Recherche avancée

Sur d’autres sites (7617)

• What is data anonymization in web analytics ?

  11 février 2020, par Joselyn Khor — Analytics Tips, Privacy
  Collecting information via web analytics platforms is needed to help a website grow and improve. When doing so, it’s best to strike a balance between getting valuable insights, and keeping the trust of your users by protecting their privacy.

  This means not collecting or processing any personally identifiable information (PII). But what if your organisation requires you to collect PII ?

  That’s where data anonymization comes in.

  

  What is data anonymization ?

  Data anonymization makes identifiable information unidentifiable. This is done through data processing techniques which remove or modify PII data. So data becomes anonymous and can’t be linked to any individual.

  In the context of web analytics, data anonymization is handy because you can collect useful data while protecting the privacy of website visitors.

  Why is data anonymization important ?

  Through modern threats of identity theft, credit card fraud and the like, data anonymization is a way to protect the identity and privacy of individuals. As well as protect private and sensitive information of organisations. 

  Data anonymization lets you follow the many laws around the world which protect user privacy. These laws provide safeguards around collecting personal data or personally identifiable information (PII), so data anonymization is a good solution to ensure you’re not processing such sensitive information.

  In some cases, implementing data anonymization techniques means you can avoid having to show your users a consent screen. Which means you may not need to ask for consent in order to track data. This is a bonus as consent screens can annoy and stop people from engaging with your site.

  GDPR and data anonymization

  

  The GDPR is a law in the EU that limits the collection and processing of personal data. The aim is to give people more control over their online personal information. Which is why website owners need to follow certain rules to become GDPR compliant and protect user privacy. According to the GDPR, you can be fined up to 4% of your yearly revenue for data breaches or non-compliance. 

  In the case of web analytics, tools can be easily made compliant by following a number of steps. 

  This is why anonymizing data is a big deal.

  Anonymized data isn’t personal data according to the GDPR : 

  “The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.”

  This means, you still get the best of both worlds. By anonymizing data, you’re still able to collect useful information like visitor behavioural data.

  US privacy laws and data anonymization

  In the US, there isn’t one single law that governs the protection of personal data, called personally identifiable information (PII). There are hundreds of federal and state laws that protect the personal data of US residents. As well as, industry-specific statutes related to data privacy, like the California Consumer Privacy Act (CCPA) and the Health Insurance Portability and Accountability Act (HIPAA).

  Website owners in the US need to know exactly what laws govern their area of business in order to follow them.

  A general guideline is to protect user privacy regardless of whether you are or aren’t allowed to collect PII. This means anonymizing identifiable information so your website users aren’t put at risk.

  Data anonymization techniques in Matomo Analytics

  If you carry these out, you won’t need to ask your website visitors for tracking consent since anonymized data is no longer considered personal data under the GDPR.

  • Anonymize previously tracked raw data – like visitors/visits
  • Anonymize Visitor IP addresses
  • Anonymize geo-location information (country, region, city)
  • Pseudonymize User ID ( if you don’t want this data to land on your Matomo server, the solution is simply to not set the User ID. Then Matomo will use the normal anonymized IDs)
  • Data can also be anonymized before it’s even sent to Matomo
  • Learn how to further configure privacy settings in a web analytics tool like Matomo
  • 11 ways Matomo Analytics helps you to protect your visitors privacy

  The techniques listed above make it easy for you when using a tool like Matomo, as they are automatically anonymized.

  Tools like Google Analytics on the other hand don’t provide some of the privacy options and leave it up to you to take on the burden of implementation without providing steps.

  Data anonymization tools

  If you’re a website owner who wants to grow your business or learn more about your website visitors, privacy-friendly tools like Matomo Analytics are a great option. By following the easy steps to be GDPR compliant, you can anonymize all data that could put your visitors at risk.

• How to complete your privacy policy with Matomo analytics under GDPR

  25 avril 2018, par InnoCraft

  Important note : this blog post has been written by digital analysts, not lawyers. The purpose of this article is to show you how to complete your existing privacy policy by adding the parts related to Matomo in order to comply with GDPR. This work comes from our interpretation of the UK privacy commission : ICO. It cannot be considered as professional legal advice. So as GDPR, this information is subject to change. We strongly advise you to have a look at the different privacy authorities in order to have up to date information. This blog post contains public sector information licensed under the Open Government Licence v3.0.

  Neither the GDPR official text or ICO are mentioning the words ‘privacy policy’. They use the words ‘privacy notice’ instead. As explained within our previous blog post about “How to write a privacy notice for Matomo”, the key concepts of privacy information are transparency and accessibility which are making the privacy notice very long.

