Yesterday, after posting for the first time in a while, Google alerts me that as a publisher of content on THEIR technology platform, using THEIR tools, that I have a responsibility to notify you (if you happen to live in a European Economic Area) of how I use your personal data, and if necessary obtain your consent, as a result of the General Data Protection Regulations (GDPR).
Conveniently, I don't use your personal data. Instead, I let Google do it all for me. If there are cookies generated by this site, they are generated by Google software. If there is tracking being done by geography, cookie, topic or other data you supply to access this site.
If you happen to be reading this blog through a syndicated site, well, all bets are off because I don't control how those who syndicate this content use your personal data, but they are subject to the same requirements as I am.
I don't use cookies for Ads (because I don't do AdWords or anything like that here). I do use Google Analytics with my blogger account.
But apparently, I still have some responsibilities to you, or at least, that is what Google is telling me.
Here's Google's policies and an explanation of how it uses your data, and how you can opt out of certain uses.
Now, here's what is interesting about what Google did. They transferred their compliance risk to me even though I use their platform and their tools. This is a classic technique to mitigate risk that we look at all the time in developing IHE profiles and other implementation guides. It's one of several techniques for risk mitigation. More often, we apply other technical mitigations (e.g., the use of ATNA or TLS, the requirement for authentication).
If you are reading this site in a European Economic Area, Google tells me that this site will display a notice to you. I've not seen it yet because even though Google tells me I should be able to by using the blogspot.fr or .blogspot.co.uk or similar name, my browser conveniently redirects me to the .com site. So, if you got the notice, please let me know. Otherwise, I may need to do something more.
Keith
P.S. Unlike HIPAA, GDPR doesn't really have an an easily acceptable pronunciation, although it does bring to mind several different acronym decodes. In that, it's somewhat like BPPC.
Conveniently, I don't use your personal data. Instead, I let Google do it all for me. If there are cookies generated by this site, they are generated by Google software. If there is tracking being done by geography, cookie, topic or other data you supply to access this site.
If you happen to be reading this blog through a syndicated site, well, all bets are off because I don't control how those who syndicate this content use your personal data, but they are subject to the same requirements as I am.
I don't use cookies for Ads (because I don't do AdWords or anything like that here). I do use Google Analytics with my blogger account.
But apparently, I still have some responsibilities to you, or at least, that is what Google is telling me.
Here's Google's policies and an explanation of how it uses your data, and how you can opt out of certain uses.
Now, here's what is interesting about what Google did. They transferred their compliance risk to me even though I use their platform and their tools. This is a classic technique to mitigate risk that we look at all the time in developing IHE profiles and other implementation guides. It's one of several techniques for risk mitigation. More often, we apply other technical mitigations (e.g., the use of ATNA or TLS, the requirement for authentication).
If you are reading this site in a European Economic Area, Google tells me that this site will display a notice to you. I've not seen it yet because even though Google tells me I should be able to by using the blogspot.fr or .blogspot.co.uk or similar name, my browser conveniently redirects me to the .com site. So, if you got the notice, please let me know. Otherwise, I may need to do something more.
Keith
P.S. Unlike HIPAA, GDPR doesn't really have an an easily acceptable pronunciation, although it does bring to mind several different acronym decodes. In that, it's somewhat like BPPC.
While Google's instructions failed for me, I did manage to get a look at pages as they would be delivered in Europe, and have verified that you'll get the right notices. So my work for GDPR is hopefully done, at least for this content.
ReplyDelete