diff --git a/assets/styles/elements.scss b/assets/styles/elements.scss index 3e1357fa2..4b8399216 100644 --- a/assets/styles/elements.scss +++ b/assets/styles/elements.scss @@ -1229,6 +1229,7 @@ details.footnote { flex-wrap: nowrap; justify-content: space-between; margin-bottom: 15px; + column-gap: 5px; .dropdown-container { &:focus > .dropdown, diff --git a/assets/styles/framework.scss b/assets/styles/framework.scss index d0aed89c3..a44843073 100644 --- a/assets/styles/framework.scss +++ b/assets/styles/framework.scss @@ -476,3 +476,17 @@ ul { .focus-anchor { outline: none; } + +// Distinguish consecutive footnotes. +.footnote summary { + ::before { + content: '['; + } + ::after { + content: ']'; + } +} + +.footnotes ol > li::marker { + content: '[' counter(list-item) ']\2003'; +} diff --git a/assets/styles/main.scss b/assets/styles/main.scss index f5d75e614..7ab4d275e 100644 --- a/assets/styles/main.scss +++ b/assets/styles/main.scss @@ -1165,3 +1165,7 @@ article.page, .slides > div { scroll-snap-align: start; } + +address { + font-style: normal; +} diff --git a/config/_default/params.toml b/config/_default/params.toml index c0c908966..92b13159a 100644 --- a/config/_default/params.toml +++ b/config/_default/params.toml @@ -1,5 +1,5 @@ [authors.baltpeter] -byline = "Benjamin Altpeter" +byline = "Benjamin Altpeter" short_name = "Benni" # Sorry but there was no way to preserve the capitalization. :( diff --git a/content/de/contact.md b/content/de/contact.md index 72dff0ea4..5cf741d11 100644 --- a/content/de/contact.md +++ b/content/de/contact.md @@ -6,6 +6,7 @@ ## Angaben gemäß § 5 TMG +
**Postanschrift** (keine Bürozeiten): Datenanfragen.de e. V. Schreinerweg 6 @@ -16,6 +17,7 @@ Deutschland **Telefax:** +49 531 209299 36 **E-Mail:** kontakt@datenanfragen.de ([PGP-Key](/pgp/62A7EC35.asc) `B64A 852D F7DF 855C A058 0A00 FC74 1754 62A7 EC35`) **Web:** [www.datenanfragen.de/verein](https://www.datenanfragen.de/verein) +
**Vertreten durch den Vorstand:** Benjamin Altpeter und Lorenz Sieben Der Datenanfragen.de e. V. ist im Vereinsregister des Amtsgerichts Braunschweig unter der [Registernummer VR 201732](https://static.dacdn.de/docs/vereinsregisterabdruck_2020-09-11.pdf "Aktueller Abdruck aus dem Vereinsregister vom 11. September 2020") eingetragen und zuletzt per [Bescheid vom 30. Januar 2023](https://static.dacdn.de/docs/freistellungsbescheid_2023-01-30.pdf) vom Finanzamt Braunschweig-Wilhelmstraße als gemeinnützig anerkannt. diff --git a/content/de/donate.md b/content/de/donate.md index 7c4a759e2..677423d9c 100644 --- a/content/de/donate.md +++ b/content/de/donate.md @@ -46,10 +46,12 @@ Als gemeinnütziger Verein stellen wir Dir natürlich auch gerne eine [Spendenbe Wenn Du uns Deine Identität nicht preisgeben möchtest, kannst Du entweder eine anonyme Cryptowährung verwenden oder Bargeld per Post an unsere Adresse schicken: +
*Datenanfragen.de e. V. Schreinerweg 6 38126 Braunschweig Deutschland* +
Für Bargeldspenden kannst Du auch ein Produkt wie [WERT NATIONAL](https://www.deutschepost.de/de/w/wert-national.html) von der Deutschen Post verwenden, um die Spende gegen Verlust abzusichern. Bitte sorg dafür, dass sich in keinem Fall von außen erkennen lässt, dass Deine Sendung Geld enthält. diff --git a/content/de/privacy.md b/content/de/privacy.md index b4d6a271b..ea7320058 100644 --- a/content/de/privacy.md +++ b/content/de/privacy.md @@ -33,6 +33,7 @@ Mit unserer Webseite Datenanfragen.de (sowie deren Übersetzungen) wollen wir Di Verantwortlicher für die im Abschnitt „Geltungsbereich“ genannten Angebote im Sinne des Art. 4 Nr. 7 DSGVO ist der: +
Datenanfragen.de e. V. Schreinerweg 6 38126 Braunschweig @@ -45,6 +46,7 @@ Telefon: +49 531 209299 35 Telefax: +49 531 209299 36 E-Mail: [datenschutz@datenanfragen.de](mailto:datenschutz@datenanfragen.de) ([PGP-Key](https://www.datenanfragen.de/pgp/CF2CBB2E.asc) `CC13 973A F8FD 11D1 4D94 98A8 0269 92F0 CF2C BB2E`) Web: [www.datenanfragen.de/verein](https://www.datenanfragen.de/verein) +
Falls Du irgendwelche Fragen zu unserer Datenschutzerklärung hast, der Meinung bist, dass wir gegen Datenschutzrecht verstoßen oder Deine Rechte geltend machen möchtest, kannst Du Dich gerne jederzeit an uns wenden. diff --git a/content/de/verein/board.md b/content/de/verein/board.md index 9c7049e2c..18a96d29e 100644 --- a/content/de/verein/board.md +++ b/content/de/verein/board.md @@ -7,6 +7,7 @@ Alle wichtigen laufenden Geschäfte des Vereins werden vom Vorstand erledigt, der ebenfalls die Geschäftsführung innehat. Laut unserer {{< link slug="verein/constitution#7-der-vorstand" text="Satzung" >}} besteht der Vorstand aus zwei gleichberechtigten Vorsitzenden, die den Verein gemeinsam vertreten und beliebig vielen Beisitzer_innen, die den Vorstand in seiner Arbeit kontrollieren und unterstützen. Unser aktueller Vorstand besteht seit der Wahl auf der Mitgliederversammlung vom 16. Juli 2020 aus: +
* Benjamin Altpeter, Vorsitzender ([benni@datenanfragen.de](mailto:benni@datenanfragen.de), [PGP-Key](/pgp/AF1381BD.asc) `9F99 3663 0B82 D3C7 DFC9  23F6 EB5C F074 AF13 81BD`) * Lorenz Sieben, Vorsitzender ([lorenz@datenanfragen.de](mailto:lorenz@datenanfragen.de), [PGP-Key](/pgp/4C44A6EF.asc) @@ -28,3 +29,5 @@ Wenn Du den Vorstand kontaktieren möchtest, geht das auf verschiedene Weisen: Schreinerweg 6 38126 Braunschweig Deutschland* + +
diff --git a/content/de/verein/event/topio-09-2023/index.md b/content/de/verein/event/topio-09-2023/index.md new file mode 100644 index 000000000..860b1c881 --- /dev/null +++ b/content/de/verein/event/topio-09-2023/index.md @@ -0,0 +1,17 @@ +{ + "title": "Menschenrechte im digitalen Zeitalter: Datenanfragen.de bei Topio", + "type": "event", + "event_date": "2023-09-08T18:30:00+02:00", + "place": { + "name": "Markthalle Moabit (Zunftwirtschaft)", + "address": "Arminiusstraße 2 – 4, 10551 Berlin, Deutschland" + }, + "license": "cc-by-40", + "description": "Wir stellen uns bei der Vortragsreihe „Digital Rights: Menschenrechte im digitalen Zeitalter“ des Topio e. V. vor. Wir erzählen von unserer Arbeit zu Tracking in Apps und den damit einhergehenden gesellschaftlichen Problemen. Wir stellen auch unsere Tools und Ressourcen vor." +} + +Wir sind zu Gast beim Topio e. V. und sprechen dort im Rahmen der Veranstaltungsreihe „Digital Rights: Menschenrechte im digitalen Zeitalter“ über Datenschutzrechte und die Datensammlung durch mobiles Tracking. Anhand konkreter Beispiele zeigen wir auf, wie Apps Daten sammeln – in der Regel ohne korrekte Einwilligung der Betroffenen. Wir stellen auch unsere Tools und Ressourcen vor und erzählen von den Rechten aus der DSGVO und wie diese über Datenanfragen.de ausgeübt werden können. + +[Mehr Infos bei Topio](https://www.topio.info/veranstaltungen.html) + +**Material**: [Vortragsfolien](https://static.dacdn.de/talks/slides/2023-09-08-topio.pdf) diff --git a/content/de/verein/press/_index.md b/content/de/verein/press/_index.md index 5ee627ef1..f671eed6f 100644 --- a/content/de/verein/press/_index.md +++ b/content/de/verein/press/_index.md @@ -7,6 +7,10 @@ Willkommen auf unserer Presseseite. Für Presseanfragen, kontaktiere uns bitte u ## Presse- und Forschungsspiegel +* CHIP: [*Ihre Sicherheit: Daten löschen bei Facebook, Netflix und Co.*](https://www.chip.de/news/Es-geht-um-Ihre-Sicherheit-So-nerven-Sie-Facebook-Netflix-und-Amazon_184919517.html), 25. August 2023 +* netzpolitik.org: [*So findest du heraus, was Datenhändler über dich gespeichert haben*](https://netzpolitik.org/2023/auskunftsanfragen-so-findest-du-heraus-was-datenhaendler-ueber-dich-gespeichert-haben/), 08. Juni 2023 +* Digitalcourage: [*Nutzen Sie Ihre Auskunftsrechte!*](https://digitalcourage.de/digitale-selbstverteidigung/nutzen-sie-ihre-auskunftsrechte), 05. Mai 2023 +* Artikel 91: [*So funktioniert das Auskunftsrecht nach KDG und DSG-EKD*](https://artikel91.eu/2023/04/12/so-funktioniert-das-auskunftsrecht-nach-kdg-und-dsg-ekd/), 12. April 2023 * Deutschlandfunk Nova: [*Unsere Daten im Netz: Tipps fürs digitale Aufräumen*](https://www.deutschlandfunknova.de/beitrag/spam-wie-wir-unsere-daten-im-netz-loeschen-koennen), 19. Januar 2023 * Mimikama: [*Daten abfragen und mit wenigen Klicks löschen lassen*](https://www.mimikama.org/daten-abfragen-mit-wenigen-klicks/), 03. Januar 2023 * Deutschlandfunk Nova: [*Datenanfragen.de: Bei Google und Meta erfragen, welche Daten sie sammeln – ganz einfach*](https://www.deutschlandfunknova.de/beitrag/datenschutz-datenanfragen-de-will-uns-gegen-tracking-helfen), 02. Januar 2023 diff --git a/content/de/verein/transparency.md b/content/de/verein/transparency.md index e80248c66..214a4ea8b 100644 --- a/content/de/verein/transparency.md +++ b/content/de/verein/transparency.md @@ -14,7 +14,7 @@ Die Informationen sind auf dem Stand vom 13. Februar 2023. ## 1. Name, Sitz, Anschrift und Gründungsjahr Diese Informationen sind auch in unserem {{< link slug="contact" text="Impressum" >}} zu finden. - +
- Name: Datenanfragen.de e. V. - Sitz: Braunschweig - Register: Vereinsregister am Amtsgericht Braunschweig @@ -26,6 +26,7 @@ Diese Informationen sind auch in unserem {{< link slug="contact" text="Impressum Deutschland - Gründungsdatum: 14. Juni 2018 - Ansprechpartner für Transparenz: Benjamin Altpeter ([transparenz@datenanfragen.de](mailto:transparenz@datenanfragen.de) oder o.g. Anschrift) +
## 2. Satzung und Ziele diff --git a/content/en/blog/tracking-id-personal-data/cookie-ids-and-personal-data-under-the-gdpr.jpg b/content/en/blog/tracking-id-personal-data/cookie-ids-and-personal-data-under-the-gdpr.jpg new file mode 100644 index 000000000..967480fbf Binary files /dev/null and b/content/en/blog/tracking-id-personal-data/cookie-ids-and-personal-data-under-the-gdpr.jpg differ diff --git a/content/en/blog/tracking-id-personal-data/index.md b/content/en/blog/tracking-id-personal-data/index.md new file mode 100644 index 000000000..ac829a856 --- /dev/null +++ b/content/en/blog/tracking-id-personal-data/index.md @@ -0,0 +1,313 @@ +{ + "title": "Is tracking data linked with cookie and fingerprinting IDs personal data under the GDPR?", + "type": "blog", + "date": "2023-11-24T10:30:30+02:00", + "description": "Tracking companies collect vast amounts of data about individuals with dangerous implications, all while usually not knowing their names. We comprehensively analyzed whether tracking data linked to cookie and fingerprinting IDs constitutes personal data under the GDPR, reviewing relevant case law, legal literature, and data protection authority guidance.", + "featured_image": "cookie-ids-and-personal-data-under-the-gdpr", + "tags": [ "tracking", "cookie id", "online identifier", "personal data", "legal analysis" ], + "authors": [ "baltpeter" ], + "notices": "Photo adapted after: “[cookies on stainless steel tray](https://unsplash.com/photos/cookies-on-stainless-steel-tray-8yTwt-j230s)” by [Lisa Hanly](https://unsplash.com/@lisah_stl) ([Unsplash license](https://unsplash.com/license))" +} + +**Tracking is ubiquitous on the web: companies follow users across websites, collecting vast amounts of data to profile their behavior and target them with personalized ads. For these practices, which can have serious dangers and negative consequences for users, trackers typically don't know users' real names, instead only assigning them unique identifiers. But are these IDs personal data under GDPR? We’ve explored this question by reviewing relevant sources, including EU case law, legal commentary, and recommendations and decisions from data protection authorities. While there is still debate as to whether IDs on their own constitute personal data, in the larger context of online tracking, there is a strong consensus that such data processing falls within the scope of the GDPR and poses significant risks to the fundamental rights and freedoms of natural persons.** + +{{< featuredImg alt="Stylized photo with a blue tint of tray of cookies, above that the text: “Cookie IDs and personal data under the GDPR”" >}} + +Thousands of tracking companies worldwide constantly collect vast amounts of data on users on the web and on mobile and analyze intimate details about their lives. Based on this data, they try to predict users’ behaviours for example to target and influence users with ads and decide which products to display and at what price. They also claim to be able to assess companies’ risks to protect against spam, compute credit scores, or prevent fraud.