low intrusiveness, would justify that, should the restricted panel decide to impose a fine, it significantly reduce the amount of 60 million euros proposed by the rapporteur.<\/p>\n<\/blockquote>\n Criteo added that the initial fine represented half of its earnings and 3% of its global sales, which is \u201cclose to the legal maximum\u201d allowed under GDPR. Moreover, it argued that the fine was excessive compared to other fines meted out by the CNIL to the likes of Google and Facebook\u2019s parent Meta, which amounted to just 0.07% and 0.06% of their respective global sales.<\/span><\/p>\n Thus, the CNIL has seemingly paid at least some heed to Criteo\u2019s grievances and reduced the fine by one-third. However, Criteo chief legal officer Ryan Damon says that the company plans to appeal the decision, calling it \u201cvastly disproportionate\u201d when positioned against other alleged breaches elsewhere in the industry.<\/p>\n \u201cIn addition, we believe that a number of the CNIL\u2019s interpretations and applications of the GDPR are not consistent with the European Court of Justice rulings, and even with the CNIL\u2019s own guidance,\u201d Damon said in a statement issued to TechCrunch.<\/p>\n The CNIL\u2019s final report<\/a> still paints a scathing picture of Criteo\u2019s disregard for privacy, noting that the data processing involved \u201ca very large number of people\u201d from across the European Union, including the \u201cconsumption habits\u201d of millions of internet users.<\/p>\n In total, the CNIL says it found five GDPR infringements involving Criteo\u2019s ad-tracking activities, including a failure to demonstrate that the data subject (i.e. the user) gave their consent, which is covered by article 7(1)<\/a> of GDPR; a failure to \u201ccomply with the obligation of information and transparency (articles 12<\/a> and 13<\/a>), effectively meaning that Criteo didn\u2019t divulge all the ways it would process user data; a failure to \u201crespect the right of access\u201d (article 15(1<\/a>), meaning Criteo didn\u2019t provide users with all the data it held when requested; a failure to \u201ccomply with the right to withdraw consent and erasure of data\u201d (articles 7.3<\/a> and 17.1<\/a> GDPR), meaning Criteo didn\u2019t delete or remove all of a user\u2019s data when they requested this; and a failure to \u201cprovide for an agreement between joint controllers\u201d (article 26<\/a>), which means Criteo didn\u2019t have clear agreements in place with its partner companies that stipulate the role of each party and their obligation in managing users\u2019 data.<\/p>\n In its conclusion, the CNIL said that although Criteo didn\u2019t have individual names of each user, the data was \u201csufficiently accurate to re-identify individuals\u201d in some instances, which means that it was likely able to identify individuals by cross-referencing otherwise anonymized datasets with public records or combining other data-meshing techniques to infer the identity of users.<\/p>\n And then, of course, there is the elephant in the room \u2014 Criteo\u2019s motivations with regards to its main mechanisms for making money.<\/p>\n \u201cThe CNIL also took into account the business model of the company which relies exclusively on its ability to display to internet users the most relevant advertisements to promote the products of its advertiser customers and thus on its ability to collect and process a huge amount of data,\u201d the CNIL wrote. \u201cThe CNIL considered that the processing of individuals\u2019 data without proof of their valid consent enabled the company to unduly increase the number of persons concerned by its processing and thus the financial income it derives from its role as an advertising intermediary.\u201d<\/p>\n However, Criteo is sticking to its original arguments, insofar as it says that no damage was ultimately done, while pointing to the fact that the CNIL has not requested Criteo to alter any of its current practices.<\/p>\n \u201cAs we stated previously, we consider that the allegations made by the CNIL do not involve risk to individuals nor any damage caused to them,\u201d Damon said. \u201cCriteo, which uses only pseudonymized, non-directly identifiable and non-sensitive data in its activities, is fully committed to protecting the privacy and data of users. The decision relates to past matters and does not include any obligation for Criteo to change its current practices; there is no impact to the service levels and performance that we are able to deliver to our customers as a result of this decision. We continue to uphold the highest standards in this area and operate a fully transparent and regulatory-compliant global business. We will be making no further statement at this stage.\u201d<\/p>\n
\nAdtech giant Criteo hit with revised \u20ac40M fine by French data privacy body over GDPR breaches<\/br>
\n2023-06-22 22:13:23<\/br><\/p>\nPreliminary decision<\/h2>\n
\n
Findings<\/h2>\n