Connect with us

Technology

The Austrian data regulator’s issue with Google Analytics

William Fry’s David Cullen and David Kirton look at the Austrian data watchdog’s Google Analytics concerns and what it means.

In the latest in a long line of challenges to the transfer of personal data from Europe to the US, the Austrian data protection authority, DSB, has found that the use by an Austrian website of Google Analytics did not comply with EU data protection law.

The DSB reached this decision on the basis that the use of Google Analytics involves the transfer of personal data to the US where, it found, it would not receive adequate protection from surveillance by US intelligence services.

The DSB concluded that measures put in place to protect that personal data, such as encryption, were not sufficient to address that risk.

This decision is the first issued on foot of 101 complaints filed by Vienna-based privacy non-profit group NOYB with various European data protection authorities, including the Irish Data Protection Commission.

These complaints allege that personal data transfers to Google and Facebook in the US breach EU data protection law as set out in the widely reported Schrems II case.

What is Google Analytics?

Google Analytics is a tool that website operators can use to monitor how visitors use their websites. For example, it can be used to generate reports on visitor numbers, visitors’ browser parameters, which device they are using and more. It does this by placing a cookie – a small piece of code – on the user’s device, which assigns a unique identification number.

Google Analytics can also combine this unique identifier with other information, such as the visitor’s IP address, to track the visitor in additional ways. For example, if the visitor is logged into their Google account, their visit will be linked to that account.

The DSB found that this creates a ‘digital footprint’ that can be used to identify individuals. This digital footprint is not only used by the website operator. Google also collects this information and transfers it to its servers in the US.

International data transfers

EU data protection law, including the GDPR, allows the free movement of personal data within the EEA, as well as between the EEA and certain other countries that are deemed to offer adequate protection for personal data, such as Canada and Japan.

Otherwise, a transfer of personal data outside the EEA (including the US) can only take place using certain mechanisms set out in the GDPR.

One such mechanism is by using standard contractual clauses. This mechanism requires the data exporter and importer to enter into a contract requiring the importer to ensure that the personal data receives sufficient protection outside the EEA.

However, pursuant to the decision of the Court of Justice of the EU in the Schrems II case, the standard contractual clauses alone are not sufficient.

Data exporters must also assess the level of protection that the personal data will receive in the destination country and, if that falls short of the level offered in the EEA, put in place supplementary measures to address those deficiencies.

The DSB’s decision

The DSB’s decision followed a complaint by a visitor to an Austrian website called NetDoktor.  Because that website used Google Analytics, the visitor’s personal data, including a unique user identification number, IP address and browser parameters, were retrieved and sent to servers operated by Google in the US.

The operator of the website and Google had entered into the standard contractual clauses, and Google had implemented certain additional contractual, technical and organisational measures with a view to ensuring an adequate level of protection for EU personal data exported to the US.  This included encryption of the data.

However, the DSB found that the steps taken were not sufficient to ensure compliance with the GDPR rules on transfers of personal data outside the EEA.

As an electronic communication service provider under US law, Google is subject to compliance with surveillance requests made by US intelligence agencies. Google disclosed that it had received such enquiries from US authorities.

In the absence of additional measures, therefore, the DSB determined that there was a risk that personal data transferred to the US could be accessed by US intelligence agencies in a manner which would violate the rights of data subjects.

Next, the DSB considered the additional measures that were in place, such as encryption, but found that they were not sufficient to address the risk.

For example, the DSB referred to European Data Protection Board (EDPB) recommendations, which state that encryption is not a sufficient measure if the recipient of the personal data has the encryption key and may be under an obligation to hand over that key to the relevant authorities.

The DSB therefore decided that the website operator had not complied with GDPR rules on transfers of personal data outside the EEA.

Google’s response

It should be noted that the DSB did not find any wrongdoing on the part of Google – the primary legal responsibility for transfers of data lies with the data controller, in this case, the website operator.

Nonetheless, Google expressed its concern with the decision. Its president of global affairs and chief legal officer, Kent Walker, noted in a blogpost that, in 15 years of offering the Google Analytics tool, Google “has never once received the type of demand [from the US authorities] the [DSB] speculated about”.