[^sieben-surv-cap] Additionally, trackers build profiles on users, categorizing them into segments, sometimes based on highly sensitive inferences like health conditions, religious beliefs, sexual orientation, income level, and more. To give just a few examples, reporting has found segments such as *heavy alcohol consumers*, *desire to lose weight*, *planning to adopt a child*, *diagnosis for leukemia* *low income without perspective*, *conservative values*, and even *visits to sexual abuse treatment centers*. Trackers also score users on criteria like *often influenced by ads*, *inexperienced credit card users*, *lone wolves*, and *getting a raw deal out of life* to identify vulnerabilities.[^markup-labels][^np-europa] Trackers conduct large-scale experiments, systematically optimizing how to persuade, manipulate, and trigger users.[^cracked-corp-surv] + +[^sieben-surv-cap]: Sieben in Altpeter/Sieben, [Tracking und Datenschutzrechte](https://static.dacdn.de/talks/slides/2023-09-08-topio.pdf), 2023, slide 75 +[^markup-labels]: Keegan/Eastwood, [From “Heavy Purchasers” of Pregnancy Tests to the Depression-Prone: We Found 650,000 Ways Advertisers Label You](https://themarkup.org/privacy/2023/06/08/from-heavy-purchasers-of-pregnancy-tests-to-the-depression-prone-we-found-650000-ways-advertisers-label-you), 2023, retrieved 2023-11-16 +[^np-europa]: Gille/Meineck/Dachwitz, [Wie eng uns Datenhändler auf die Pelle rücken](https://netzpolitik.org/2023/europa-vergleich-wie-eng-uns-datenhaendler-auf-die-pelle-ruecken/), 2023, retrieved 2023-11-16 +[^cracked-corp-surv]: Christl, [Corporate Surveillance in Everyday Life](https://crackedlabs.org/en/corporate-surveillance), 2017, retrieved 2023-11-16 + +Crucially, trackers don’t need to know users’ legal identities for any of this profiling. They collect and assign unique identifiers to track users, and share and link IDs among each other in order to more precisely follow users across websites and apps. For trackers, these IDs are often even more useful than legal names. After all, names are not unique whereas IDs are specifically designed to precisely identify a single user, device, or session. And supposedly anonymized datasets are rarely safe against re-identification.[^anon] + +[^anon]: cf. e.g. Rocher/Hendrickx/de Montjoye, [Estimating the success of re-identifications in incomplete datasets using generative models](https://www.nature.com/articles/s41467-019-10933-3), Nature Communications, 2019; lschatzkin/Budington/maximillianh/Antaki, [About Cover Your Tracks](https://coveryourtracks.eff.org/about), 2021, retrieved 2023-11-24 + +Given the enormous risks, it is important to regulate tracking activities. The question then becomes whether the processed information is personal data under the GDPR, even if the trackers don’t collect information on the users’ legal identities but only individualize them based on IDs. Otherwise, such processing would not be covered by the GDPR which, according to Art. 2(1) GDPR, only applies to personal data. + +The dangers of restricting the concept of personal data to a person's legal identity were recognized and articulated early on, long before the GDPR, for example in a 2004 report to Council of Europe's T-PD Committee[^c108][^poullet]: + +> […] not treating the IP and the [GUID] as items of personal data would pose a problem in the light of the risks that the subsequent use of these data represent in terms of the profiling of the individual and, indeed, the possibility of contacting him or her. In this connection, there is evidence that, with the combination of web traffic surveillance tools, it is easy to identify the behaviour of a machine and, behind the machine, that of its user. In this way the individual’s personality is pieced together in order to attribute certain decisions to him or her. Without even enquiring about the “identity” of the individual – ie, his or her name and address – it is possible to categorise this person […] since the individual’s contact point (a computer) no longer necessarily requires the disclosure of his or her identity in the narrow sense. […] The definition of personal data should reflect this fact. + +[^c108]: The [Council of Europe](https://www.coe.int/en/web/portal/the-council-of-europe-key-facts) is an international organisation established after World War II to uphold human rights, democracy and the rule of law in Europe, centred on the European Convention on Human Rights. + + The CoE's [Convention 108](https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=180) was the first legally binding international instrument in the data protection field and opened for signature in 1981. The convention is binding for states that have ratified it, requiring its signatories to enact certain principles of the fundamental rights with regard to the processing of personal data into national law. The convention was updated in 2018 to address new data protection challenges that have arisen in the preceding decades, becoming [Convention 108+](https://rm.coe.int/convention-108-convention-for-the-protection-of-individuals-with-regar/16808b36f1). + + The [T-PD Committee](https://www.coe.int/en/web/data-protection/consultative-committee-tpd) consults on the implemention of Convention 108. + +[^poullet]: Poullet et al., [Report on the application of data protection principles to the worldwide telecommunication networks](https://rm.coe.int/168068416a), T-PD (2004) 04 final, section 2.1.3 + +On the surface, the question of whether tracking data is covered by the GDPR should be easy to answer since the GDPR leads with a long list of definitions, with the first one unsurprisingly being for personal data in Art. 4(1) GDPR: + +> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person + +That is further explained in Recital 26 GDPR: + +> […] To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. […] + +Note however how neither of these explains what it means for a person to be “identified”. They only explain what an “identifiable” person is, relying on a supposed understanding of the “identified“ criterion. In fact, there is no definition of what a controller needs to know for a person to be identified anywhere in the GDPR.[^purtova] Now, in many common cases, the meaning may be obvious. Often, the controller knows the data subject's legal identity, usually through their name. In these cases, the data subject is obviously “identified” and any data relating to that identified person is personal data. + +[^purtova]: Purtova, [From knowing by name to targeting: the meaning of identification under the GDPR](https://academic.oup.com/idpl/article/12/3/163/6612144), IDPL, Vol. 12, No. 3 (2022) + +But what about when that's not the case? As we've established above, in the case of tracking, users are typically assigned unique IDs but the controller usually *doesn't* know their name or legal identity. Is the concerned data still personal data? And if so, is the user identified or identifiable? It all hinges on the definition of identification. Does the controller need to know the data subject's legal identity or is it sufficient for them to be able to “single out” the data subject from everyone else, as Recital 26 GDPR alludes to? There are essentially three possible answers to these questions: + +1. Identification requires knowing a person’s legal identity. Data associated with an ID does not make the person identifiable unless there is additional data that links the ID to information about the person’s legal identity. +2. Identification does not require knowing a person’s legal identity, being able to single them out is sufficient. As such, any ID that is uniquely assigned to a person is in and of itself sufficient for identification and thus constitutes personal data. +3. Knowing a person’s legal identity is not necessary for information to be considered personal data. However, an ID that is uniquely assigned to a person is not sufficient to identify a person but only makes the person identifiable. (While this answer seems like the least likely based on the wording in Art. 4(1) GDPR, it is quite common. As both identification and identifiability are sufficient on their own to classify information as personal data under the GDPR, the distinction between this and number 1 is only of academic interest and holds little practical relevance.) + +Even though these questions have been the subject of heavy legal debate for more than twenty years, long before there were even any plans for the GDPR, the text of the GDPR leaves them unanswered.[^absrel] But in the context of tracking, they are of crucial importance: Tracking-related data collection poses significant risks for individuals and can have severe negative consequences for them, all without tracking companies having any clue of their legal identity. If these cases were not covered by the GDPR, it would leave users unprotected against the harms of tracking and undermine the explicit goal of the GDPR to protect the fundamental rights and freedoms of natural persons. This could lead to a feeling of insecurity and cause chilling effects: people adapt their behavior if they know their activities may be tracked. They might hesitate to read about diseases, politics, or other topics that could affect their privacy or reputation.[^zuiderveen-borgesius267268][^schantz293] + +[^absrel]: A similarly unanswered and related discussion, that isn’t relevant here, though, concerns the question of whether information is considered personal data based on an absolute (objective) or a relative (subjective) approach, which is not definitely answered by the GDPR either. The absolute approach assumes that information is personal data if the controller or any third party can link it to a person, regardless of the actual use of the linking possibilities, the individual abilities and means of the controller, and the legality of the linking. The relative approach considers only the means and knowledge that the controller actually and reasonably has in the specific case to establish the link between the information and the person. Under the old DPD, the ECJ has favored the relative approach (cf. Breyer ruling), but with some limitations and elements of the absolute approach. The controller must take into account not only the direct and immediate knowledge and means of a third party, but also the indirect and potential ones, as long as the linking is legally permissible and reasonably possible. The ECJ thus expands the scope of the relevant knowledge and technical possibilities, but also adds a clear corrective. The link between the information and the person does not have to be actually established, but only potentially possible. + + Further on that subject, with different positions: Ziebarth in Sydow/Marsch, DS-GVO/BDSG, 3. edition, 2022, Art. 4 Nr. 1 DSGVO, mn. 34 – 39; Karg in Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht, 1. edition, 2019, Art. 4 DSGVO, mn. 58 – 61; Klar/Kühling in Kühling/Buchner, DS-GVO/BDSG, 3. edition, 2020, Art. 4 Nr. 1 DSGVO, mn. 25 – 30; Arning/Rothkegel in Taeger/Gabel, DSGVO - BDSG - TTDSG, 4. edition, 2022, Art. 4 DSGVO, mn. 33 – 38; Hermann/Mühlenbeck/Schwartmann in Schwartmann/Jaspers/Thüsing/Kugelmann, DS-GVO/BDSG, 2. edition, 2020, Art. 4 Nr. 1 DSGVO, mn. 35 – 40; Eßer in Auernhammer, DSGVO/BDSG, 8. edition, 2023, Art. 4 Nr. 1 DSGVO, mn. 20; Gola in Gola/Heckmann, Datenschutz-Grundverordnung - Bundesdatenschutzgesetz, 3. edition, 2022, Art. 4 Nr. 1 DSGVO, mn. 20 – 22; Schantz in Schantz/Wolff, Das neue Datenschutzrecht, 1. edition, 2017, mn. 276 – 278; Farinho in Spiecker/Papakonstantinou/Hornung/De Hert, General Data Protection Regulation, Art. 4(1) Personal data, 2023, mn. 28; Finck/Pallas, [They who must not be identified](https://academic.oup.com/idpl/article/10/1/11/5802594), IDPL, Vol. 10, No. 1 (2020) + +[^zuiderveen-borgesius267268]: Zuiderveen Borgesius, Singling out people without knowing their names – Behavioural targeting, pseudonymous data, and the new Data Protection Regulation, Computer Law & Security Review 2016, 256, p. 267–268 ([longer open access preprint](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2733115)) + +Therefore, it is essential to clarify whether tracking data linked with cookie and fingerprinting IDs is personal data under the GDPR, and if so, under what conditions. In this article, we’ll examine these questions, doing a comprehensive review of relevant sources, including EU case law, legal commentary, and DPA recommendations and decisions. We’ll start by considering the question of whether IDs that are uniquely assigned to a person are personal data under the GDPR _on their own_ (i.e. without the plethora of other information that is associated with them in the context of tracking). + +## The ECJ’s Breyer judgement + +When a law is not definitive, it is up for the courts to interpret it. For EU law, the European Court of Justice (ECJ) is the highest court, with its judgements being binding for national courts. In the case of IDs as personal data, the ECJ's October 2016 judgement in case [C‑582/14](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62014CJ0582) (*Breyer*) is often referred to. + +The Breyer case concerned the question of whether dynamic IP addresses are personal data. The plaintiff, Patrick Breyer, sued the Federal Republic of Germany for storing his IP addresses when he accessed several websites run by German Federal institutions, without his consent and beyond the duration of his visits. One of the issues the ECJ decided on was the question of whether a dynamic IP address constitutes personal data for the website operator (“online media services provider”), even if only the ISP has the additional data to connect the IP address to the user's legal identity. + +To quote the relevant parts of the decision (paras. 