Vinted will have to pay a fine of 2.3 million euros for allegedly violating several aspects of the European General Data Protection Regulation (GDPR). The fine follows complaints from several Europeans - Germany, France, Poland, and Spain, and one of the main issues is the practice of 'shadowbanning'. As a result, the Lithuanian regulator SDPI (State Data Protection Inspectorate), where Vinted is registered, has launched an investigation against the company.

According to FashionUnited, the investigation shows that Vinted "does not adequately respect users' right to be forgotten". Vinted members have been asked to provide specific arguments to remove their personal data. If these specifics are not given, Vinted rejects the request, which is not allowed.

Furthermore, SDPI considers that "the fashion platform is not sufficiently transparent about which personal data it uses." In this context, it stresses that the platform practices 'shadowbanning'. That is, Vinted members can be excluded from Vinted without being informed. This practice is applied when the rules of behavior are violated. In such a case, users can still post items for sale, but other users cannot see their ads. SDPI considers this method "illegal."

In response to these accusations, Vinted has explained to the aforementioned media outlet, "We would like to reassure our members that the issues referred to by the Lithuanian data protection authority are in no way related to the security of their accounts nor do they involve abuse or violation of their personal data."

What exactly is Shadowbanning, and why is Vinted accused of doing it? 

Shadow banning, also called stealth banning, hell banning, ghost banning, and comment ghosting, is the practice of blocking or partially blocking a user or the user's content from some areas of an online community in such a way that the ban is not readily apparent to the user, regardless of whether the action is taken by an individual or an algorithm. For example, shadow-banned comments posted to a blog or media website would be visible to the sender, but not to other site users.

This practice is precisely what the EU authorities have accessed Vinted of doing, implying that some users have been banned without them fully knowing this. To this, Vinted has officially responded with the following: 

"We take privacy and GDPR very seriously and have invested heavily in compliance and protection of our members, collaborating throughout this process with the VDAI. However, we have found no legal basis for this decision and believe it sets a new precedent that goes beyond the current wording of the law and industry best practices. We fundamentally disagree with this fine and will continue to appeal, as we have throughout this process," the company said.

"Regarding the VDAI's decision on shadowbanning processes, which we used in the past to keep our platform and our members safe, we would like to reiterate that we no longer use these processes. We regularly evaluate these measures and adjust them to align with technological advances and changing legal regulations," they reiterated.

The post Vinted fined 2.3 million euros for ‘shadowbanning’ + Vinted official response  appeared first on Cross-Border Magazine.

Meta has issued a statement confirming that it will halt plans to train its Artificial Intelligence (AI) systems using user data in the European Union and the United Kingdom. In doing so, the company will follow the measures requested by the Irish Data Protection Commission (DPC) and the UK's Information Commissioner's Office (ICO) to delay training our large language models (LLMs) using public content shared by adults on Facebook and Instagram.

"The DPC welcomes Meta's decision to pause its plans to train its large language model using public content shared by adults on Facebook and Instagram across the EU and EEA," the DPC said in a statement. "This decision followed intense engagement between the DPC and Meta. In cooperation with its EU data protection authorities, the DPC will continue to engage with Meta on this issue."

The tech company has stated that they continue to work with the DPC so that people in Europe can have access "to the same level of AI innovation as the rest of the world" because the company will continue to train its AI with users in other markets such as the U.S. where regulations are not as strict. 

In the statement, it has also clarified that this will cause that "if we don't train our models on the public content that Europeans share on our services and others, such as posts or public comments, then the models and the AI features they power will not accurately understand important regional languages, cultures or hot topics. social media."

The post Meta halts the training if its AI systems in the EU appeared first on Cross-Border Magazine.

The European Union aims to strengthen the General Data Protection Regulation (GDPR) to the maximum and facilitate cooperation among the 27 member states in cross-border investigations. As a result, investigations into Big Tech companies will be more efficient than ever.

The main objective is to enhance the harmonized rules since their creation, as they are considered too lenient and slow, with legal supremacy in privacy disputes remaining in the hands of Ireland and Luxembourg, where investigations into Facebook, Google, Apple, Twitter, and Amazon have been conducted.

On July 4th, the new proposal was unveiled, with the European Commission aiming to "strengthen citizens' trust by facilitating faster resolution of investigations and reducing the number of disputes between supervisory authorities."

The new regulation establishes different points, such as whistleblowers having the right to be heard and being able to participate if regulators decide to investigate their complaints. On the other hand, the companies under investigation will be heard at key stages, have the opportunity to provide clarifications, and access the case file.

The GDPR will pressure Big Tech companies

In investigations involving Big Tech, authorities under the GDPR must share a summary identifying key elements, present their views in the early stages, and use cooperation tools such as joint investigations and mutual assistance.

Technology companies have already begun to take action. For example, Microsoft has been announcing changes since January 1st. Starting this year, users of their European cloud have their data stored and managed within European soil. This has been called the "EU data boundary" and applied to all their cloud services (Azure, Microsoft 365, Dynamics 365, and Power BI).

On the other hand, Meta, the owner of Facebook, has been the company sanctioned with the highest amount for violating the GDPR in Europe, with fines amounting to 1.2 billion euros. Amazon follows with 746 million euros.

The post The Big Tech companies face new and stringent European privacy rules appeared first on Cross-Border Magazine.

The EU General Data Protection Regulation (GDPR) replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy. The aim is to enable information to be freely shared internally across borders for companies that operate across the EU, but at the same time aims to make it clearer and give more control to individuals as to what companies can do with the data they hold on you.

Many small marketplace traders need not be overly concerned about the implications of the GDPR. However, entrepreneurs still need to be aware of its reach. Comply if necessary, fines can get up to 4% of your (global) turnover. The full impact of the GDPR is only applicable for data controllers and/or processors, i.e. when organizations store information on your customers. If you purely trade on marketplaces and take payment through services such as PayPal, then the impact of the GDPR may be minimal. It’ll be down to the marketplace and payment provider to keep the customer’s data safe and secure. However, if you download customer data and store it on your local hard drive or on a web server then the GDPR definitely applies to you.

The same situation arises if you have your own website/ web shop. If it is a hosted service then you won’t be storing customer data yourself. Again, download your customer data and you need to take a lot more notice of the GDPR. Ultimately, organizations should familiarise themselves with the GDPR requirements which classify more identifiers as ‘personal data’. Under the GDPR even an IP address can be construed as a personal identifier.

If you’re unsure as to how to proceed, the Information Commissioners Office has a data protection self assessment survey to help you get ready for the GDPR. Find key changes of the GDPR here.

The post Will the General Data Protection Regulation apply to you? appeared first on Cross-Border Magazine.