EMBARRASING: EU’s executive arm violates its own privacy laws

12/20/2024 / By Laura Harris

The European Data Protection Supervisor (EDPS) confirmed that the European Commission violated EU privacy laws through its “Chat Control” proposal.
The EU launched targeted ads on X (formerly Twitter) to sway public opinion on the “Chat Control” proposal. However, the campaign used micro-targeting that processed citizens’ sensitive political data without consent.
Regional nonprofit noyb filed a complaint citing unlawful micro-targeting and unauthorized processing of citizens’ personal data. In December 2024, the EDPS validated these concerns, declaring the campaign unlawful under Articles 4(1)(a), 4(2), 5, 10(1) and 26 of the Regulation.
This incident highlights a growing discrepancy between the EU’s stringent regulation of tech companies under guidelines like GDPR and its own privacy practices.
Despite the lack of financial penalties, the scandal severely damages the EU’s reputation, potentially negating its previous efforts to establish strict privacy regulations.

The European Union (EU) has faced an embarrassing setback after the European Data Protection Supervisor (EDPS) confirmed that the bloc’s executive arm, the European Commission, violated its own privacy laws.

“Chat Control” proposal, launched in the fall of 2023 by the Commission’s Directorate General for Migration and Home Affairs, was designed to sway public opinion in favor of the new legislation, which would require messaging platforms to scan every user’s communication for traces of child sexual abuse material (CSAM). (Related: U.K. set to launch controversial DIGITAL ID system in 2025, sparking privacy concerns.)

However, the implementation drew fire from privacy advocates who saw it as a significant threat to digital privacy and end-to-end encryption.

The EU, known for its stringent regulation of tech companies under guidelines like the General Data Protection Regulation (GDPR), launched targeted ads on X, formerly known as Twitter. The EU used micro-targeting that processed citizens’ sensitive political data without their consent. This move was seen as particularly ironic by critics, given the EU’s own role in enforcing privacy protections against tech giants like Meta and Google.

Regional nonprofit noyb, short for “none of your business,” filed a complaint almost immediately, The non-profit organization cited the unlawful micro-targeting and unauthorized processing of citizens’ political views. In December 2024, the EDPS validated these concerns and declared the campaign unlawful.

“The EDPS finds that the Commission has infringed Articles 4(1)(a), 4(2), 5, 10(1) and 26 of the Regulation by unlawfully processing the complainant’s personal data, including special categories of personal data, without a valid legal basis in the context of the targeted advertising campaign that the Commission ran on the social media platform X from 15 to 28 September 2023, as referred in point 2.1. of the present decision,” EDPS wrote.

The Commission was given a sternly worded letter, but no fine or tangible consequences were imposed.

EU’s hypocrisy EXPOSED

This fiasco exposes a widening gap between the EU’s lofty rhetoric on privacy and its actual practices.

“The Commission routinely paints itself as the defender of citizens’ rights against the excesses of Silicon Valley. But when push comes to shove, they seem perfectly willing to dip their hands into the same Big Data cookie jar they claim to regulate,” Christina Maas wrote in her article for Reclaim the Net.

Maas then added that the EU has spent the past decade crafting some of the world’s strictest privacy regulations, such as the GDPR, which caused CEOs to lose sleep and inboxes to be flooded with privacy policy updates. Yet, when it came to their own questionable advertising practices, they seemed exempt from these very rules.

In turn, Maas concluded that the reputational damage to the EU is already substantial even though the EDPS ruling may not come with financial penalties.

“For one, it undermines the EU’s credibility in regulating tech giants. After all, how can Brussels wag its finger at Meta or Google for privacy violations when it’s guilty of the same? And let’s not forget the broader implications for the Commission’s “Chat Control” proposal. If the public wasn’t already skeptical, this scandal has poured gasoline on the fire. Opposition groups will undoubtedly use this incident as Exhibit A in their argument that the EU’s surveillance agenda is both dangerous and hypocritical,” Maas wrote.

Follow PrivacyWatch.news for more news about the digital ID system.

Watch this clip about the Australian government officially passing the digital ID bill in the Land Down Under.

This video is from the Fritjof Persson channel on Brighteon.com.