28–39, 44–48): + +> […] it must be noted, first of all, that it is common ground that a dynamic IP address does not constitute information relating to an ‘identified natural person’, since such an address does not directly reveal the identity of the natural person who owns the computer from which a website was accessed, or that of another person who might use that computer. +> Next, […] it must be ascertained whether such an IP address, registered by such a provider, may be treated as data relating to an ‘identifiable natural person’ where the additional data necessary in order to identify the user of a website that the services provider makes accessible to the public are held by that user’s internet service provider. +> […] +> The fact that the additional data necessary to identify the user of a website are held not by the online media services provider, but by that user’s internet service provider does not appear to be such as to exclude that dynamic IP addresses registered by the online media services provider constitute personal data within the meaning of Article 2(a) of Directive 95/46. +> However, it must be determined whether the possibility to combine a dynamic IP address with the additional data held by the internet service provider constitutes a means likely reasonably to be used to identify the data subject. +> Thus, […] that would not be the case if the identification of the data subject was prohibited by law or practically impossible on account of the fact that it requires a disproportionate effort in terms of time, cost and man-power, so that the risk of identification appears in reality to be insignificant. +> Although the referring court states in its order for reference that German law does not allow the internet service provider to transmit directly to the online media services provider the additional data necessary for the identification of the data subject, it seems however, \[…\] in the event of cyber attacks legal channels exist so that the online media services provider is able to contact the competent authority, so that the latter can take the steps necessary to obtain that information from the internet service provider and to bring criminal proceedings. +> Thus, it appears that the online media services provider has the means which may likely reasonably be used in order to identify the data subject, with the assistance of other persons, namely the competent authority and the internet service provider, on the basis of the IP addresses stored. + +Even though, on the surface, the ECJ did decide that (temporary) identifiers like dynamic IP addresses can constitute personal data (as the case is often summarized as) and the judgement is as such generally regarded as a positive development toward a broad understanding of the concept of personal data, it can also be read as supporting a restrictive position on IDs as personal data. In this case, the ECJ did **not** consider the IP address to _identify_ the user directly. Instead, it ruled that an IP address only (potentially) makes a user _identifiable_ if there is additional information that links the IP to the user's legal identity. + +When discussing what the Breyer judgement means for our question at hand, we first have to consider its legal basis. Notably, the case was not decided under the GDPR but under Directive 95/46/EC (Data Protection Directive, DPD), the predecessor of the GDPR. And even though the definition of personal data in both of them is similar, there are some notable differences. Compare Art. 2(a) DPD with Art. 4(1) GDPR: + +> “Personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity + +Even though they are largely identical, it is clear that the legislature deliberately wanted to widen the scope. The mention of “identification numbers” as information potentially making a person identifiable was expanded to “identifiers”, listing names, identification numbers, location data, and online identifiers as examples. + +This becomes even more apparent when comparing Recital 26 DPD to Recital 26 GDPR: + +> Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable; […] + +The GDPR introduces the concept of pseudonymisation, stating that pseudonymised data should be considered personal data. It also introduces the notion of singling out as a potential means of identifiability. Albrecht/Jotzo confirm the legislature’s intention behind the introduction of the “singling out” criterion[^albrecht3-trans]: + +> Data subjects can be indirectly inferred for example through “singling out” as mentioned in Recital 26 GDPR. The *European Parliament* had pushed for this clarification, since in the online world, for example with the help of cookies, IP addresses, browser fingerprints and other techniques, personality profiles are generated for many users by which they receive individual advertising without the operators of such advertising networks needing their civil names. + +[^albrecht3-trans]: Albrecht/Jotzo, Das neue Datenschutzrecht der EU, 1. edition, 2017, Part 3, mn. 3 (translated) + +Based on that, the Swedish IMY argues that the Breyer judgement is not applicable to IDs under the GDPR[^imy-breyer] (similarly: Kring/Marosi[^kring-marosi]; Schantz[^schantz293]): + +> The judgments should not, according to IMY, be read […] in the way that a legal possibility to access information that can link IP addresses to individuals must be demonstrated for IP addresses to be considered personal data. An interpretation of the concept of personal data that always requires demonstrating a legal possibility to link such information to an individual would, according to IMY, entail a significant limitation of the scope of protection of the regulation, and open up possibilities to circumvent the protection in the regulation. This interpretation would, among other things, conflict with the purpose of the regulation according to Article 1(2) GDPR. The Breyer judgment was decided under the previously applicable Directive 95/46 and the concept of "singling out" according to Recital 26 of the current regulation (that knowledge of the actual visitor's name or physical address is not required, since singling out in itself is sufficient to make the visitor identifiable), was not specified in the previously applicable directive as a method for identifying personal data. + +[^imy-breyer]: IMY, [Beslut efter tillsyn enligt dataskyddsförordningen – Tele2 Sverige AB:s överföring av personuppgifter till tredjeland](https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-tele2.pdf), DI-2020-11373, 2023-06-30, p. 12 (translated) +[^kring-marosi]: Kring/Marosi, [Ein Elefant im Porzellanladen – Der EuGH zu Personenbezug und berechtigtem Interesse](https://baecker.jura.uni-mainz.de/files/2018/08/KuR_12_16_Beitrag_Kring_Marosi.pdf), K&R 2016, 773, p. 776 + +Alternatively, Purtova proposes a contextual interpretation of *Breyer* which negates its restrictive potential (in agreement: Farinho[^purtova+farinho]). They argue that it is important to pay close attention to the context of the case, which specifically concerns **dynamic IP addresses** (which are regularly reassigned to other users by ISPs) not during but **after the browsing session ended**. In this context, the IP address alone does in fact not identify (individualize) the user anymore, it now refers to the set of all users who were assigned the IP address at some point. As such, the ECJ specifically ruled that a reassigned dynamic IP address can only lead to identification in combination with the ISP’s traffic logs which record who held the IP address at which point.[^purtova] This however does not preclude IDs in general directly identifying users. Purtova concludes[^purtova]: + +> The IP address provides a direct link to a flesh and blood individual who is browsing through the website’s content. Under these circumstances, a website visitor is directly identified by the dynamic IP address [during the browsing session]. Once the session is ended and the Internet connection is broken, the retained dynamic IP address is no longer pointing to a specific [node] on the network. The direct link with the visitor is severed and additional information is necessary to restore it. This contextual reading of Breyer does not effect the validity of the […] understanding of identification as distinguishing a person from the group and preserves a far reach of the GDPR. + +[^purtova+farinho]: Farinho in Spiecker gen. Döhmann/Papakonstantinou/Hornung/De Hert, General Data Protection Regulation, Art. 4(1) Personal data, 2023, mn. 24 + +## Other EU case law + +As a result, the Breyer judgement is of little help for finding an answer to our questions. The same applies for the ECJ’s November 2023 judgement in case [C-319/22](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62022CJ0319). Here, the court had to decide whether the vehicle identification number (VIN) of a car constitutes personal data under the GDPR and whether car manufacturers are obliged to make it available to independent operators, such as spare parts suppliers or publishers of technical information (paras. 43–44). The ECJ noted that the VIN appears on the registration certificate of the vehicle, along with the name and address of the holder of that certificate, who may be the owner or the user of the vehicle (para. 47). It ruled that the VIN is personal data for those who have reasonable means to link it to a specific person, such as the independent operators who have access to the registration certificates or other sources of information, but also indirectly for the vehicle manufacturers making the VIN available to operators, even if the VIN is not, in itself, personal data for them (paras. 47–49): + +> […] the VIN must appear on the registration certificate for a vehicle, as must the name and address of the holder of that certificate. In addition, […] a natural person may be designated in that certificate as the owner of the vehicle, or as a person who can use the vehicle on a legal basis other than that of owner. +> In those circumstances, the VIN constitutes personal data, within the meaning of Article 4(1) of the GDPR, of the natural person referred to in that certificate, in so far as the person who has access to it may have means enabling him to use it to identify the owner of the vehicle to which it relates or the person who may use that vehicle on a legal basis other than that of owner. +> […] where independent operators may reasonably have at their disposal the means enabling them to link a VIN to an identified or identifiable natural person, which it is for the referring court to determine, that VIN constitutes personal data for them, within the meaning of Article 4(1) of the GDPR, and, indirectly, for the vehicle manufacturers making it available, even if the VIN is not, in itself, personal data for them, and is not personal data for them in particular where the vehicle to which the VIN has been assigned does not belong to a natural person. + +At first glance, this looks as though the ECJ is reinforcing its Breyer judgement and saying that being able to link an ID to a person’s legal identity is also necessary under the GDPR for it to be consider personal data. However, the ECJ introduces the section quoted above by saying that a non-personal ID becomes personal where it can reasonably associated with a specific person (para. 46): + +> […] a datum such as the VIN – which is […] an alphanumeric code assigned to the vehicle by its manufacturer in order to ensure that the vehicle is properly identified and which, as such, is not ‘personal’ – becomes personal as regards someone who reasonably has means enabling that datum to be associated with a specific person. + +Just as Purtova argues for *Breyer*, a contextual interpretation is needed here, as well. The defendant in this case is Scania CV AB, described as “one of the largest manufacturers of heavy goods vehicles in Europe” (para. 16). Therefore, it is likely that most of the vehicles sold by Scania are not owned or used by natural persons, but by legal entities, which are not covered by the GDPR (Recital 14 GDPR). As such, it makes sense that the ECJ stresses that the VIN constitutes personal data only where it is linked to a natural person (paras. 