“If a theoretical risk of data access were enough to block data flows, that would pose a risk for many publishers and small businesses who use the web and highlight the lack of legal stability for international data flows facing the entire European and American business ecosystem,” he said.

Wider implications

It is important to stress that the DSB’s decision is not yet final and, in any event, does have effect outside Austria. As with all regulatory decisions, it is specific to its facts.

No one is expecting to see websites across Europe drop Google Analytics overnight. However, as this is the first decision on the foot of 101 complaints filed by NOYB, it is possible that in the coming months, we will start to see similar decisions across Europe.

These decisions may well have an impact on the use of various tools, not just Google Analytics, which involve transfers of personal data to the US or elsewhere outside the EEA.

The EDPB has set up a taskforce to coordinate and promote communication between the national authorities in relation to these complaints.

According to BuiltWith, 28m sites (including more than 70pc of the most popular 10,000 websites globally) were using the Google Analytics tool as of November 2021. There will therefore be a great many businesses, regulators and lawyers looking at these decisions very carefully.

These decisions are against a background where EU and US negotiators are trying to work out a new deal to facilitate the continued sharing of data across the Atlantic.

It is intended that this deal would replace the Privacy Shield mechanism rejected by the EU courts in July 2020. These discussions have not yet resulted in any concrete proposals and negotiators will not approve any deal unless expected to meet the standards set down in the Schrems II decision and related cases.

In the meantime, it is important that businesses operating online are completely aware of all their international data flows, know what tools they use and what personal data they process.

As the Austrian decision illustrates, it is ultimately the website operator that is legally accountable for the protection of its user’s personal data.

By David Cullen and David Kirton

David Cullen is a partner and head of William Fry’s Technology Group. David Kirton is a partner in William Fry’s Technology Group.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Source link

Global Affairs

Open Source Software (OSS) Supply Chain, Security Risks And Countermeasures

OSS Security Risks And Countermeasures

The software development landscape increasingly hinges on open source components, significantly aiding continuous integration, DevOps practices, and daily updates. Last year, Synopsys discovered that 97% of codebases in 2022 incorporated open source, with specific sectors like computer hardware, cybersecurity, energy, and the Internet of Things (IoT) reaching 100% OSS integration.

While leveraging open source enhances efficiency, cost-effectiveness, and developer productivity, it inadvertently paves a path for threat actors seeking to exploit the software supply chain. Enterprises often lack visibility into their software contents due to complex involvement from multiple sources, raising concerns highlighted in VMware’s report last year. Issues include reliance on communities to patch vulnerabilities and associated security risks.

Raza Qadri, founder of Vibertron Technologies, emphasizes OSS’s pivotal role in critical infrastructure but underscores the shock experienced by developers and executives regarding their applications’ OSS contribution. Notably, Qadri cites that 95% of vulnerabilities surface in “transitive main dependencies,” indirectly added open source packages.

Qadri also acknowledges developers’ long-standing use of open source. However, recent years have witnessed heightened awareness, not just among developers but also among attackers. Malware attacks targeting the software supply chain have surged, as demonstrated in significant breaches like SolarWinds, Kaseya, and the Log4j exploit.

Log4j’s widespread use exemplifies the consolidation of risk linked to extensively employed components. This popular Java-based logging tool’s vulnerabilities showcase the systemic dependency on widely used software components, posing significant threats if exploited by attackers.

Moreover, injection of malware into repositories like GitHub, PyPI, and NPM has emerged as a growing threat. Cybercriminals generate malicious versions of popular code to deceive developers, exploiting vulnerabilities when components are downloaded, often without the developers’ knowledge.

Despite OSS’s security risks, its transparency and visibility compared to commercial software offer certain advantages. Qadri points out the swift response to Log4j vulnerabilities as an example, highlighting OSS’s collaborative nature.

Efforts to fortify software supply chain security are underway, buoyed by multi-vendor frameworks, vulnerability tracking tools, and cybersecurity products. However, additional steps, such as enforcing recalls for defective OSS components and implementing component-level firewalls akin to packet-level firewalls, are necessary to fortify defenses and mitigate malicious attacks.

Qadri underscores the need for a holistic approach involving software bills of materials (SBOMs) coupled with firewall-like capabilities to ensure a comprehensive understanding of software contents and preemptive measures against malicious threats.

