The GDPR emphasize that when processing data, the design of systems, apps etc must support the principles of fundamental data protection, including the principle of data minimisation. Many games and free apps have previously tracked all kinds of data about the user because this can be used to provide targeted ads or to influence the behaviour of the user.
When Christian Schmidt, a Danish citizen, signed up for some of Google’s services a lot of boxes were already ticked. This means that, by default, Google tracks and stores information about their users that are not needed to provide the service in question. He thus contacted the Danish Data Protection Agency in order to see whether Google breaks the GDPR.
Version2.dk reports that the case has been dismissed by the Danish Data Protection Agency, on the basis of two main arguments.
The Danish Data Protection Agency states that since it is relatively easy to un-tick the boxes, there is no breach of the GDPR. However, the agency also states that taking on Google in a case such as this one would be too time-consuming and demanding. The verdict has received very different reactions.
On the one hand, experts in the field argue that there are so many cases concerning data breaches and privacy that there is a need to prioritise.
On the other hand, a critique of the decision has been raised that the fact that it is easy to un-tick the boxes is not a relevant argument. Furthermore, even if the case would demand a lot of resources the fact is that Google remains one of the largest players in their field and what they do has an influence on a vast amount of users. This, the argument goes, makes it a relevant case to look at.
For now, critics will have to wait for similar cases in other countries to be taken up, so that a future case in Denmark may be stronger.
“I believe it is smarter to wait until they (Google) really does something wrong, and I think that is what other European DPAs are waiting for. They need a better case to really enforce the law in a coordinated way,” says law professor Søren Sandfeld Jakobsen to Version2.
Read more about the case here (in Danish)