55–61). The situation is different for tracking, however, where IDs such as cookies or fingerprints are almost exclusively used to target individuals and their online behaviour. The ECJ’s judgement cannot simply be generalized over all these cases. +First reactions to the judgement also criticize the ECJ for being vague with regards to the relevant questions on personal data, questioning the relevance the judgement will have in practice.[^piltz-scania] + +[^piltz-scania]: e.g. Quiel, [Entscheidung des EuGH zur FIN und generellen Aspekten des Personenbezugs](https://www.piltz.legal/news/entscheidung-des-eugh-zur-fin-und-generellen-aspekten-des-personenbezugs), 2023, retrieved 2023-11-13 + +Finally, we have to consider the April 2023 judgement of the EGC in case [T‑557/20](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62020TJ0557). There, the EGC had to decide whether the comments submitted by the affected shareholders and creditors of a bank that was placed under resolution by the Single Resolution Board (SRB) constituted personal data and whether the SRB had infringed its obligation to inform them that their comments would be shared with Deloitte, an independent valuer. Alongside with the comments, the SRB had collected, among other documentation, proof of identity of the submitting persons (para. 9) but only made that available to a limited number of their internal staff. The comments were transmitted to Deloitte _without_ this additional documentation, which had been replaced with a unique alphanumeric code (paras. 16, 24). After complaints by several shareholders and further information provided by the SRB, the European Data Protection Supervisor (EDPS) ultimately issued a decision finding the comments associated with unique IDs to be pseudonymous and thus personal data, and confirming an infringment (para. 32). + +The EGC annulled the decision of the EDPS, on the grounds that the EDPS had not properly assessed whether the information transmitted to Deloitte related to an identified or identifiable natural person (paras. 97, 101, 105): + +> […] it is […] apparent from the [ECJ *Breyer* judgement], that, in order to determine whether the information transmitted to Deloitte constituted personal data, it is necessary to put oneself in Deloitte’s position in order to determine whether the information transmitted to it relates to ‘identifiable persons’. +> […] +> Thus, the EDPS is incorrect to maintain that it was not necessary to ascertain whether the authors of the information transmitted to Deloitte were re-identifiable by Deloitte or whether such re-identification was reasonably possible. +> […] +> Therefore, since the EDPS did not investigate whether Deloitte had legal means available to it which could in practice enable it to access the additional information necessary to re-identify the authors of the comments, the EDPS could not conclude that the information transmitted to Deloitte constituted information relating to an ‘identifiable natural person’ within the meaning of Article 3(1) of Regulation 2018/1725. + +Even though the EGC didn’t actually decide whether the transmitted data is personal data but only that the EDPS had insufficiently assessed the case to come to such a conclusion, it makes its position on pseudonymous data clear. The EGC does not share the interpretation that unique IDs are automatically personal data.[^egc-agree] It interprets the ECJ *Breyer* judgement such that the classification of data as personal data is relative to a certain party. That is, for data to be considered personal data to a certain party, said party _itself_ needs to have (reasonable and legal, even if just theoretical) access to additional information that would allow it to associate a certain ID with the legal identity of a person. + +[^egc-agree]: in agreement: Bronner, Personenbezug bei pseudonymisierten Daten, jurisPR-ITR 12/2023 Anm. 5; Schweinoch/Peintinger, EuG: Datenschutz-Verstoß bei Weitergabe pseudonymisierter oder anonymisierter Daten, CR 2023, 532-539; Kunczik, Relativer Personenbezug von Daten, ITRB 2023, 176-177 + +Also, even though the ruling concerns Regulation 2018/1725 (the counterpart to the GDPR for EU institutions) and not the GDPR, everything in it also applies to the GDPR since the passages it relies on are identical between both (Art. 3(1) Regulation 2018/1725 is identical to Art. 4(1) GDPR, Recital 16 Regulation 2018/1725 is identical to Recital 26 GDPR). + +However, as a decision of the EGC, the judgement is not binding for national courts. The EDPS already [appealed](https://curia.europa.eu/juris/document/document.jsf?text=&docid=276483&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1) the judgement in July 2023. Therefore, the EGC’s judgement does not create a precedent for the interpretation of the GDPR, unless it is confirmed by the ECJ. + +## Positions taken in legal literature + +Since the current case law doesn't answer our questions, we’ll do a comprehensive review of the legal literature on the subject. As a key concept of European data protection law, the question of identifiability under the DPD and GDPR has been heavily debated in many papers and commentaries, with a few key positions being observable. + +### Knowing the person’s legal identity + +The first question we need to consider is whether information can be personal data at all without the controller knowing the data subject’s legal identity (especially the name). A few authors like Hermann/Mühlenbeck/Schwartmann argue that it is not. They say that a person is generally identified by some information if the controller can easily infer their (legal) identity from that information.[^hermann32] Similarly, Eßer[^auernhammer21], Gola[^gola23], and Klar/Kühling[^klar39] argue that email addresses are only directly identifying if they contain a person’s name but not if they contain a pseudonym. + +However, there is a far greater corpus of authors taking the position that knowing the person’s name is not necessary. Arning/Rothkegel[^arning2430], Ernst[^ernst8], Farinho[^farinho20], Purtova[^purtova], Schild[^beckok17], and Ziebarth[^ziebarth14] all explicitly state so. Karg explains[^karg4849]: + +> The GDPR does not stipulate such a narrow understanding of the concept of identification [as in conventional linguistic usage or in the German Code of Criminal Procedure], and this would not do justice to the purpose of comprehensive protection of data subjects. It is sufficient that the person can be individualized or made recognizable by or with the help of the corresponding information. In this respect, the controller does not need to process information such as the legal name […] together with the information in question in order for there to be personal data. The only decisive factor is that, from the perspective of the controller, the information is or can be assigned to one and the same person and the person is singularized. This is the case if the person can be recognized or re-addressed by means of the information used and/or confusion is ruled out. + +Similarly, Schantz also refers to the concept of “singling out” as an argument for considering personal data in cases where a person can be individualized by the controller, even if the controller doesn’t know their name.[^schantz291292] Albrecht[^albrecht3], Klabunde[^klabunde15], the EU FRA’s *Handbook on European data protection law*[^fra-handbook], and Ziebarth[^ziebarth14] all mention examples of details that can identify a person without knowing their name being necessary, such as phone numbers, social security numbers, online identifiers, and video recordings. Schantz explicitly lists pseudonymized email addresses as examples of personal data.[^schantz293] + +Zuiderveen Borgesius criticises the idea that a name is the only or even the most effective identifier and argues that many companies could easily tie a name to data that they are processing but aren’t interested in doing so, mentioning the example of a phone number or other phone ID being a far more useful identifier for sending messages to a phone or tracking its location.[^zuiderveen-borgesius268] This argument is echoed by Schantz.[^schantz291292] + +Karg/Kühn[^karg288] and Wenhold[^wenhold130] held the position that knowing a person’s name or legal identity is not necessary even under the old DPD with its less broad wording. In fact, in its WP 136 from 2007, the Article 29 WP already expressed that “the possibility of identifying an individual no longer necessarily means the ability to find out his or her name”.[^wp136] + +### Cookie, advertising and similar IDs + +With most authors agreeing that knowing a person’s name is not necessary and that other identifiers are possible, the question then becomes whether cookie, advertising, and similar IDs on their own are sufficient to make a person identified or identifiable. + +Still in its WP 136, the Article 29 WP was of the opinion that that was already the case under the DPD[^wp136]: + +> [Identification using something other than a name] may happen when other "identifiers" are used to single someone out. Indeed, computerised files registering personal data usually assign a unique identifier to the persons registered, in order to avoid confusion between two persons in the file. Also on the Web, web traffic surveillance tools make it easy to identify the behaviour of a machine and, behind the machine, that of its user. Thus, the individual’s personality is pieced together in order to attribute certain decisions to him or her. Without even enquiring about the name and address of the individual it is possible to categorise this person on the basis of socio-economic, psychological, philosophical or other criteria and attribute certain decisions to him or her since the individual’s contact point (a computer) no longer necessarily requires the disclosure of his or her identity in the narrow sense. […] The definition of personal data reflects this fact. + +It reinforced that position in WP 188 from 2011.[^wp188] Meanwhile, Dieterich[^dieterich201] and Schmidt[^schmidt88] disagreed with this interpretation, citing the necessity of controllers linking additional information (like email addresses) with the online IDs for them to be personal data. + +Under the GDPR, there are more authors in favor of the interpretation that IDs can be personal data on their own. The Article 29 WP successfully pushed for the “singling out” criterion to be included in the GDPR, where it is mentioned in Recital 26 as we’ve seen already.[^tosoni-single][^albrecht3][^schantz291] + +Based on that, Albrecht/Jotzo[^albrecht3], Farinho[^farinho2124], Karg[^karg50], Schantz[^schantz292293], and Schild[^beckok1719] conclude that it is enough for the controller to individualize, differentiate or recognize a person based on some information for that information to be personal data. Farinho explains that it doesn’t matter whether this individualization is possible “for a short period of time or a long one”.[^farinho2124] Albrecht/Jotzo argue that the inclusion of the “singling out” criterion in Recital 26 GDPR invalidates earlier arguments that required knowing a person’s legal identity instead of just an ID.[^schantz293] + +Zuiderveen Borgesius explains that this singling out is precisely what trackers do[^zuiderveen-borgesius268] (in agreement: EU FRA’s *Handbook on European data protection law*[^fra-handbook]): + +> […] the whole point of behavioural targeting is tracking individuals, building profiles of individuals, and targeting ads to individuals. The goal of behavioural targeting is, in the words of a marketing company, ‘to use data to deliver the right ad to the right person at the right time.’ To do this, behavioural targeting companies must single out people with unique identifiers. + +Albrecht/Jotzo[^albrecht3], Ernst[^ernst18], Klabunde[^klabunde18], Schantz[^schantz292293], and Schild[^beckok1719] all mention online identifiers like IP addresses, cookie IDs, device IDs, and browser fingerprints as examples of identifiers that allow for such individualization. Karg goes further, reasoning that any randomly assigned string that is assigned to a single person, at least for the timeframe of the processing, is sufficient for individualization.