Two weeks ago, I intended to write about the upcoming cinematic autumn focusing on Big Tech. I didn’t know it then, but I left out the most relevant film of the bunch.
Four tech movies about supervillains this fall
In the coming days/weeks, four films will be released about four CEOs of the world’s most powerful tech companies. Well, about one who didn’t make it and three who did... at the cost of a lot of bad things.
At this point, I assume that you are already aware of (i) the ongoing genocide in Gaza, (ii) the content of this film (interviews with anonymous individuals who have participated in its execution), and (iii) the censorship campaign against the creators of the film (a common theme in several of the other films mentioned).
The film is very short and, against all odds, artistically very relevant, despite its tiny budget.
Very much in the style of Hitchcock’s “Rear Window,” it captures the details of the nighttime daily lives of families in Tel Aviv, visible through open windows, filmed – as is the entire film – from the rooftops of tall buildings.
These images take on a power that is not easy to explain when combined with the account of nighttime attacks on Palestinian civilian families.
My only advice for preserving a minimum of mental well-being is not to watch it right before going to bed, because you will have a hard time.
Some key plot points.
(Spoiler alert, if you’re going to watch it, and you should, read all of this afterward).
Naza is the number of “collateral damage” victims that the Israeli army was willing to accept at any given time when carrying out a remote missile or drone strike against a “Hamas terrorist.” According to the testimonies gathered in the film, the figure ranges from 5 to as many as 500.
Usually, it involves the target person’s family, because it is more likely that they will be eliminated by being attacked at night in their home.
A highly disturbing detail is that the interviewees speak as civilians—not professional soldiers—who have participated for a limited time in these actions.
The long-term effects on a “normal” life after something like this remain to be seen.
Some noteworthy highlights for technology law.
Lavender infers the designation of “terrorist” by using an algorithm that triangulates data from their contacts and direct communications. The estimated probability of accuracy is 75%. You decide.
The testimonies are unanimous in stating that the human involved has no capacity to supervise the system that sets objectives and respond to the hierarchical order that progressively increases the number of “Naza” during the war.
This is the element of the film that strikes me the most: not the technology, not the individual people, but the system as a well-oiled machine for carrying out a genocide.
Human stories are terrible, but they are not new (the excuses: “if I didn’t do it, someone else would have,” “I was fighting for my survival,” “I was obeying orders,” cannot surprise anyone who has read about the “banality of evil” or, in fact, anything by Hannah Arendt—another Jew persecuted by her own people for being critical).
The expulsion of any thought about the victims in the midst of the moral intoxication of doing THE RIGHT THING in capital letters has been dissected in Pablo Malo’s “The Dangers of Morality.”
As I said, go see it.
You are reading ZERO PARTY DATA. The newsletter about current events and technology law by Jorge García Herrero and Darío López Rincón.
In the free time that this newsletter allows us, we resolve complex issues related to personal data protection regulations and artificial intelligence. If you have any of these, let us know. Or contact us by email at jgh(at)jorgegarciaherrero.com
Thanks for reading Zero Party Data! Subscribe for free to receive new posts and support my work.
🗞️News of the Data world🌍
– A court in Granada has indicted the former head of the Local Police and seven other officers for alleged crimes of disclosing and revealing secrets (the infamous Article 189 of the Penal Code): they made 35 inquiries in VioGén about the ex-partner of their sub-inspector, who was later convicted of domestic violence, and about his minor daughter, between August 2023 and April 2024. The protection of that victim was the exclusive responsibility of the Civil Guard, and the Local Police were not assigned to the case.
It was an audit of access logs by the State Secretariat of Security that uncovered the pattern, after the victim reported, convinced that her abuser knew her movements in real time. The individuals under investigation belonged to the Women and Minors Group, the unit specializing in gender-based violence. Let’s thank the boring but essential access log, which is crucial for punishing this type of abuse.
- Data brokers may be more or less appealing to you, but in any case, you won’t reach the level of Heidi Saas, who publicly boasts about hating them at every opportunity: in fact, “I hate data brokers” is almost her personal brand. That’s why it’s striking that Heidi has given her seal of approval to Apple’s new iteration for blocking tracking, now at the domain level, not just at the device level.