As the software supply chain faces ongoing vulnerabilities and attacks, concerted efforts are imperative to bolster security measures, safeguard against threats, and fortify the foundational aspects of open source components.


We Can’t Thank You Enough For Your Support!

By John Elf | Science, Technology & Business contributor VoiceOfEU.com Digital

— For more information: info@VoiceOfEU.com

— Anonymous news submissions: press@VoiceOfEU.com


Continue Reading

Culture

Choco: Revolutionizing The FoodTech Industry With Innovation & Sustainability | EU20

By Clint Bailey

— In the rapidly evolving world of food technology, European startup Choco has emerged as a pioneering force. With its website, Choco.com, this Berlin-based company is transforming the way food industry professionals operate by leveraging innovative digital solutions. By linking restaurants, distributors, suppliers, and producers on a single platform, Choco is streamlining the supply chain process while promoting sustainability.

Let’s explore the journey of Choco.com and its impact on the overall foodtech industry.


  1. Company: Choco Technologies GmbH
  2. Website: www.Choco.com
  3. Head Office: Berlin, Germany
  4. Year Established: 2018
  5. Founders: Choco was co-founded by Daniel Khachab, Julian Hammer, and Rogerio da Silva.
  6. Industry: Choco operates in the foodtech industry, specifically focusing on digitizing the supply chain for the food industry.
  7. Funding: Choco has secured significant funding rounds from investors, including Bessemer Venture Partners & Coatue Management.
  8. Market Presence: Choco has a strong presence in several European cities, including Berlin, Paris, London & Barcelona.
  9. Mission: Choco aims to revolutionize the food industry by leveraging technology to simplify supply chain management, promote sustainability, and reduce food waste.

Simplifying Supply Chain Management

One of the core focuses of Choco is to simplify supply chain management for food businesses. Traditionally, the procurement process in the food industry has been cumbersome and inefficient, with numerous intermediaries and manual processes. Choco’s digital platform replaces the traditional paper-based ordering system, allowing restaurants and suppliers to communicate and collaborate seamlessly.

Choco’s platform enables restaurants to place orders directly with suppliers, eliminating the need for phone calls, faxes, or emails. This not only saves time but also reduces the likelihood of errors and miscommunications.

By digitizing the ordering process, Choco improves transparency, making it easier for restaurants to compare prices, track deliveries, and manage inventory efficiently.

Streamlining Operations For Suppliers & Producers

Choco’s impact extends beyond restaurants. The platform also provides suppliers and producers with valuable tools to streamline their operations. By digitizing their product catalogs and integrating them into the Choco platform, suppliers can showcase their offerings to a wide network of potential buyers.

Suppliers benefit from increased visibility, enabling them to reach new customers and expand their market presence. Moreover, Choco’s platform helps suppliers manage their inventory, track orders, and plan deliveries effectively. These features enhance operational efficiency, reduce waste, and ultimately contribute to a more sustainable food system.

https://youtube.com/@choco233
YouTube Channel

Promoting Sustainability & Reducing Food Waste

Choco recognizes the critical importance of sustainability in the food industry. According to the United Nations, approximately one-third of the world’s food production goes to waste each year. By digitizing the supply chain and enabling more efficient ordering and inventory management, Choco actively works to combat this issue.

Air France – Deals & Destinations

Choco’s platform facilitates data-driven decision-making for restaurants, suppliers, and producers. By analyzing purchasing patterns & demand, Choco helps businesses optimize their inventory levels, reducing overstocking and minimizing food waste. Additionally, Choco supports local sourcing, enabling businesses to connect with nearby suppliers & promote sustainable, community-based practices.

Expanding Reach & Impact

Since its founding in 2018, Choco has experienced rapid growth and expansion. The startup has successfully secured significant funding rounds, allowing it to scale its operations and establish a strong presence across Europe and other global markets. Today, Choco’s platform is used by thousands of restaurants and suppliers, revolutionizing the way they operate.

Choco’s impact extends beyond operational efficiency or sustainability. By connecting restaurants, suppliers & producers on a single platform, Choco fosters collaboration & encourages the exchange of ideas. This collaborative approach strengthens the overall foodtech ecosystem and creates a supportive community of like-minded aiming to drive positive change within the industry.