[^karg50] + +Meanwhile, Arning/Rothkegel[^arning27] and Klar/Kühling[^klar36] hold the position that IDs alone do not allow for identification but only in combination with other information that allows for inferring the person’s identity. + +### Personal data in the larger context of online tracking + +In summary, there is still debate on whether IDs on their own constitute personal data under the GDPR. However, in the context of online tracking and advertising, IDs are never processed on their own. Instead, they are combined with other information, such as interaction data, browsing history, location data, device parameters, behavioral patterns, and IP addresses, to create detailed fingerprints and profiles of users and target them with personalized ads. In this larger context, there is fairly universal agreement, even from those who reject cookie and similar IDs being personal data on their own, that such data processing falls under the scope of the GDPR and constitutes personal data. + +This is supported by Recital 30 GDPR, which states: + +> Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. + +Gola[^gola23], Klar/Kühling[^klar36], and Schild[^beckok20] confirm that this typically applies in the case of fingerprinting and other online profiling. Karg/Kühn[^karg288] and Wenhold[^wenhold144] already considered fingerprinting data to be personal data under the DPD, with Wenhold stating that due to “monopolistic operator structures“ on the internet enabling interlinkage, it cannot be ruled out that fingerprints could be tied to IP addresses, thus “infecting” them with personal data[^wenhold144]. + +In more recent commentary, Karg contends that the information and communication technology constantly improves the ability to individualize persons based on various and ultimately only seemingly anonymous or non-personal information. They cite that uniquely marking a browser and the user behind it is possible based on usage history and behavioral linking of internet sessions over a longer period of time, with this allowing individualization of the user and thus leading to otherwise anonymous data becoming personal data.[^karg5253] They explain that an observed expansion of the scope of data protection law is thus not caused by a perceivedly more extensive interpretation of the concept of personal data, but rather by the constantly increasing analytical capabilities of technology and the resulting increasing ability in gaining knowledge about individuals.[^karg65] Given this situation, they argue that there is a need for an extension rather than a reduction of the scope of data protection law. A potential balancing between the interests of society, economy and state with the rights of the data subjects is not to happen in the definition of personal data, but at the level of lawfulness of data processing, especially according to Art. 5 and 6 GDPR.[^karg65] + +## Positions taken by data protection authorities + +In addition to the legal literature and the EU case law, we also have to consider the positions taken by the data protection authorities, as they are responsible for enforcing the GDPR and issuing guidance and decisions on its interpretation and application. + +## DPA guidelines + +Several DPAs have issued guidelines or guidance notes on the use of cookies and other tracking technologies, which often involve the processing of IDs that are uniquely assigned to a person. These guidelines generally confirm that such IDs are personal data under the GDPR, especially when they are used or combined to create profiles of individuals or to single them out from others. + +For example, the DPC Ireland explains that cookies can include personal data such as usernames or unique identifiers like user IDs and other tracking IDs. The DPC adds that where cookies contain identifiers that may be used to target a specific individual, or where information is derived from cookies and other tracking technologies that may be used to target or profile individuals, this will constitute personal data and its processing is also subject to the rules set out in the GDPR. The DPC also emphasizes that online identifiers are included in the definition of personal data in Article 4(1) of the GDPR, and that it does not matter whether the controller is in possession of other information that may be needed to identify an individual; the fact that the person may be identified, even with the addition of information held by another organisation, is sufficient to make this data personal data.[^dpcie] + +Similarly, the ICO, the UK DPA, explains that online identifiers, such as IP addresses, advertising IDs, pixel tags, account handles, and device fingerprints, can be used to distinguish one user from another and to create profiles of individuals, even when those individuals are unnamed. The ICO notes that this is particularly the case when the information enables the controller to single out, make inferences or take specific actions in relation to users, such as identifying them over time or across multiple devices and websites. The ICO concludes that where this is the case, the processing must comply with the UK GDPR.[^ico] + +In an FAQ on Google Analytics, the Danish Datatilsynet also adopts a broad understanding of personal data in relation to online identifiers. It states that a unique identifier makes it possible to identify the individual to whom the data relates, even if it is not possible to assign a specific name or identity to the person concerned. It cites the GDPR's explicit mention of the “singling out” concept.[^datatilsynet] + +The EDPB and the German Datenschutzkonferenz have not issued detailed guidance on the definition of personal data. However, in its opinion on the interplay between the ePrivacy Directive and the GDPR, the EDPB mentions cookies as a clear example of processing activities which trigger the material scope of both the ePrivacy Directive and the GDPR.[^edpb-interplay] Similarly, in its guidelines on telemedia, the Datenschutzkonferenz states that the use of cookies and other tracking technologies often involves the processing of personal data and thus fall within the scope of both the TTDSG (the German law implementing the ePrivacy Directive) and the GDPR.[^ohtm] + +[^ico]: ICO, [How do the cookie rules relate to the GDPR?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-the-cookie-rules-relate-to-the-gdpr/), retrieved 2023-11-16 +[^dpcie]: DPC Ireland, [Guidance Note: Cookies and other tracking technologies](https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf), 2020 +[^edpb-interplay]: EDPB, [Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities](https://edpb.europa.eu/sites/default/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en_0.pdf), 2019 +[^ohtm]: Datenschutzkonferenz, [Orientierungshilfe der Aufsichtsbehörden für Anbieter:innen von Telemedien ab dem 1. Dezember 2021 (OH Telemedien 2021)](https://www.datenschutzkonferenz-online.de/media/oh/20221205_oh_Telemedien_2021_Version_1_1_Vorlage_104_DSK_final.pdf), version 1.1, 2022 +[^datatilsynet]: Datatilsynet, [Google Analytics](https://www.datatilsynet.dk/english/google-analytics), retrieved 2023-11-16 + +## DPA decisions + +In addition to the guidelines, some DPAs have also issued decisions on specific cases involving the processing of IDs that are uniquely assigned to a person. These decisions provide concrete examples of how the DPAs apply the GDPR in relation to tracking data and IDs. + +One of the most common issues relating to tracking that the DPAs have addressed is the use of Google Analytics in the context of [noyb’s 101 complaints following the *Schrems II* judgement](https://noyb.eu/en/101-complaints-eu-us-transfers-filed). + +For example, the Swedish DPA (IMY) issued a decision in June 2023, fining Tele2 Sverige AB and three other website providers for using Google Analytics despite the EU recommendations and decisions and without implementing additional safeguards.[^imy-additional] In the decision, the IMY explains that network/online identifiers can be used to identify a user, especially when combined with other similar types of information.[^imy-10] The IMY considered the data collected by Google Analytics, such as unique identifiers stored in the cookies `_gads`, `_ga`, and `_gid`, IP addresses, and other information related to the website visit and user’s browser. They highlight that these identifiers were created with the express aim of being able to distinguish individual visitors, thus making them identifiable. The IMY notes that even if the IDs alone did not make individual identifiable, the IDs in combination with the other transmitted data makes website visitors even more distinguishable. As such, they conclude that the transmitted data information constitutes personal data. The IMY explains that this differentiation is in itself sufficient to make the visitor indirectly identifiable in accordance with Recital 26 and that knowledge of the visitor’s name or physical address is not required. They also do not consider it necessary that the controller or processor actually intends to identify the visitor, noting that the possibility of doing so is in itself sufficient to determine whether it is possible to identify a visitor.[^imy-11] +Further, the IMY observed that the complainant logged into their Google account when visiting the website, which allowed Google to draw conclusions about them based on their registration with Google, making it even more clear that personal data was processed.[^imy-13] They however notably do not consider this a requirement for the classification of the information as personal data. + +[^imy-additional]: At the same time, the IMY also issued three additional, very similar decisions, against other websites: [DI-2020-11397](https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-cdon.pdf), [DI-2020-11368](https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-coop.pdf), [DI-2020-11370](https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-dagens-industri.pdf) +[^imy-10]: IMY, [Beslut efter tillsyn enligt dataskyddsförordningen – Tele2 Sverige AB:s överföring av personuppgifter till tredjeland](https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-tele2.pdf), DI-2020-11373, 2023-06-30, p. 10 +[^imy-11]: IMY, [Beslut efter tillsyn enligt dataskyddsförordningen – Tele2 Sverige AB:s överföring av personuppgifter till tredjeland](https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-tele2.pdf), DI-2020-11373, 2023-06-30, p. 11 +[^imy-13]: IMY, [Beslut efter tillsyn enligt dataskyddsförordningen – Tele2 Sverige AB:s överföring av personuppgifter till tredjeland](https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-tele2.pdf), DI-2020-11373, 2023-06-30, p. 13 + +Similarly, the Austrian DPA (DSB) issued a decision in December 2021, finding that an Austrian website violated the GDPR by transferring personal data to US by using Google Analytics. The DSB notes that the cookies used by Google Analytics, `_ga`, `_gid`, and `cid`, contained unique identifiers that were stored on the users' devices and browsers, and that only through these identifiers was it possible for the website operator and Google to distinguish visitors as well as determine whether they had visited the website before. The DSB explains its position that such a possibility of individualizing website visitors was sufficient to open the scope of data protection law and that being able to find out the person’s name was not necessary, citing Recital 26 GDPR as justification.[^dsbat-ga-2728] With regards to the controller’s and Google’s argument that they didn’t actually intend to associate the IDs with an actual person, the DSB underlines[^dsbat-ga-28-trans]: + +> Insofar as the defendants argue that no “means“ are used to link the identification numbers in question here to the person of the complainant, it must be reiterated that the implementation of Google Analytics on [the website] *results in* a singling out within the meaning of Recital 26 GDPR. In other words: Those who use a tool that only enables such singling out *in the first place*, cannot take the position that they do not “reasonably” use any means to make natural persons identifiable. + +The DSB also notes that these identifiers could combined with other information, such as browser data and IP addresses, which made the website visitors even more identifiable, referring to Recital 30 GDPR. The DSB further points out that Google Analytics was specifically designed to be implemented on as many websites as possible, in order to collect information about website visitors. They conclude that the data processed by Google Analytics constituted personal data and stress that not applying the GDPR to the processing done by Google Analytics would run afoul of the fundamental right to data protection.