  As a result, we prefer splitting the privacy notice into two parts :

  • Privacy notice : straight to the point information about how personal data is processed at the time of the data collection. This is the subject of the our previous blog post.
  • Privacy policy : a web page explaining in detail all the personal data you are processing and how visitors/users can exercise their rights. This is the blog post you are reading.

  Writing/updating your privacy policy page can be one of the most challenging task under GDPR.

  In order to make this mission less complicated, we have designed a template which you can use to complete the privacy policy part that concerns Matomo.

  Which information should your privacy policy include ?

  ICO is giving a clear checklist about what a privacy policy has to contain when the data is obtained from the data subject :

  1. Identity and contact details of the controller and where applicable, the controller’s representative and the data protection officer.
  2. Purpose of the processing and the legal basis for the processing.
  3. The legitimate interests of the controller or third party, where applicable.
  4. Any recipient or categories of recipients of the personal data.
  5. Details of transfers to third country and safeguards.
  6. Retention period or criteria used to determine the retention period.
  7. The existence of each of data subject’s rights.
  8. The right to withdraw consent at any time, where relevant.
  9. The right to lodge a complaint with a supervisory authority.
  10. Whether the provision of personal data part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data.
  11. The existence of automated decision-making, including profiling and information about how decisions are made, the significance and the consequences.

  So in order to use Matomo with due respect to GDPR you need to answer each of those points within your privacy policy.

  Matomo’s privacy policy template

  You will find below some examples to each point requested by GDPR. Those answers are just guidelines, they are not perfect, feel free to copy/paste them according to your needs.

  Note that this template needs to be tweaked according to the lawful basis you choose.

  1 – About Matomo

  Note : this part should describe the data controller instead, which is your company. But as you may already have included this part within your existing privacy policy, we prefer here to introduce what is Matomo.

  Matomo is an open source web analytics platform. A web analytics platform is used by a website owner in order to measure, collect, analyse and report visitors data for purposes of understanding and optimizing their website. If you would like to see what Matomo looks like, you can access a demo version at : https://demo.matomo.org.

  2 – Purpose of the processing

  Matomo is used to analyse the behaviour of the website visitors to identify potential pitfalls ; not found pages, search engine indexing issues, which contents are the most appreciated… Once the data is processed (number of visitors reaching a not found pages, viewing only one page…), Matomo is generating reports for website owners to take action, for example changing the layout of the pages, publishing some fresh content… etc.

  Matomo is processing the following personal data :

  Pick up the one you are using :

  • Cookies
  • IP address
  • User ID
  • Custom Dimensions
  • Custom Variables
  • Order ID
  • Location of the user

  And also :

  • Date and time
  • Title of the page being viewed
  • URL of the page being viewed
  • URL of the page that was viewed prior to the current page
  • Screen resolution
  • Time in local timezone
  • Files that were clicked and downloaded
  • Link clicks to an outside domain
  • Pages generation time
  • Country, region, city
  • Main Language of the browser
  • User Agent of the browser

  This list can be completed with additional features such as :

  • Session recording, mouse events (movements, content forms and clicks)
  • Form interactions
  • Media interactions
  • A/B Tests

  Pick up one of the two :

  1. The processing of personal data with Matomo is based on legitimate interests, or :
  2. The processing of personal data with Matomo is based on explicit consent. Your privacy is our highest concern. That’s why we will not process any personal data with Matomo unless you give us clear explicit consent.

  3 – The legitimate interests

  This content applies only if you are processing personal data based on legitimate interests. You need here to justify your legitimate interests to process personal data. It is a set of questions described here.

  Processing your personal data such as cookies is helping us identify what is working and what is not on our website. For example, it helps us identify if the way we are communicating is engaging or not and how we can organize the structure of the website better. Our team is benefiting from the processing of your personal data, and they are directly acting on the website. By processing your personal data, you can profit from a website which is getting better and better.

  Without the data, we would not be able to provide you the service we are currently offering to you. Your data will be used only to improve the user experience on our website and help you find the information you are looking for.

  4 – Recipient of the personal data

  The personal data received through Matomo are sent to :

  • Our company.
  • Our web hosting provider : name and contact details of the web hosting provider.

  Note : If you are using the Matomo Analytics Cloud by InnoCraft the web hosting provider is “InnoCraft, 150 Willis St, 6011 Wellington, New Zealand“.

  5 – Details of transfers to third country and safeguards

  Matomo data is hosted in Name of the country.

  If the country mentioned is not within the EU, you need to mention here the appropriate safeguards, for example : our data is hosted in the United States within company XYZ, registered to the Privacy Shield program.

