OX · Companies & groups · DE
…2020 © by Open-Xchange AG. This document is released under the Creative Commons BY-ND-4.0 International license. Open-Xchange and the Open- Xchange logo are trademarks or registered trademarks of Open-Xchange AG. All other company and/or product names may be trademarks or registered trademarks of their owners. Information contained in this document is subject to change without notice. Cologne, 29 April 2020 Open-Xchange contribution to the request for feedback on the report on the application of the General Data Protection Regulation Open-Xchange, as the leading European open source software company in the email and DNS space, and as the service provider of choice for some of the biggest Internet access providers in Europe, would like to thank for the opportunity to provide feedback on the Commission’s report on the application of the General Data Protection Regulation.
…to provide feedback on the Commission’s report on the application of the General Data Protection Regulation. Open-Xchange strongly believes in openness and privacy, as fundamental pillars for individual rights in the online space, and as a key differentiator for European companies in the competition with dominant global Internet platforms. As such, we have a very positive view of the GDPR and of its impact on the European and global Internet services market. The GDPR showed that European legislators can have a global, positive impact on the digital society, creating a competitive advantage for European companies and services. We note that this impact is mostly due to the significant sanctions that it imposes on violators, and to the fact that they apply to any company doing business in Europe, regardless of the country it is incorporated in.
…to the fact that they apply to any company doing business in Europe, regardless of the country it is incorporated in. We thus assess the GDPR model positively and encourage the European institutions to follow the same model for future Internet regulations, starting from the upcoming Digital Services Act. However, we also note that much still needs to be done in terms of actual enforcement. In the Internet sphere, on practices like website cookie configuration and consent provision in sign-up forms, there is widespread disregard for the GDPR, sometimes in the letter, but much more frequently in the spirit.
…forms, there is widespread disregard for the GDPR, sometimes in the letter, but much more frequently in the spirit. It is common to see cookie management pop-ups in which the option to deny consent is buried deep into the navigation, made almost invisible, or broken up into dozens or even hundreds of separate toggles that have to be disabled one by one – and as soon as you get back to the website, you are asked to do it again or accept all cookies. These practices make a mockery of the GDPR and of European institutions. Similar issues, though less evident, seem to happen within the big Internet platforms and within advertising ecosystems. Even users that make special efforts to regularly deny consent see their data appear in many unexpected places.
Even users that make special efforts to regularly deny consent see their data appear in many unexpected places. Data seem to enter black boxes, be processed (for example via machine learning algorithms) and reappear in ways that are out of the control of the data subject; coupled with the almost impossibility of doing without the dominant services of the big platforms, no practical way to prevent this from happening seems to exist, apart from not using the Internet. Ref. Ares(2020)2298295 - 29/04/2020 Open-Xchange 2 Lack of enforcement thus seems to be a pressing issue with the GDPR. Not all European countries seem adequately equipped or committed for enforcing the regulation, especially if they have to stand up to very big companies.
…equipped or committed for enforcing the regulation, especially if they have to stand up to very big companies. Also, sometimes the “one-stop-shop” mechanism that entitles the company to interact with a single DPA seems to promote “forum shopping” by the big players, as certain European countries seem to become “privacy havens” that, similarly to tax havens, use their reduced energy in enforcing the GDPR to attract global multinational companies, with a small advantage for the country but a big damage to Europe and European citizens in general, and also to European competitors located in other countries.
…a big damage to Europe and European citizens in general, and also to European competitors located in other countries. The enforcement system thus needs to be revised to ensure: • that companies have to conform to the highest European GDPR implementation and enforcement standards, not to the lowest ones; • that all DPAs are adequately committed to the enforcement of the Regulation, both in quality and in quantity of proceedings; • that citizens have effective ways to prompt action by their DPA when they encounter blatant violations. At the same time, the GDPR still needs to be accompanied by a special law to make it effective over online Internet and web services. We support the call by the European Data Protection Board for an intensification and finalization of the efforts to establish a new ePrivacy Regulation1.
Data Protection Board for an intensification and finalization of the efforts to establish a new ePrivacy Regulation1. We think that citizens should be allowed to declare their consent preferences once, within their client applications, through the use of regulator-approved standardized categories of data processing purposes, and that their privacy preferences should be automatically retrieved and applied by each website and service that they visit. This would solve the user interaction problems and give actual control to European citizens over their data. Finally, as the biggest European maker of consumer webmail platforms, we would like to comment specifically on the data portability right enshrined in article 20 of the GDPR.
…platforms, we would like to comment specifically on the data portability right enshrined in article 20 of the GDPR. We believe that this right is a very positive provision, but we regret to note that, at least in the email space, it is still unimplemented in its most important features. While most platforms nowadays allow users to export all their information, the right of direct transfer foreseen by paragraph 2 has almost never been implemented. There is no technical reason for this, except that the major players would need to agree on common standards for the direct exchange of data. We note that some efforts have been established, such as the Data Transfer Project2, but they are only nominally supported by the big players, with no clear commitment and timeframe for implementation.
…but they are only nominally supported by the big players, with no clear commitment and timeframe for implementation. Smaller players like us would much like to implement a standard, but it makes no sense to invest significant energies in doing so if none of the big platforms is doing the same. We think that a “moral suasion” effort by European authorities is necessary to bring all relevant players around a table and have them agree on a common technical standard and implementation timeline, while at the same time making sure that such standard will not hinder the end-user’s ability to actually enjoy the data portability right in practice. The same approach could be used for other types of applications, such as instant messaging, social media, online storage, calendars and so on.
…used for other types of applications, such as instant messaging, social media, online storage, calendars and so on. 1 See https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_contributiongdprevaluation_20200218.pdf , page 4. 2 https://datatransferproject.dev/ Open-Xchange 3 We however also note that data portability is only a first step towards appropriate ex- ante regulation of Internet platforms and services that would ensure user choice, fair competition and opportunities for innovation, to the advantage of European citizens and industry growth.
…choice, fair competition and opportunities for innovation, to the advantage of European citizens and industry growth. As today’s online communication services (other than basic email) are often built by dominant global players in the form of “walled gardens”, having an easy opportunity to move one’s own data to a different service becomes useless, if then the new service cannot exchange communications with all the user’s contacts that are still on the previous one. For example, if you move from Whatsapp to Telegram you will not be able to communicate with your friends that are still using Whatsapp, even if technical mechanisms to allow this could easily be conceived and implemented. This lack of service interoperability, in the end, tends to void the GDPR’s data portability right.
14 → 12