[^dsbat-ga-29] + +The DSB's decision was later confirmed by the Austrian Federal Administrative Court in judgement [W245 2252208-1/36E, W245 2252221-1/30E](https://www.ris.bka.gv.at/Dokumente/Bvwg/BVWGT_20230512_W245_2252208_1_00/BVWGT_20230512_W245_2252208_1_00.pdf). + +[^dsbat-ga-2728]: Österreichische Datenschutzbehörde, [Teilbescheid D155.027 2021-0.586.257](https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_DE_bk_0.pdf), 2021-12-22, p. 27–28 +[^dsbat-ga-28-trans]: Österreichische Datenschutzbehörde, [Teilbescheid D155.027 2021-0.586.257](https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_DE_bk_0.pdf), 2021-12-22, p. 28 (translated) +[^dsbat-ga-29]: Österreichische Datenschutzbehörde, [Teilbescheid D155.027 2021-0.586.257](https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_DE_bk_0.pdf), 2021-12-22, p. 29 + +In a more recent decision in March 2023, the DSB found that the use of Facebook's tracking pixel by an Austrian website provider also violated the GDPR and the *Schrems II* judgement. In the decision, the DSB follows the same argument as in the Google Analytics decision, quoting from it with regards to the classification of tracking data as personal data.[^dsbat-meta] + +[^dsbat-meta]: Österreichische Datenschutzbehörde, [Bescheid D155.028 2022-0.726.643](https://noyb.eu/sites/default/files/2023-03/Bescheid%20redacted.pdf), 2023-03-06 + +Again concerning Google Analytics but also Google Tag Manager, Tietosuojavaltuutetun toimisto, the Finish DPA, issued a decision in December 2022 against the public library online services of four cities in Finland. The decision mentions that personal data was collected through those tools but doesn’t provide a reasoning with further details.[^dpafi] Just as the Swedish and Austrian DPAs, the Finish DPA also found an unlawful transfer of personal data to the US. + +[^dpafi]: Tietosuojavaltuutetun toimisto, [Apulaistietosuojavaltuutetun päätös käsittelyn lainmukaisuutta, käsittelyn turvallisuutta, sisäänrakennettua ja oletusarvoista tietosuojaa, rekisteröityjen informointia ja henkilötietojen siirtoa kolmansiin maihin koskevassa asiassa](https://finlex.fi/fi/viranomaiset/tsv/2022/20221663), 4672/161/22, 2022-12-13 + +The CNIL, the French DPA, issued a decision in March 2022, ordering three French websites to comply with the GDPR in relation to their use of Google Analytics. The CNIL explains that online identifiers, such as IP addresses or information stored in cookies, could be used as a means of identifying a user, especially when combined with other similar types of information, citing Recital 30 GDPR. The CNIL explains that the websites had to demonstrate the means implemented to ensure that the identifiers collected were anonymous, otherwise they could not be qualified as anonymous. They also note that the IDs used by Google Analytics were unique identifiers that were intended to differentiate between individuals and that these identifiers could also be combined with other information, such as the address of the site visited, metadata relating to the browser and operating system, the time and data relating to the visit to the website, and the IP address. The CNIL argues that this combination reinforced their distinguishing nature and made the visitors identifiable. The CNIL believes that the scope of the right to data protection would be diminished if this were decided otherwise.[^cnil-ga-4] + +[^cnil-ga-4]: CNIL, [Décision n° […] du […] mettant en demeure […]](https://www.cnil.fr/sites/cnil/files/atoms/files/med_google_analytics_anonymisee.pdf), 2022-03-02, p. 4 + +The CNIL also sanctioned Criteo, an online advertising company, with a fine in June 2023 for failing to verify that users from whom it processed data had given their consent. The CNIL considers that Criteo processed personal data, given the number and diversity of the data collected and the fact that they were all linked to an identifier, which made it possible, with reasonable means, to re-identify the natural persons to whom this data relates. The CNIL also notes that the Criteo cookie ID was intended to distinguish each individual whose data it collected and that a large amount of information intended to enrich the user’s advertising profile was associated with this identifier. The CNIL believes that even if Criteo did not directly have the identity of the person associated with a cookie ID, reidentification could be possible if Criteo also collected other data such as the email address, the IP address, or even the user agent (or hashed forms thereof). The CNIL concludes that as long as Criteo is able to re-identify individuals using reasonable means, the processed data is personal data under the GDPR.[^cnil-criteo] + +[^cnil-criteo]: CNIL, [Délibération SAN-2023-009 du 15 juin 2023](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063), 2023-06-22 + +In one of the few DPA proceedings on the matters not related to the *Schrems II* judgement, the Norwegian Datatilsynet published a draft decision in May 2021, notifying Disqus, a company that provides a platform for online comments, that it would be fined for unlawfully processing personal data for programmatic advertising. The DPA states that online identifiers, such as cookie IDs, were personal data, as they enabled the controller to distinguish one website user from another, and to monitor how each user interacts with the website, citing Art. 4(1) GDPR and Recital 30 GDPR to support its interpretation.[^datatilsynet-disqus-1516] A final decision on the matter has not been published yet. + +[^datatilsynet-disqus-1516]: Datatilsynet, [Advance notification of an administrative fine – Disqus Inc.](https://www.datatilsynet.no/contentassets/8311c84c085b424d8d5c55dd4c9e2a4a/advance-notification-of-an-administrative-fine--disqus-inc.pdf), 20/01801-5, 2021-05-02, p. 15–16 + +Finally, the DPA of Lower Saxony in Germany (LfD NDS) issued a decision in May 2023 concerning the use of a “pay or okay” system by Heise, a German tech news site. The site made users choose between paying for a monthly subscription or agreeing to their data being processed for advertising and other purposes. The LfD found that such a system was, in principle, permissible but that the requirements for obtaining consent were not fulfilled by Heise. In the decision, the LfD describes the high number of observed local storage objects, tracking techniques and third-party services used on the site, explaining that they will not provide a legal assessment of each one as a result. The LfD notes, without providing further reasoning, that Heise processed personal data through these objects, citing for example that Adform placed a `cid` cookie, which they determined to be an ID based on the name.[^lfdnds-heise-6] + +[^lfdnds-heise-6]: Die Landesbeauftrage für den Datenschutz Niedersachsen, [Beschwerdeverfahren gegen Verarbeitungen personenbezogener Daten bei der Nutzung der Webseite www.heise.de](https://noyb.eu/sites/default/files/2023-07/11VerwarnungPurAboModellfinalgeschwrztp_Redacted.pdf), 2023-05-17, p. 6 + + + +[^fra-handbook]: EU FRA, [Handbook on European data protection law](https://fra.europa.eu/sites/default/files/fra_uploads/fra-coe-edps-2018-handbook-data-protection_en.pdf), 2018 edition, section 2.1 +[^auernhammer21]: Eßer in Auernhammer, DSGVO/BDSG, 8. edition, 2023, Art. 4 Nr. 1 DSGVO, mn. 21 +[^beckok17]: Schild in BeckOK Datenschutzrecht, 45. edition, 2023, Art. 4 Nr. 1, mn. 17 +[^beckok1719]: Schild in BeckOK Datenschutzrecht, 45. edition, 2023, Art. 4 Nr. 1, mn. 17, 19 +[^beckok20]: Schild in BeckOK Datenschutzrecht, 45. edition, 2023, Art. 4 Nr. 1, mn. 20 +[^klabunde18]: Klabunde in Ehmann/Selmayr/Klabunde, DS-GVO, 2. edition, 2018, Art. 4 DSGVO Nr. 1, mn. 18 +[^klabunde15]: Klabunde in Ehmann/Selmayr/Klabunde, DS-GVO, 2. edition, 2018, Art. 4 DSGVO Nr. 1, mn. 18 +[^gola23]: Gola in Gola/Heckmann, Datenschutz-Grundverordnung - Bundesdatenschutzgesetz, 3. edition, 2022, Art. 4 Nr. 1 DSGVO, mn. 23 +[^hermann32]: Hermann/Mühlenbeck/Schwartmann in Schwartmann/Jaspers/Thüsing/Kugelmann, DS-GVO/BDSG, 2. edition, 2020, Art. 4 Nr. 1 DSGVO, mn. 32 +[^ernst8]: Ernst in Paal/Pauly, DS-GVO BDSG, 3. edition, 2021, Art. 4 Nr. 1 DSGVO, mn. 8 +[^ernst18]: Ernst in Paal/Pauly, DS-GVO BDSG, 3. edition, 2021, Art. 4 Nr. 1 DSGVO, mn. 18 +[^farinho20]: Farinho in Spiecker gen. Döhmann/Papakonstantinou/Hornung/De Hert, General Data Protection Regulation, Art. 4(1) Personal data, 2023, mn. 20 +[^farinho2124]: Farinho in Spiecker gen. Döhmann/Papakonstantinou/Hornung/De Hert, General Data Protection Regulation, Art. 4(1) Personal data, 2023, mn. 21, 24 +[^arning2430]: Arning/Rothkegel in Taeger/Gabel, DSGVO - BDSG - TTDSG, 4. edition, 2022, Art. 4 DSGVO, mn. 24, 30 +[^arning27]: Arning/Rothkegel in Taeger/Gabel, DSGVO - BDSG - TTDSG, 4. edition, 2022, Art. 4 DSGVO, mn. 27 +[^ziebarth14]: Ziebarth in Sydow/Marsch, DS-GVO/BDSG, 3. edition, 2022, Art. 4 Nr. 1 DSGVO, mn. 14 +[^klar36]: Klar/Kühling in Kühling/Buchner, DS-GVO/BDSG, 3. edition, 2020, Art. 4 Nr. 1 DSGVO, mn. 36 +[^klar39]: Klar/Kühling in Kühling/Buchner, DS-GVO/BDSG, 3. edition, 2020, Art. 4 Nr. 1 DSGVO, mn. 39 +[^albrecht3]: Albrecht/Jotzo, Das neue Datenschutzrecht der EU, 1. edition, 2017, Part 3, mn. 3 +[^schmidt88]: Schmidt, Anforderungen an den Einsatz von Cookies, Browser-Fingerprinting und ähnlichen Techniken im deutschen Recht, K&R 2016, 86, p. 88 +[^schantz291292]: Schantz in Schantz/Wolff, Das neue Datenschutzrecht, 1. edition, 2017, chapter C.II, mn. 291–292 +[^schantz292293]: Schantz in Schantz/Wolff, Das neue Datenschutzrecht, 1. edition, 2017, chapter C.II, mn. 292–293 +[^schantz293]: Schantz in Schantz/Wolff, Das neue Datenschutzrecht, 1. edition, 2017, chapter C.II, mn. 293 +[^schantz291]: Schantz in Schantz/Wolff, Das neue Datenschutzrecht, 1. edition, 2017, chapter C.II, mn. 291 +[^karg4849]: Karg in Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht, 1. edition, 2019, Art. 4 Nr. 1 DSGVO, mn. 48–49 (translated) +[^karg50]: Karg in Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht, 1. edition, 2019, Art. 4 Nr. 1 DSGVO, mn. 50 +[^karg5253]: Karg in Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht, 1. edition, 2019, Art. 4 Nr. 1 DSGVO, mn. 52–53 +[^karg65]: Karg in Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht, 1. edition, 2019, Art. 4 Nr. 1 DSGVO, mn. 65 +[^karg288]: Karg/Kühn, Datenschutzrechtlicher Rahmen für "Device Fingerprinting" - Das klammheimliche Ende der Anonymität im Internet, ZD 2014, 285, p. 288 +[^wenhold130]: Wenhold, Nutzerprofilbildung durch Webtracking, 1. edition, 2018, chapter E.I.2, p. 130 +[^wenhold144]: Wenhold, Nutzerprofilbildung durch Webtracking, 1. edition, 2018, chapter E.I.2, p. 144 +[^dieterich201]: Dieterich, Canvas Fingerprinting – Rechtliche Anforderungen an neue Methoden der Nutzerprofilerstellung, ZD 2015, 199, p. 201 +[^zuiderveen-borgesius268]: Zuiderveen Borgesius, Singling out people without knowing their names – Behavioural targeting, pseudonymous data, and the new Data Protection Regulation, Computer Law & Security Review 2016, 256, p. 268 ([longer open access preprint](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2733115)) +[^wp136]: Article 29 Data Protection Working Party, [WP 136: Opinion 4/2007 on the concept of personal data](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2007/wp136_en.pdf), p. 14 +[^wp188]: Article 29 Data Protection Working Party, [WP 188: Opinion 16/2011 on EASA/IAB Best Practice Recommendation on Online Behavioural Advertising](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2011/wp188_en.pdf), p. 8 +[^tosoni-single]: Tosoni/Bygrave in Kuner/Bygrave/Docksey, The EU General Data Protection Regulation: A Commentary, 1. edition, 2020, Art. 4(1) GDPR, p. 108 diff --git a/content/en/contact.md b/content/en/contact.md index b41d12e5a..eb137fbba 100644 --- a/content/en/contact.md +++ b/content/en/contact.md @@ -5,6 +5,7 @@ ## Information according to § 5 of German Telemedia Act (TMG) +
**Mail address** (no office hours): Datenanfragen.de e. V. Schreinerweg 6 @@ -21,6 +22,7 @@ Datenanfragen.de e. V. is a non-profit listed in the register of associatio **Responsible for the content according to § 18(2) of German State Media Treaty (MStV):** Benjamin Altpeter, Schreinerweg 6, 38126 Braunschweig, Germany +
Please note that we are an independent non-profit and not affiliated with the companies listed in our company database.