  Note : The Matomo Analytics Cloud by InnoCraft is currently hosted in France. If you are using the cloud-hosted solution of Matomo, use “France” as name of the country.

  6 – Retention period or criteria used to determine the retention period

  We are keeping the personal data captured within Matomo for a period of indicate here the period.

  Justify your choice, for example : as our data is hosted in France, we are applying the French law which defines a retention period of no more than 13 months. You can set the retention period in Matomo by using the following feature.

  7 – The existence of each of the data subject’s rights

  If you are processing personal data with Matomo based on legitimate interest :

  As Matomo is processing personal data on legitimate interests, you can exercise the following rights :

  • Right of access : you can ask us at any time to access your personal data.
  • Right to erasure : you can ask us at any time to delete all the personal data we are processing about you.
  • Right to object : you can object to the tracking of your personal data by using the following opt-out feature :

  Insert here the opt-out feature.

  If you are processing personal data with Matomo based on explicit consent :

  As Matomo is processing personal data on explicit consent, you can exercise the following rights :

  • Right of access : you can ask us at any time to access your personal data.
  • Right to erasure : you can ask us at any time to delete all the personal data we are processing about you.
  • Right to portability : you can ask us at any time for a copy of all the personal data we are processing about you in Matomo.
  • Right to withdraw consent : you can withdraw your consent at any time by clicking on the following button.

  8 – The right to withdraw consent at any time

  If you are processing personal data under the consent lawful basis, you need to include the following section :

  You can withdraw at any time your consent by clicking here (insert here the Matomo tracking code to remove consent).

  9 – The right to lodge a complaint with a supervisory authority

  If you think that the way we process your personal data with Matomo analytics is infringing the law, you have the right to lodge a complaint with a supervisory authority.

  10 – Whether the provision of personal data is part of a statutory or contractual requirement ; or obligation and possible consequences of failing to provide the personal data

  If you wish us to not process any personal data with Matomo, you can opt-out from it at any time. There will be no consequences at all regarding the use of our website.

  11 – The existence of automated decision-making, including profiling and information about how decisions are made, the significance and the consequences

  Matomo is not doing any profiling.

   

  That’s the end of our blog post. We hope you enjoyed reading it and that it will help you get through the GDPR compliance process. If you have any questions dealing with this privacy policy in particular, do not hesitate to contact us.

  The post How to complete your privacy policy with Matomo analytics under GDPR appeared first on Analytics Platform - Matomo.

• Vedanti and Max Sound vs. Google

  14 août 2014, par Multimedia Mike — Legal/Ethical

  Vedanti Systems Limited (VSL) and Max Sound Coporation filed a lawsuit against Google recently. Ordinarily, I wouldn’t care about corporate legal battles. However, this one interests me because it’s multimedia-related. I’m curious to know how coding technology patents might hold up in a real court case.

  Here’s the most entertaining complaint in the lawsuit :

  Despite Google’s well-publicized Code of Conduct — “Don’t be Evil” — which it explains is “about doing the right thing,” “following the law,” and “acting honorably,” Google, in fact, has an established pattern of conduct which is the exact opposite of its claimed piety.

  I wonder if this is the first known case in which Google has been sued over its long-obsoleted “Don’t be evil” mantra ?

  Researching The Plaintiffs
  
  I think I made a mistake by assuming this lawsuit might have merit. My first order of business was to see what the plaintiff organizations have produced. I have a strong feeling that these might be run of the mill patent trolls.

  VSL currently has a blank web page. Further, the Wayback Machine only has pages reaching back to 2011. The earliest page lists these claims against a plain black background (I’ve highlighted some of the more boisterous claims and the passages that make it appear that Vedanti doesn’t actually produce anything but is strictly an IP organization) :

  The inventions key :
  The patent and software reduced any data content, without compressing, up to a 97% total reduction of the data which also produces a lossless result. This physics based invention is often called the Holy Grail.

  Vedanti Systems Intellectual Property
  Our strategic IP portfolio is granted in all of the world’s largest technology development and use countries. A major value indemnification of our licensee products is the early date of invention filing and subsequent Issue. Vedanti IP has an intrinsic 20 year patent protection and valuation in royalties and licensing. The original data transmission art has no prior art against it.

  Vedanti Systems invented among other firsts, The Slice and Partitioning of Macroblocks within a RGB Tri level region in a frame to select or not, the pixel.

  Vedanti Systems invention is used in nearly every wireless chipset and handset in the world

  Our original pixel selection system revolutionized wireless handset communications. An example of this system “Slice” and “Macroblock Partitioning” is used throughout Satellite channel expansion, Wireless partitioning, Telecom – Video Conferencing, Surveillance Cameras, and 2010 developing Media applications.

