Max Schrems’s NOYB initiates GDPR action

The end of pop-ups

NOYB said that if the complaints are successful, the practical result will be the end of obtrusive pop-ups which are used to claim a user’s consent.

“If companies realise that annoying pop-ups usually don’t lead to valid consent, we should also be free from this digital plague soon,” said Schrems. “GDPR is very pragmatic on this point: Whatever is really necessary for an app is legal without consent, the rest needs a free ‘yes’ or ‘no’ option.”

The fight against forced consent is also important for small and local companies, which usually cannot force their customers to agree to policies, according to NOYB.

“The fight against forced consent ensures that the corporations cannot force users to consent. This is especially important so that monopolies have no advantage over small businesses,” said Schrems.

NOYB said these first complaints will be a crucial test of the law: with a penalty of 4% of global revenue, Google or Facebook would have to pay more than a billion Euros for violating the law.

“We probably will not immediately have billions of penalty payments, but the corporations have intentionally violated the GDPR, so we expect a corresponding penalty under GDPR,” he said.

Enhanced privacy rights

According to Schrems, NYOB is key to fulfilling the GDPR’s promise of enhanced privacy rights, especially as the regulation allows collective enforcement by NGOs on behalf of individuals under article 80. “The non-profit NOYB is meant to reasonably enforce the new law, so that the benefits actually reach the users,” said Schrems.

The complaints about “forced consent” are the first action of NOYB, which is already planning further complaints about the illegal use of user data for advertising purposes or “fictitious consent”, such as when companies recognise “consent“ to other types of data processing by solely using their webpage.

NOYB is funded by more than 2,800 individual supporting members and sponsors.To finance the fight against data breaches in the long term, the association is looking for more supporting members.

So far, the budget for 2018 is only 69% funded. “In 1995 the EU already passed data protection laws, but they were simply ignored by the big players. We want to make sure this does not happen again with GDPR,” said Schrems.

Google said in a statement: “We build privacy and security into our products from the very earliest stages and are committed to complying with the GDPR. Over the last 18 months, we have taken steps to update our products, policies and processes to provide users with meaningful data transparency and control across all the services that we provide in the EU.”

Facebook’s chief privacy officer, Erin Egan, told the Guardian: “We have prepared for the past 18 months to ensure we meet the requirements of the GDPR. We have made our policies clearer, our privacy settings easier to find and introduced better tools for people to access, download, and delete their information.

“Our work to improve people’s privacy doesn’t stop on 25 May. For example, we’re building Clear History: a way for everyone to see the websites and apps that send us information when you use them, clear this information from your account, and turn off our ability to store it associated with your account going forward.”