diff --git a/content/en/devlog/tweasel-update-4/data-tweasel-org-screenshot.png b/content/en/devlog/tweasel-update-4/data-tweasel-org-screenshot.png new file mode 100644 index 000000000..3a5f319c4 Binary files /dev/null and b/content/en/devlog/tweasel-update-4/data-tweasel-org-screenshot.png differ diff --git a/content/en/devlog/tweasel-update-4/index.md b/content/en/devlog/tweasel-update-4/index.md new file mode 100644 index 000000000..6e8caabfe --- /dev/null +++ b/content/en/devlog/tweasel-update-4/index.md @@ -0,0 +1,74 @@ +{ + "title": "Tweasel update #4: Request database, tracker documentation and legal research", + "type": "devlog", + "date": "2023-10-05T19:08:23+02:00", + "description": "Our tweasel updates are back after the summer. We have made our request data publicly available, such that anyone can run SQL queries against our datasets. We have also better documented many of our TrackHAR adapters. Furthermore, we have begun doing legal research to inform our decisions on how to establish tracker IDs as personal data in our complaints.", + "authors": [ "baltpeter" ] +} + +Now that summer is over, we’re back to our semi-regular updates from the [tweasel project](https://docs.tweasel.org/), where we are building a web app for fighting privacy violations in mobile apps. In this update, we are excited to announce that we have launched our open request database, where anyone can access and query the traffic data that we have collected from thousands of Android and iOS apps. We have also been busy documenting the trackers that we encounter in our data, using various sources and methods to identify the types of personal data that they transmit. Additionally, we have started doing legal research into how to establish tracker IDs as personal data and to prepare for writing our complaint templates. + +## TrackHAR and documentation + +* We have launched our open request database at [data.tweasel.org](https://data.tweasel.org/). We regularly run traffic analyses on thousands of Android and iOS apps. As we want to enable as many people as possible to look into the inner workings of trackers, we are finally publishing our datasets for other researchers, activists, journalists, and anyone else who is interested in understanding tracking. There are already 250k requests from between January 2021 and July 2023, with more to come in the future. + + {{< img name="data-tweasel-org-screenshot.png" alt="Screenshot of data.tweasel.org, showing a query that returns multiple requests. The screenshot shows seven rows, with the following columns: initiator (e.g. com.amazon.dee.app@2.2.453377.0, com.opera.app.news@11.1.2254.67011), platform (android or ios), endpointUrl (e.g. https://us-u.openx.net/w/1.0/cm, https://csi.gstatic.com/csi), content (one requests has a base64-encoded binary content, another one has an XML document, for the others, the content is blank), and headers." >}} + + To publish the data, we are using the phenomenal [Datasette](https://datasette.io/). We have installed a few plugins to provide even more features, and have written a custom plugin to enhance the display of requests in table views ([source code](https://github.com/tweaselORG/data.tweasel.org), [more details](https://github.com/tweaselORG/meta/issues/33)). + + This setup allows anyone to run arbitrary SQL queries (enhanced with additional features by the plugins) against the data. We hope that this will enable others to do investigations that we couldn't even think of. To give just a few (pretty basic) examples of the kinds of queries that can be run: + * [endpoints that were contacted by the most apps](https://data.tweasel.org/data?sql=select+count(distinct+regex_replace(%27%40.%2B%3F%24%27%2C+coalesce(initiator%2C+%27%3Cno+app+ID%3E%27)%2C+%27%27))+appCount%2C+count(1)+requestCount%2C+endpointUrl+from+requests%0D%0Awhere+endpointUrl+is+not+null%0D%0Agroup+by+endpointUrl++order+by+appCount+desc+limit+101%3B) + * [requests by a particular app, e.g. Airbnb on Android](https://data.tweasel.org/data?sql=select+link(dataset%2C+id)%2C+initiator%2C+platform%2C+runType%2C+startTime%2C+method%2C+httpVersion%2C+endpointUrl%2C+scheme%2C+host%2C+port%2C+path%2C+content%2C+headers%2C+cookies+%0D%0Afrom+requests%0D%0Awhere+initiator+like+%3AappId+||+%27%40%25%27%0D%0Alimit+101%3B&appId=com.airbnb.android) + * [longest requests](https://data.tweasel.org/data?sql=select+length(content)+%2B+length(path)+%2B+length(headers)+%2B+length+(cookies)+as+length%2C+link(dataset%2C+id)%2C+initiator%2C+platform%2C+runType%2C+startTime%2C+method%2C+httpVersion%2C+endpointUrl%2C+scheme%2C+host%2C+port%2C+path%2C+content%2C+headers%2C+cookies+from+requests%0D%0Aorder+by+length+desc%0D%0Alimit+10%3B) +* I've been busy [backing up our adapters with proper documentation](https://github.com/tweaselORG/TrackHAR/issues/9) on the reasoning behind why we think properties contain certain data types. In the first prerelease of TrackHAR, we have called most associations "obvious" but we want to do better than that. This is especially important for the complaints later on. It is a very labor-intensive process but this is also one of the main benefits our the adapter approach: We can provide verifiable evidence for each bit of data that we claim was transmitted. In fact, I have found that a surprising number of the trackers (around half) actually have public documentation on these properties that we can reference. Obviously, the companies themselves admitting to which types of data they collect is the best evidence we can get. + + But sometimes, such documentation is not available. We have a [hierarchy of possible justifications](https://trackers.tweasel.org/research) that we go through in those cases: SDK source code, obvious property names, observed values match known device parameters, obvious observed values, experiments. + + So far, I have produced documentation for the following trackers/adapters, adding missing properties and adapters along the way (though none of them are merged or released yet): [Adjust](https://github.com/tweaselORG/TrackHAR/issues/26) ([PR](https://github.com/tweaselORG/TrackHAR/pull/28)), [branch.io v1](https://github.com/tweaselORG/TrackHAR/issues/30) ([PR](https://github.com/tweaselORG/TrackHAR/pull/31)), [Bugsnag](https://github.com/tweaselORG/TrackHAR/pull/51), [Facebook](https://github.com/tweaselORG/TrackHAR/issues/27) ([PR](https://github.com/tweaselORG/TrackHAR/pull/35)), [ioam.de](https://github.com/tweaselORG/TrackHAR/issues/38) ([PR](https://github.com/tweaselORG/TrackHAR/pull/43)), [Microsoft App Center](https://github.com/tweaselORG/TrackHAR/issues/44) ([PR](https://github.com/tweaselORG/TrackHAR/pull/47)), [OneSignal](https://github.com/tweaselORG/TrackHAR/issues/49) ([PR](https://github.com/tweaselORG/TrackHAR/pull/50)), [singular.net](https://github.com/tweaselORG/TrackHAR/issues/16) ([PR](https://github.com/tweaselORG/TrackHAR/pull/24)) +* When I started the adapter work, we only had a very basic idea of how we actually wanted to document all this but I decided to just get my feet wet and gain a better understanding of the problem as I worked on it. That sparked some very [in-depth discussions](https://github.com/tweaselORG/meta/issues/3#issuecomment-1682038715). To summarize the main conclusions: + * Where should the documentation be stored (in pads hosted somewhere, in GitHub issues, in Markdown files in some repo, …)? +We decided to keep the documentation as [Markdown files in the TrackHAR repo](https://github.com/tweaselORG/TrackHAR/pull/32), such that each page gets its own folder and each property its own file. We glue the sections together using Hugo in the `tracker-wiki` repo (which Lorenz has already [implemented](https://github.com/tweaselORG/tracker-wiki/pull/7)). This way, we can easily reference the reasoning for each property and generate links to the final documentation. + * [How should we archive the external links that we use as sources for our documentation?](https://github.com/tweaselORG/meta/issues/36) +This one is particularly tricky. We ideally want to use an established and trusted service like the [Wayback Machine](https://web.archive.org/) but that has issues with lots of the pages we tried (sites blocking the archiving resulting in broken snapshots, dynamic content not being captured properly). The only other public alternative is archive.today, which is heavily gated behind reCAPTCHA and cannot be automated. Meanwhile, the available self-hosted solutions all have their own problems, and we wouldn't be able to host them publicly anyway due to copyright issues. In the end, we decided to create our own solution, keeping that as simple as possible: + * We store the original links in the `reasoning` field of the adapters, and have a file watcher that tries to archive them using the [Save Page Now API](https://archive.org/details/spn-2-public-api-page-docs-2023-01-22) of archive.org. Errors are recorded in a local file so we can retry using an exponential backoff strategy. Lorenz has mostly [implemented](https://github.com/tweaselORG/TrackHAR/pull/54) this already. + + The archived links are stored in a CSV file in the TrackHAR repo and have redirects set up in a subfolder on `trackers.tweasel.org`. + * If automatic archiving fails, we have to manually create a snapshot on a public archive, likely using archive.today and add that to the CSV. + * We will manually take screenshots and PDFs of the pages, and upload them to a Nextcloud folder or similar. These can unfortunately not be hosted publicly. + * We'll create a [linting script](https://github.com/tweaselORG/TrackHAR/issues/33) that warns us on commit if some of the links have not been archived. + * What do we even want to document, how in-depth do we want to go? Do we always need to reference official documentation if available? +We decided that we will only document things related to the properties in our adapters to avoid scope creep, even though there are a lot of (disturbingly) interesting admissions on tracker websites. It is fine to use "obvious" as a reasoning if the property name or value is self-explanatory. We do not need to seek out official documentation for every property, but we should update our documentation if we find it later. We also decided that we won't document properties that are listed in official documentation but that we have not observed in our requests, as we only rely on the data we find. + * How do we document the honey data that we use for our analysis? +We decided to document the honey data as JSON in the `datasets` table of `data.tweasel.org` and create a nice human-readable view using a plugin. +* To enable the adapter work, I've written a [script for debugging adapters](https://github.com/tweaselORG/TrackHAR/pull/17) that allows you to run an adapter against *all* matching requests in our request database. And as I said, that database (including its API) is public, so *anyone* can use this, not just us. + + {{< img name="trackhar-debug-script-screenshot.png" alt="Screenshot of the debug script being run in a terminal. It shows properties (manfacturer, model, isRooted, carrier, screenHeight, etc.) being matched to values. For example, the values for osVersion are 11 and 13, for isEmulator: true and false, for timezone: 3600000." >}} + + This is quite a powerful tool for ensuring that our adapters are correct—you can quite easily spot transmissions that don't match your initial expectations and correct the adapter accordingly. +* The adapter work has also given rise to quite a few architecture issues and questions for TrackHAR that we'll have to consider: + * [How do we deal with tracker-specific "empty" values?](https://github.com/tweaselORG/TrackHAR/issues/46), e.g. if `idfa: none` is transmitted, we don't want to identify an IDFA transmission. I've proposed `onlyIf` and `notIf` regex filters in `DataPath`. + * [How fine-grained do we want to be with our categorisation of proprietary IDs?](https://github.com/tweaselORG/TrackHAR/issues/45). Currently, they all end up as `otherIdentifiers`, but there are various different types. In the complaints, we'll have to [argue for each one why it is personal data](https://github.com/tweaselORG/TrackHAR/issues/25#issuecomment-1735287854). Does that mean that we need a specific property and justification blurb for each possible ID? Or can we maybe get away with just having more granular ID types (session, device, user, installation, …)? + * [How do we represent transmitted events?](https://github.com/tweaselORG/TrackHAR/issues/37) + * [I don't think we should list the locale under `country` anymore.](https://github.com/tweaselORG/TrackHAR/issues/22) + * I proposed [renaming our current `idfa` property to `advertisingId`, and `ifdv` to `developerScopedId`](https://github.com/tweaselORG/TrackHAR/issues/21) to avoid making them sound iOS-specific. + * We should be more clever in recognizing endpoint URLs, by at least [trimming trailing slashes](https://github.com/tweaselORG/TrackHAR/issues/34). +* Finally, I have started investigating Google's tracking endpoints more thoroughly. Those are mostly not publicly documented and use Protobuf as the transmission format, which doesn't contain any property names that we could rely on. I've made good progress on a [new adapter for `firebaselogging-pa.googleapis.com`](https://github.com/tweaselORG/TrackHAR/issues/52), which is actually the fourth most common endpoint in our dataset (as you can see for yourself on [`data.tweasel.org`](https://data.tweasel.org/data?sql=select+count(distinct+regex_replace(%27%40.%2B%3F%24%27%2C+coalesce(initiator%2C+%27%3Cno+app+ID%3E%27)%2C+%27%27))+appCount%2C+count(1)+requestCount%2C+endpointUrl+from+requests%0D%0Awhere+endpointUrl+is+not+null%0D%0Agroup+by+endpointUrl++order+by+appCount+desc+limit+101%3B)). I've discovered the actual Protobuf schemas for those scattered around various public Google repositories, which will allow us to definitively identify the transmitted properties. + + I've also started [looking into `app-measurement.com`](https://github.com/tweaselORG/TrackHAR/issues/53), but not gotten too far yet. + +## Complaints + +* I have started doing legal research, looking into relevant complaints, court submissions, decisions, rulings, recommendations, and legal commentary regarding tracking to inform our decisions on how we establish tracker IDs as personal data in our complaints and also prepare for writing our complaint templates. I have collected a [comprehensive list of sources to go through](https://github.com/tweaselORG/meta/issues/38). I am using [Hypothes.is](https://web.hypothes.is/) to organise and annotate them as I go along. Unfortunately, we cannot share these annotations publicly as the source material is copyrighted but I have documented my [main conclusions and learnings](https://github.com/tweaselORG/meta/issues/38#issuecomment-1739101286). + + Based on that research, I am also keeping lists of relevant [decisions/judgements by DPAs and courts](https://github.com/tweaselORG/meta/issues/35), [complaints by others as a reference](https://github.com/tweaselORG/meta/issues/39), and [national implementations of Art. 5(3) ePrivacy directive](https://github.com/tweaselORG/meta/issues/10). + +## Outreach + +* We gave a (German) [talk for Topio's lecture series "human rights in the digital age"](https://www.datenanfragen.de/verein/event/topio-09-2023/), aimed at a non-technical audience. Topio is a Berlin based non-profit that offers people free support on privacy topics. While the first half of the talk focused on datarequests.org, the second half was about our work into mobile tracking and what we're doing with tweasel. Unfortunately, there is no recording but I created an [annotated presentation](https://github.com/datenanfragen/website/pull/1100) (not merged yet), inspired by Simon Willison. +* Fellow privacy NGO [noyb filed their first three complaints against illegal tracking in mobile apps](https://noyb.eu/en/how-mobile-apps-illegally-share-your-personal-data) with the French CNIL, namely MyFitnessPal, Fnac and SeLoger. We were happy to contribute some insights from our research, which is also cited in the [complaints](https://noyb.eu/sites/default/files/2023-09/Complaint%20Fnac%20EN_redacted.pdf). We are looking forward to see the results of these complaints and will be following them closely to inform our own complaints. + + As we have mentioned before: If you're also working against (mobile) tracking, absolutely do [reach out](https://www.datarequests.org/contact/) so we can collaborate and share our knowledge! + +## Libraries + +* We have noticed that our tools and libraries are currently broken on Windows. We have identified at least two problems so far: [`appstraction`'s `postinstall` script is broken](https://github.com/tweaselORG/appstraction/issues/118) and [Android emulators don't work](https://github.com/tweaselORG/andromatic/issues/9). Lorenz has [started work on the former](https://github.com/tweaselORG/appstraction/pull/120), finding differences in command separators in \*nix and Windows shells as the problem. diff --git a/content/en/devlog/tweasel-update-4/trackhar-debug-script-screenshot.png b/content/en/devlog/tweasel-update-4/trackhar-debug-script-screenshot.png new file mode 100644 index 000000000..30f807e87 Binary files /dev/null and b/content/en/devlog/tweasel-update-4/trackhar-debug-script-screenshot.png differ diff --git a/content/en/verein/board.md b/content/en/verein/board.md index 5652b1690..38eded53a 100644 --- a/content/en/verein/board.md +++ b/content/en/verein/board.md @@ -7,6 +7,7 @@ All important business of the association is conducted by the executive board. According to our {{< link slug="verein/constitution#7-the-board" text="constitution" >}}, the board is composed of two equal chairpersons, who represent the association jointly, and an arbitrary number of assessors, who check and support the board in its work. The current board has been elected in the general assembly on July 16, 2020, and consists of: +
* Benjamin Altpeter, Chairperson ([benni@datenanfragen.de](mailto:benni@datenanfragen.de), [PGP key](/pgp/AF1381BD.asc) `9F99 3663 0B82 D3C7 DFC9  23F6 EB5C F074 AF13 81BD`) * Lorenz Sieben, Chairperson ([lorenz@datenanfragen.de](mailto:lorenz@datenanfragen.de), [PGP key](/pgp/4C44A6EF.asc) @@ -28,3 +29,4 @@ You can contact the board through several different ways: Schreinerweg 6 38126 Braunschweig Germany* +
diff --git a/content/es/contact.md b/content/es/contact.md index 80d3368e0..c9db8fe0f 100644 --- a/content/es/contact.md +++ b/content/es/contact.md @@ -7,6 +7,7 @@ ## Información de acuerdo con § 5 de la ley alemana de telecomunicaciones (TMG) +
**Dirección postal:** Datenanfragen.de e. V. Schreinerweg 6 @@ -23,6 +24,7 @@ Datenanfragen.de e. V. es una organización sin fines de lucro que figura e **Responsable del contenido según § 18(2) Tratado Interestatal Alemán de Medios *(MStV)*:** Benjamin Altpeter, Schreinerweg 6, 38126 Braunschweig, Alemania +
Ten en cuenta que somos una organización sin fines de lucro independiente y no estamos afiliados a las empresas que figuran en nuestra base de datos de empresas.