Heidi Saas celebrates that Apple has become the most effective privacy regulator of the moment (note the irony): in versions 27 of iOS, iPadOS, macOS, and visionOS, Safari and WebKit block network access to the identity resolution infrastructure at the domain level, preventing them from receiving the email with which they link the user across sites. Because it is done by domain, intermediaries cannot circumvent it by reformulating the request. Saas anticipates that Adtech will complain (and rightly so, I add) about restrictions on competition. However, the plot twist is that to do so, they will have to prove that… their business is legitimate. A delicious post… yum yum yum.
Pay attention to these two news items, in anticipation of what is coming in Spain in four days:
– Flávio Bolsonaro paid 600,000 reais to Elytron,a cybersecurity company that, according to documents obtained by Intercept Brasil, offered a system in the United States to manipulate elections using AI. The material, provided by former consultant Vincent Edward Reed, describes mass data collection, voter segmentation, fake accounts, targeted rumors, AI-generated avatars, deepfakes, and psychological warfare techniques to discredit rivals, and according to Reed, it was presented to people linked to Trump’s 2024 campaign. There is no evidence that the system was used in the Brazilian elections, and both the campaign and Elytron deny any illegal services and describe the contract as the provision of cybersecurity services.
– Meta employees acknowledged in internal communications that Lula da Silva’s Instagram accounts were affected by restrictions during the Brazilian election campaign, according to messages reviewed by Folha de S.Paulo and reported by Reuters. These messages also admit that the platform recommended the profile and WhatsApp channel of his rival, Flávio Bolsonaro.
- Meta’s latest: WhatsApp’s help pages contained hidden instructions for its AI support chatbot, instructing it not to recommend contacting a data protection authority if the user could not delete their account, even though WhatsApp’s own European privacy policy recognizes that right. Another section indicated that if the user mentioned lawyers, lawsuits, or courts, the chatbot should not cite or interpret the GDPR or other privacy regulations, even when the user invoked them.
- To God what belongs to God: A federal judge dismissed Ann Altman’s lawsuit against her brother, Sam Altman, in which she accused him of sexually abusing her during her childhood. The judge dismissed the case – that is, there was no ruling on the merits – because the plaintiff did not undergo an independent medical examination or meet other deadlines despite warnings. However, he rejected Sam Altman’s request that she be required to pay costs and attorney’s fees.
📖 Hard data documents for coffee lovers ☕️
-The Norwegian data protection authority has fined Xandr 8.5 million euros for failing to obtain proper consent and for processing special category data without complying with Article 9 (sexual orientation). This is not a new issue in terms of sanctions, as in 2021, Grindr, which is part of the Adtech ecosystem and bidding system, was also fined, although the amount was lower.
Specifically, the game between the two of them proceeded as follows:
Grindr sent data from its users (advertising ID, IP address, app name/ID) to advertising partners, either directly or via SDK, as part of the real-time bidding (RTB) process.
Xandr acted as both an SSP (supply-side platform) and a DSP (demand-side platform), receiving this data, enriching it with third-party providers, and distributing bid requests to other DSPs.
Xandr deleted relevant data during the investigation, citing its data retention policies, even though it was aware of the procedure since February 2020.
Implying conclusions from the DPA that we already know:
-Xandr is equally responsible for both the supply and the demand, even if it claims to be merely in charge. This ability to exert real influence on the configuration and structure is what will force you to consider yourself in this category. Referencing the well-known IAB Europe:
“In the NO DPA’s opinion, Xandr had a tangible impact on the determination of the purposes and means of the processing by providing the framework and presenting the Console with the standard selected by Xandr.”
-It is not permissible to include a clause in the contract obligating another party to obtain the valid consent of the interested party. The person responsible remains responsible, even if there is more than one.
“The accountability principle contained in Article 5(2) GDPR, as well as the obligations under Article 24 GDPR, apply to both controllers. They are both responsible for ensuring and demonstrating that processing is performed in accordance with the GDPR. For example, where one controller is tasked with requesting consent from data subjects, both controllers remain responsible for ensuring that such consent provides a valid and appropriate basis for their processing. Compliance can never be outsourced.”
-Contractually prohibiting the use of sensitive data doesn’t achieve anything if it ends up being used anyway, as that’s when the proactive responsibility of the data controller comes into play. We’ll start seeing this in the DPAs of any AI-related agreements, where you can agree to whatever you want on that point:
“The NO DPA maintains that such a formality in the form of a contractual commitment between controllers does not relieve Xandr of its responsibility when it de facto processed sensitive personal data pursuant to Article 9.”
