hugoroy
Joined 16 years ago
Joined 16 years ago
True whatever that means :)
> and EU law isn't applied by some overarching entity.
It is. EU law as a whole is ultimately applied by an entity, the Court of Justice of the European Union. It is overarching, over national courts, over national governments, and over EU bodies.
Then within EU law, you have several branches and distribution of who has authority etc. Primary EU law is the foundational basis (some would say a "constitution" effectively even though the word has been a political minefield) and does provide some "overarching entity" in some areas.
Then within Secondaru EU law, you have regulations, orders, directives, etc. Many regulations and orders have an EU overarching entity, and in many cases the European Commission has a central role.
> On a technical level, each country ratifies and applies their own laws in their own ways.
That is a gross mischaracterisation and overgeneralization of EU Directives.
EU Directives as a general rule* don't have "direct effect" in a Member State. They set a goal agreed at the EU level, and the Member State are bound to implement the means in their national laws to reach the goal. That usually (but not always) means at a national level the adoption of a legal act by national Parliament.
*as a general rule because as always there are exceptions.
You develop X and distribute it to B.
B modifies X (becomes X.1) and because B has been well advised by lawyers, B knows that modification of software is an act restricted under copyright law, and so B went to go read the LICENSE file and found Section 13 of AGPL. As a result because he/she is diligent, B ensures that the source code of X.1 can be accessed by putting a link to a server in X.1's user interface.
See Section 13 of AGPL:
B's "modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge ..."
B distributes X.1 to C
C runs X.1 which is a version that already offers all users a way to get the source code.
Section 13 of the AGPL which is the one the author says is ineffective starts:
"Notwithstanding any other provision of this License, if you modify the Program, your modified version must ..."
The obligation starts from "modification" of the software, and modification of software is an act protected under copyright law. Hence you need an authorisation for it (without prejudice to fair use and copyright exceptions of course).
"The AGPL, like the GPL, is a copyright licence, not a contract" actual authoriative legal source needed. For what it's worth, this is plain wrong under French law (and I'm a lawyer and there is actual case law in France to support the view that GPL is a contract).
What got rejected is using the data for "service improvement" and "security" - in particular how WhatsApp used personal data for these purposes, and how in the opinion of Europea data protection authorities this was not necessary for Meta to perform the contract.
So, duty calls[1]:
> This decision is from the Irish data privacy regulator, DPC. They are "in charge" of this investigation because Facebook's EU subsidiary is in Ireland. They are not a "lead" regulator in any sense of the word.
The DPC are officially acting on this case as the "lead supervisory authority" as defined in the GDPR ("Article 56 - Competence of the lead supervisory authority").
> In fact, this decision does not come from the DPC.
In fact it actually does come from the DPC. The process is:
- DPC issues draft decision, after conducting an investigation, etc.
- Other authorities in impacted countries ("concerned supervisory authorities" in the official terms of the GDPR) chime in, provide comments, and possibly disagree with the draft decision (they raise "objections")
- The authorities try to aree, and if they don't, they have a dispute that gets resolved at the European Data Protection Board
- The EDPB takes a binding decision, which is imposed on the DPC (and the other concerned authorities)
- The DPC takes notes of the decision, and issue their sanction accordingly.
In the end, it is indeed a decision formally issued by the DPC against WhatsApp. That's why Meta need to appeal against the DPC in Irish Courts - and why Meta cannot appeal direclty in the European General Court against the EDPB.
> The DPC's decision was to pussy out and issue a smaller fine, and rubber-stamp several of Facebook's arguments. Their authority to do so was overturned by the regulators for other countries, and by the EDPB (EU-level agency). The EDPB is also requiring the DPC to do more investigations which will probably eventually result in even more fines.
> GDPR fines tend to be about specific issues related to specific complaints. [...] There has NOT been a general "is Whatsapp in its entirety compliant with GDPPR" investigation yet. > The EDPB-mandated investigation is creeping closer to that.
Actually, the EDPB's request is also specific: it is asking the DPC to look precisely about the part of the complaint on WhatsApp's use of sensitive data ("special categories" under GDPR Article 9).
PS: IAAL
[1] Know your classics: https://xkcd.com/386/
While GDPR did raise the threshold of valid consent, the interpretation before the GDPR was nowhere near what you describe here.
There are authority guidelines and sanctions predating the GDPR on this.
This is outdated.
The relevant bit about consent and cookies was added in 2009, with directive 2009/136 modifying article 5(3) of directive 2002/58.
So all you're saying about legitimate interests etc. is wrong since 2011 (2009+2 years allowing for Member States implementation in national law)
> [...] we felt it necessary to state unequivocally that this post does not reflect the reality of the facts and contradicts the verdict by the Berlin Labour Court.
> The court judgement of 19 November 2020 (reference number 42 Ca 5723/20) did not acknowledge any factual basis to the assertions. Furthermore the judges concluded that our former employee's own statements prove that she “neither experienced hostility, nor was she offended, nor in another form intimidated or demeaned”. Additionally they found, she received equal treatment, and that “the boundaries of socially acceptable conduct” were “not exceeded”.
> Until the end of the proceedings, we do not wish to comment any further [...]