Investigation | Using easily accessible advertising data, Le Monde was able to pinpoint the identities, home addresses and daily routines of several dozen people working for sensitive official entities.
The identities of French spies are among the Republic’s most closely-guarded secrets. Revealing them is even a criminal offense. Yet, with just a little technical know-how, one can track down the home addresses of certain agents, and thereby discover their identities, daily routines and even those of their loved ones, all of which represent risks to their safety and that of their families and their agencies.
The blame lies with the advertising industry, an insatiable and unregulated sector with no regard for transparency, which extracts billions of personal data points from people’s smartphones every day. This data, which can be used to track people’s movements particularly precisely, down to a few meters, is then resold. Evading such tracking, except for users with flawless digital hygiene, is nearly impossible.
Staff members working for all of France’s most sensitive institutions are affected: intelligence officers, personnel responsible for protecting the country’s top officials, high-ranking police officers, members of the elite National Gendarmerie Intervention Group (GIGN) unit, military personnel stationed at critical nuclear weapons bases, defense company executives, prison staff, and even nuclear power plant staff.
Ireland has entered the chat.
It’s a myth that the GDPR is a useful tool in such cases. You know the expression “protected by copyright”? That’s how lawyers protect data.
The GDPR grants people rights over data concerning them, similar to how copyright grants rights over data. That means 2 things.
It’s rarely obvious that some data processing is illegal. It’s not obvious if it happens without consent. But even so, you often don’t need explicit consent to use someone’s data. EG when we write about French president Macron, then that is Macron’s data under the GDPR. Of course, you don’t need his consent to discuss or report on politics, and so you usually don’t need his consent to discuss his person.
Enforcement is difficult and expensive. Think about the problems the copyright industry has. Surveillance tools like Content ID can at least rely on knowing what exactly they are looking for. Besides, much of the world has similar laws supported by influential industries. Little chance to do that for GDPR.
Basically, using GDPR to protect actual secrets is like using copyright for the purpose.