“In addition, the CJEU has confirmed that it is not relevant whether the controller is acting with the aim of obtaining information that falls within one of the categories referred to in Article 9(1) GDPR.
-Reversal of the burden of proof: in the absence of documentation, the authority applies the presumption that the standard practice of the industry was followed. It was missing because it was deleted. And it can be added that the common practice of the industry is not a valid argument in any sense.
“The NO DPA takes the view that the deletion of potential evidence after the commencement of an investigation cannot be invoked in Xandr’s favour. On the contrary, the NO DPA maintains that the burden of demonstrating compliance and accountability pursuant to Article 5(2) GDPR rests upon Xandr itself.”
-The classic case of ending up processing special category data by inference: the name/ID of the app, along with online identifiers, reveals sexual orientation. Whether the hypothesis about eating meat, fish, both, or a thousand other options is correct or incorrect is irrelevant.
“Data revealing the fact that someone is a Grindr user strongly indicates that they belong to a sexual minority, and that data concerning a person’s sexual orientation constitutes special category data under the GDPR.”
“The CJEU has ruled that the concept of special category data should be interpreted broadly and encompass personal data that is likely to indirectly reveal sensitive information [...]. This is the case regardless of whether the information revealed is correct.”
- The OECD publishes a policy brief to determine when there is a public interest that justifies the secondary use of health data, especially when obtaining individual consent is impossible or impractical.
The lack of clear definitions and the disparity of criteria among review committees, sometimes several for the same application, delay valuable access and hinder cross-border collaboration. The solution is not a crappy web tool that won’t solve anything, but rather five categories of criteria: population health and planning, research and innovation, ethical and risk considerations, health equity, and public communication and transparency. The document includes an interesting case of a private French data warehouse of pharmaceutical dispensing data authorized by the CNIL. The point is that the CNIL required that each subsequent study demonstrate its own public interest. The legal basis is not “inherited” from the repository; it must be demonstrated and documented for each use case: that is the logic of permissions in the EHDS (the European Health Data Space).
💀Death by Meme🤣
It looks really bad, but be careful with the comment from the affected person. This is an unintentional example of an availability incident without any major consequences (aside from not being able to withdraw or pay for anything with what you have there).
📃The paper of the week
.- Citizen Lab documents for the first time the infection with mercenary spyware without clicking through targeted ads, a technique it calls AdFection: Al Jazeera devices were infected with Candiru’s, now Integrity Labs’, spyware through ads purchased by Discover-Tech, a company that presented itself as a legitimate advertising platform. Its Controlium tool allowed mercenary clients to choose targets by advertising identifier, cookie, or IP address and serve them code at the moment the ad was displayed. Nearly four billion exposed bid records reveal ads on some 200,000 websites and apps, with impressions on NATO networks, the European Parliament, the Commission, and ministries of numerous countries. For almost six years, millions of Europeans who clicked “Accept” on a TCF banner would have formally consented to a spyware facilitator processing their data. A work by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, among others.
- The newsletter of the week: Yesterday’s edition of the newsletter by Carissa Véliz (The Antidote) is so insightful, it hits the nail on the head so perfectly that it would bring tears to my eyes – if I had any left after watching Naza: Dr. Veliz surgically explains what the speaker loses and what the attendee loses at a live talk when the latter has the bright idea to take out their phone and record a snippet...
Another glaring example of the importance of context in privacy, and there have been quite a few.
Robots.txt or the AI thing…
Today, we only have this…
Reviewing a contract created with AI
“A potential client sends me a contract generated with AI (or a report or a policy) and just wants me to review it. I know that these things don’t happen to you. And if they did, you would quickly know. Has this happened to you? And what would you say?”
🛠️Useful tools
- Don’t miss out on checking out this delightful graphic explanation by Andrea Magán Rey of what is essentially an open-source project.
🙄 The final nonsense.
If you notice any document, comment, or random piece of information that should have clearly been included in this week’s Zero Party Data, write to us or leave a comment, and we will consider it for the next one.
Thank you for reading Zero Party Data! Subscribe for free to receive new posts and support my work.