Future Of FoodTech

Choco’s rise to prominence in the foodtech industry exemplifies the reach of sustainability, innovation, and community. Through its user-friendly platform, Choco simplifies supply chain management, streamlines operations for restaurants & suppliers, and actively promotes sustainable practices. By harnessing the potential of digital, Choco is disrupting the future of the food industry, making it more efficient and transparent.

As Choco continues to expand its impact and reach, its transformative influence on the foodtech sector is set to inspiring, grow other startups, and established players to embrace technology for a better and more sustainable food system.


We Can’t Thank You Enough For Your Support!


— Compiled by Clint Bailey | Team ‘Voice of EU’
— For More Info. & News Submissions: info@VoiceOfEU.com
— For Anonymous News Submissions: press@VoiceOfEU.com


Continue Reading

Current

The Implications Of Controlling High-Level Artificial Super Intelligence (ASI)

Artificial Super Intelligence (ASI)

By Clint Bailey | ‘Voice of EU’

The notion of artificial intelligence surpassing humanity has long been a topic of discussion, and recent advancements in programs have reignited concerns. But can we truly control super-intelligence? A closer examination by scientists reveals that the answer is highly unlikely.

Unraveling The Challenge:

Controlling a super-intelligence that surpasses human comprehension necessitates the ability to simulate and analyze its behavior. However, if we are unable to comprehend it, creating such a simulation becomes an impossible task. This lack of understanding hinders our ability to establish rules, such as “cause no harm to humans,” as we cannot anticipate the scenarios that an AI might generate.

The Complexity Of Super-Intelligence:


Super-intelligence presents a distinct challenge compared to conventional robot ethics. Its multifaceted nature allows it to mobilize diverse resources, potentially pursuing objectives that are incomprehensible and uncontrollable to humans. This fundamental disparity further complicates the task of governing and setting limits on super-intelligent systems.

Drawing Insights From The Halting Problem:


Alan Turing’s halting problem, introduced in 1936, provides insights into the limitations of predicting program outcomes. While we can determine halting behavior for specific programs, there is no universal method capable of evaluating every potential program ever written. In the realm of artificial super-intelligence, which could theoretically store all possible computer programs in its memory simultaneously, the challenge of containment intensifies.

The Uncontainable Dilemma:


When attempting to prevent super-intelligence from causing harm, the unpredictability of outcomes poses a significant challenge. Determining whether a program will reach a conclusion or continue indefinitely becomes mathematically impossible for all scenarios. This renders traditional containment algorithms unusable and raises concerns about the reliability of teaching AI ethics to prevent catastrophic consequences.

Air France – Deals & Special Offers

The Limitation Conundrum:


An alternative approach suggested by some is to limit the capabilities of super-intelligence, such as restricting its access to certain parts of the internet or networks. However, this raises questions about the purpose of creating super-intelligence if its potential is artificially curtailed. The argument arises: if we do not intend to use it to tackle challenges beyond human capabilities, why create it in the first place?

READ: ALL ABOUT ARTIFICIAL INTELLIGENCE

Urgent Reflection – The Direction Of Artificial Intelligence:


As we push forward with artificial intelligence, we must confront the possibility of a super-intelligence beyond our control. Its incomprehensibility makes it difficult to discern its arrival, emphasizing the need for critical introspection regarding the path we are treading. Prominent figures in the tech industry, such as Elon Musk and Steve Wozniak, have even called for a pause in AI experiments to evaluate safety and potential risks to society.

The potential consequences of controlling high-level artificial super-intelligence are far-reaching and demand meticulous consideration. As we strive for progress, we must strike a balance between pushing the boundaries of technology and ensuring responsible development. Only through thorough exploration and understanding can we ensure that AI systems benefit humanity while effectively managing their risks.


We Can’t Thank You Enough For Your Support!


By Clint Bailey, Team ‘THE VOICE OF EU

— For Information: Info@VoiceOfEU.com

— For Anonymous News Submissions: Press@VoiceOfEU.com


Continue Reading

Trending

Subscribe To Our Newsletter

Join our mailing list to receive the latest news and updates 
directly on your inbox.

You have Successfully Subscribed!