  Vedanti Systems is a Semiconductor based software, applications, and IP Continuations Intellectual Property company.

  Let’s move onto the other plaintiff, Max Sound. They have a significantly more substantive website. They also have an Android app named Spins HD Audio, which appears to be little more than a music player based on the screenshots.

  Max Sound also has a stock ticker symbol : MAXD. Something clicked into place when I looked up their ticker symbol : While worth only a few pennies, it was worth a few more pennies after this lawsuit was announced, which might be one of the motivations behind the lawsuit.

  Here’s a trick I learned when I was looking for a new tech job last year : When I first look at a company’s website and am trying to figure out what they really do, I head straight to their jobs/careers page. A lot of corporate websites have way too much blathering corporatese that can be tough to cut through. But when I see what mix of talent and specific skills they are hoping to hire, that gives me a much better portrait of what the company does.

  The reason I bring this up is because this tech company doesn’t seem to have jobs/careers page.

  The Lawsuit
  The core complaint centers around Patent 7974339 : Optimized data transmission system and method. It was filed in July 2004 (or possibly as early as January 2002), issued in July 2011, and assigned (purchased ?) by Vedanti in May 2012. The lawsuit alleges that nearly everything Google has ever produced (or, more accurately, purchased) leverages the patented technology.

  The patent itself has 5 drawings. If you’ve ever seen a multimedia codec patent, or any whitepaper on a multimedia codec, you’ve seen these graphs before. E.g., “Raw pixels come in here -> some analysis happens here -> more analysis happens over here -> entropy coding -> final bitstream”. The text of a patent document isn’t meant to be particularly useful. I’ve tried to understand this stuff before and it never goes well. Skimming the text, I just see a blur of the words data, transmission, pixel, and matrix.

  So I read the complaint to try to figure out what this is all about. To summarize the storyline as narrated by the lawsuit, some inventors were unhappy with the state of video compression in 2001 and endeavored to create something better. So they did, and called it the VSL codec. This codec is so far undocumented on the MultimediaWiki, so it probably has yet to be seen “in the wild”. Good luck finding hard technical data on it now since searches for “VSL codec” are overwhelmed by articles about this lawsuit. Also, the original codec probably wasn’t called VSL because VSL is apparently an IP organization formed much later.

  Then, the protagonists of the lawsuit patented the codec. Then, years later, Google wanted to purchase a video codec that they could open source and use to supplant H.264.

  The complaint goes on to allege that in 2010, Google specifically contacted VSL to possibly license or acquire this mysterious VSL technology. Google was allegedly allowed to study the technology, eventually decided not to continue discussions, and shipped back the proprietary materials.

  Here’s where things get weird. When Google shipped back the materials, they allegedly shipped back a bunch of Post-It notes. The notes are alleged to contain a ton of incriminating evidence. The lawsuit claims that the notes contained such tidbits as :

  • Google was concerned that its infringement could be considered “recklessness” (the standard applicable to willful infringement) ;
  • Google personnel should “try” to destroy incriminating emails ;
  • Google should consider a “design around” because it was facing a “risk of litigation.”

  Actually, given Google’s acquisition of On2, I can totally believe that last one (On2’s codecs have famously contained a lot of weirdness which is commonly suspected to be attributable to designing around known patents).

  Anyway, a lot of this case seems to hinge on the authenticity of these Post-It notes :

  “65. The Post-It notes are unequivocal evidence of Google’s knowledge of the ’339 Patent and infringement by Defendants”

  I wish I could find a stock photo of a stack of Post-It notes in an evidence bag.

  I’ve worked at big technology companies. Big tech companies these days are very diligent about indoctrinating employees about IP liability issues. The reason this Post-It situation strikes me as odd is because the alleged contents of the notes basically outline everything the corporate lawyers tell you NOT to do.

  Analysis
  I’m trying to determine what specific algorithms and coding techniques. I guess I was expecting to see a specific claim that, “Our patent outlines this specific coding technique and here is unequivocal proof that Google A) uses the same technique, and B) specifically did so after looking at our patent.” I didn’t find that (well, a bit of part B, c.f., the Post-It note debacle), but maybe that’s not how these patent lawsuits operate. I’ve never kept up before.

  Maybe it’s just a patent troll. Maybe it’s for the stock bump. I’m expecting to see pump-n-dump stock spam featuring the stock symbol MAXD anytime now.

  I’ve never been interested in following a lawsuit case carefully before. I suddenly find myself wondering if I can subscribe to the RSS feed for this case ? Too much to hope for. But I found this item through Pando and maybe they’ll stay on top of it.