German Big Brother Awards call out top privacy abusers

On Friday, 11 June 2021, the German Big Brother Awards (BBA) gala was held in Bielefeld, Germany. Organised by EDRi member Digitalcourage with jury members and support from several German groups, including other EDRi members, these awards have been held since 2000. This was the second edition to take place under pandemic restrictions. Hence, the event was further focused on its online format and on interactivity: along with the traditional audience award, feedback from social media, including questions to jury members, was featured in between the award speeches.

Another continuing feature was bilingual coverage. For more than 15 years, translations of the award speeches have been published in the English section of the BBA website. More recently, Digitalcourage has started to provide the event’s livestream with English interpretation as well.

An award in the “Mobility” category was given to the European Commission for their implementation of an On-Board Fuel Consumption Meter (OBFCM) as mandated in EU Regulation 2019/631 in the course of European environmental policy. The measure was criticised for its extensive collection of movement data and for giving the role of collecting these data to car manufacturers, despite the fact that we have seen a desire by manufacturers to collect and claim ownership of extensive amounts of these data for themselves, and a long-time practice of manipulating emissions data of their products.

In the “Education” category, the company Proctorio was recognised for their software of the same name. Proctorio offers automatic supervision of remotely conducted exams. As the award speech points out, this involves severe intrusions into students’ own devices that are used for the exam as well as violations of students’ privacy. Fairness and equality of opportunity are gravely impaired by moving exams into students’ living spaces whose suitability depends on individual – including financial – circumstances. Automated decision-making obstructs transparency and suspends the presumption of innocence. The legal basis given by the company seems dubious as well.

Two new categories were featured in these Big Brother Awards, the first of which was “Public Intellectual”. The awardee was Julian Nida-Rümelin, a philosopher, holder of several academic titles, former Cultural Minister of State, and current vice-chairperson of the German Ethics Council, where he serves as press contact for digitalisation. In a number of media appearances, Nida-Rümelin had lamented that data protection rules prevented effective measures against the Corona crisis. The award speech stresses that he had repeated his claims over several months and even after these had been disproved in detail, e.g. in blog posts and podcasts by Linus Neumann of the Chaos Computer Club. The award speech disapproves, saying that “data protection” was made an easy scapegoat and necessary standards in the public debate were being abandoned even by a high-profile thinker whose task it would be to choose and verify his arguments conscientiously, but who had instead opted for cheap populism.

In response, Mr Nida-Rümelin sent a video message which was played at the gala. He said that he would have liked to visit the gala in person had he been given more notice. He described himself as a humanist philosopher with a critical attitude towards digitalisation who is not opposed to data protection law but to the way it has been applied to tackling the Corona pandemic. Since the gala, a short discussion between the awardee and the laudator has taken place on German public radio. The debate has thus continued but a consensus has not been reached.

The second new category was called “What makes me really angry”. This award speech was a sweeping indictment of tracking and monopolies on the web, from cookies and other tracking technologies via controversial practices in online advertising (“Real-time Bidding”) to recent discoveries of anti-competitive behaviour by Google. This award, like the previous one, sets out to exonerate data protection law from being responsible for an annoyance, in this case, cookie banners with their deceitful “dark pattern” designs. It mentions that EDRi member noyb from Austria recently issued more than 500 complaints against illegally designed banners. The speech goes on to describe behind-the-scenes auctions for advertising space, or rather, for the surfer’s attention. In this process, detailed information on surfers is made available to large numbers of players without transparency, and it is actually these players that take the majority of online advertising revenue. Finally, the speech identifies Google as the “self-nominated” winner of this award, for taking part in all these activities and for engaging in anti-competitive behaviour in abuse of its double role as both an auctioneer and a bidder in these auctions. This had recently been unveiled in documents filed by Google to a Texas court that had inadvertently been provided in unredacted form. As the speech put it, through these practices “users are snooped upon and media providers are starved out”. The laudation ends with a signal of hope, pointing to examples where media websites had achieved good results by abandoning tracking-based advertising and taking back control of their ad space and revenue.

The final award went to the company Doctolib, whose appointment scheduling platform is being promoted to an increasing number of medical doctor’s practices and local health authorities in Germany and France. The speech describes the software as an enticing offer to both doctors and patients, and the German company as gaining a foothold in a European market that had up to now been unavailable at least for non‑EU players due to the health sector’s specific privacy requirements. On its website, Doctolib professes adherence to all relevant regulations. But according to the laudation, the company’s practices are not actually oriented toward these rules and patients can find themselves without privacy-friendly alternatives. In breach of one particular requirement, the platform is said to use much more data than necessary, requiring access to a practice’s full patient list instead of just focusing on the availability of time slots. This is accompanied by an overwhelming amount of unclear terms and privacy statements, a lack of isolation from third-party tracking and a lack of separation between individual doctors’ data and Doctolib’s own databases. The latter issue had been illustrated by the presentation of a data leak at the 2020 Chaos Communication Congress.

The award to Doctolib was also chosen by the online audience as the award they found most “impressive, astonishing, shocking, revolting”. It received just over a third of the votes, closely followed by the award to Google.

Comprehensive English information on the 2021 German Big Brother Awards – including a recording of the livestream with English audio – can be found on https://bigbrotherawards.de/en/2021.

Image credit: Digitalcourage

(Contribution by: Sebastian Lisken, EDRi member Digitalcourage)