diff --git a/content/es/donate.md b/content/es/donate.md index 2f3699af4..0131d5636 100644 --- a/content/es/donate.md +++ b/content/es/donate.md @@ -43,10 +43,12 @@ Como organización sin fines de lucro de beneficio público, también podemos em Si no deseas revelar tu identidad, puedes utilizar una moneda criptográfica anónima o enviarnos dinero en efectivo por correo a nuestra dirección: +
*Datenanfragen.de e. V. Schreinerweg 6 38126 Braunschweig Alemania* +
Para donaciones en efectivo, sugerimos utilizar el servicio postal alemán [WERT NATIONAL](https://www.deutschepost.de/de/w/wert-national.html) o un producto similar ofrecido por tu oficina de correos local. No recomendamos enviar donaciones en efectivo a nivel internacional. En cualquier caso, asegúrate de que el contenido de tu carta no sea visible desde el exterior. diff --git a/content/es/privacy.md b/content/es/privacy.md index 820dea36e..890d31f2c 100644 --- a/content/es/privacy.md +++ b/content/es/privacy.md @@ -33,6 +33,7 @@ Con nuestro sitio web solicituddedatos.es (así como sus traducciones), queremos El responsable del tratamiento según se define en el art. 4 (7) RGPD para los servicios mencionados en el "Alcance" es: +
Datenanfragen.de e. V. Schreinerweg 6 38126 Braunschweig @@ -47,6 +48,7 @@ Email: [privacy@datenanfragen.de](mailto:privacy@datenanfragen.de) ([PGP key](ht Web: [www.datarequests.org/verein](https://www.datarequests.org/verein) Si tienes alguna pregunta sobre nuestra política de privacidad, crees que estamos violando las leyes de protección de datos o deseas hacer valer tus derechos, no dudes en contactarnos en cualquier momento. +
### Do Not Track (DNT) diff --git a/content/es/verein/board.md b/content/es/verein/board.md index fe160ed32..ce17bce0e 100644 --- a/content/es/verein/board.md +++ b/content/es/verein/board.md @@ -6,7 +6,7 @@ } Todos los asuntos importantes de la asociación están a cargo de la junta directiva. Según nuestra {{< link slug="verein/constitution#7-the-board" text="constitución" >}}, la junta está compuesta por dos presidentes iguales, que representan conjuntamente a la asociación, y un número arbitrario de asesores, que controlan y apoyan a la junta en su trabajo. La junta actual ha sido elegida en la asamblea general el 16 de julio de 2020 y está formada por: - +
* Benjamin Altpeter, Presidente ([benni@datenanfragen.de](mailto:benni@datenanfragen.de), [PGP key](/pgp/AF1381BD.asc) `9F99 3663 0B82 D3C7 DFC9  23F6 EB5C F074 AF13 81BD`) * Lorenz Sieben, Presidente ([lorenz@datenanfragen.de](mailto:lorenz@datenanfragen.de), [PGP key](/pgp/4C44A6EF.asc) @@ -28,3 +28,4 @@ Puede contactar con la junta a través de varias formas diferentes: Schreinerweg 6 38126 Braunschweig Alemania* +
\ No newline at end of file diff --git a/content/fr/blog/sample-letter-gdpr-access-request/index.md b/content/fr/blog/sample-letter-gdpr-access-request/index.md index ff3bd6c69..ca3dc1375 100644 --- a/content/fr/blog/sample-letter-gdpr-access-request/index.md +++ b/content/fr/blog/sample-letter-gdpr-access-request/index.md @@ -47,7 +47,7 @@ Ci-dessous est notre lettre pour les demandes d'accès concernant l'Article 15 d

Ma demande comprend explicitement tous les autres services et sociétés dont vous êtes responsable comme défini dans l'Article 4, alinéa 7 du RGPD .

-

Conformément à l'Article 12, alinéa 3 du RGPD, vous devez me fournir les informations demandées dans les meilleurs délais et, dans tout les cas, dans un délai d'un mois après réception de la demande. Conformément à l'Article 15, alinéa 3 du RGPD, vous devez répondre à cette demande sans frais de ma part.

+

Conformément à l'Article 12, alinéa 3 du RGPD, vous devez me fournir les informations demandées dans les meilleurs délais et, en tout état de cause, dans un délai d'un mois après réception de la demande. Conformément à l'Article 15, alinéa 3 du RGPD, vous devez répondre à cette demande sans frais de ma part.

J'inclus les informations suivantes nécessaires pour m'identifier :
Insère ici tes données pour l'identification. Ce sont souvent des informations telles que ton nom, ta date de naissance, ton adresse, ton adresse e-mail, etc.

diff --git a/content/fr/contact.md b/content/fr/contact.md index 5ec5147ab..126963e46 100644 --- a/content/fr/contact.md +++ b/content/fr/contact.md @@ -5,6 +5,7 @@ ## Informations relatives au paragraphe 5 de la loi allemande sur les télémédias (TMG) +
**Adresse postale** (pas d'horaires de bureau) : Datenanfragen.de e. V. Schreinerweg 6 @@ -21,6 +22,7 @@ Datenanfragen.de e. V. est une association à but non lucratif enregistrée **Responsable de la publication, conformément au paragraphe 18, alinéa 2 du traité allemand «médias» (MStV) :** Benjamin Altpeter, Schreinerweg 6, 38126 Braunschweig, Allemagne +
Note que nous sommes une organisation indépendante et à but non lucratif et que nous ne sommes pas affiliés aux entreprises listées dans notre base de données d'entreprises.
diff --git a/content/fr/verein/board.md b/content/fr/verein/board.md index 2e828a76c..befa18561 100644 --- a/content/fr/verein/board.md +++ b/content/fr/verein/board.md @@ -7,6 +7,7 @@ Toutes les affaires importantes de l'association sont menées par le comité directeur. Conformément à notre {{< link slug="/verein/constitution" text="constitution" fragment="7-le-comité-directeur" >}}, le comité directeur est composé de deux présidents paritaires, qui représentent conjointement l'association, et d'un nombre arbitraire de conseillers, qui contrôlent et soutiennent le comité directeur dans son travail. Le comité actuel a été élu lors de l'assemblée générale du 16 juillet 2020 et se compose de : +
* Benjamin Altpeter, Président associé ([benni@datenanfragen.de](mailto:benni@datenanfragen.de), [Clé PGP](/pgp/AF1381BD.asc) `9F99 3663 0B82 D3C7 DFC9  23F6 EB5C F074 AF13 81BD`) * Lorenz Sieben, Président associé ([lorenz@datenanfragen.de](mailto:lorenz@datenanfragen.de), [Clé PGP](/pgp/4C44A6EF.asc) @@ -28,3 +29,4 @@ Tu peux contacter le comité directeur de différentes façons : Schreinerweg 6 38126 Braunschweig Allemagne* +
diff --git a/content/fr/verein/transparency.md b/content/fr/verein/transparency.md index 7d1a975b3..81cca6dc5 100644 --- a/content/fr/verein/transparency.md +++ b/content/fr/verein/transparency.md @@ -14,6 +14,7 @@ Ces informations ont été mises à jour pour la dernière fois le 30 mai 2021. Ces informations sont également disponibles sur notre page de {{< link slug="contact" text="contact" >}}. +
- Nom : Datenanfragen.de e. V. - Siège social : Braunschweig, Allemagne - Registre : Registre des associations du tribunal du district de Braunschweig @@ -25,6 +26,7 @@ Ces informations sont également disponibles sur notre page de {{< link slug="co Allemagne - Date de création : 14 juin 2018 - Contact pour la transparence : Benjamin Altpeter ([transparenz@datenanfragen.de](mailto:transparenz@datenanfragen.de) ou via l'adresse mentionnée plus haut) +
## 2. Constitution et objectifs diff --git a/content/hr/contact.md b/content/hr/contact.md index 4bb60d5bf..7db9b342e 100644 --- a/content/hr/contact.md +++ b/content/hr/contact.md @@ -7,6 +7,7 @@ ## Podaci na osnovi članka 5. njemačkog zakona o telekomunikaciji (TMG) +
**Poštanska adresa**: Datenanfragen.de e. V. Schreinerweg 6 @@ -23,6 +24,7 @@ Datenanfragen.de e. V. je neprofitna organizacija i registrirana je udruga **Odgovornost za sadržaj prema članku 55. stavka 2. njemačkog državnog ugovora o medijima (MStV):** Benjamin Altpeter, Schreinerweg 6, 38126 Braunschweig, Deutschland +
Napominjemo da smo neovisna neprofitna organizacija i da nismo povezani s poduzećima navedenima u našoj bazi podataka poduzeća.
diff --git a/content/hr/open-source.md b/content/hr/open-source.md index ef238e92a..e65e68a81 100644 --- a/content/hr/open-source.md +++ b/content/hr/open-source.md @@ -130,5 +130,5 @@ Ponosni smo što možemo koristiti sljedeće projekte za ovu web-stranicu. Zahva Licence svih korištenih projekata nalaze se [ovdje]({{< absURL "NOTICES.txt" >}}).
- {{< attribution "by" >}} + {{< attribution "od" >}}
diff --git a/content/hr/verein/board.md b/content/hr/verein/board.md index 64a993e36..96670892e 100644 --- a/content/hr/verein/board.md +++ b/content/hr/verein/board.md @@ -7,6 +7,7 @@ Sve važne poslove udruge vodi izvršni odbor. Prema našem {{< link slug="verein/constitution#7-the-board" text="statutu" >}}, odbor se sastoji od dviju predsjedavajućih osoba, koje zajednički predstavljaju udrugu te proizvoljnog broja asesora, koji provjeravaju i podržavaju odbor u radu. Dosadašnji odbor izabran je na glavnoj skupštini 16. srpnja 2020. godine, a čine ga: +
* Benjamin Altpeter, predsjednik ([benni@datenanfragen.de](mailto:benni@datenanfragen.de), [PGP key](/pgp/AF1381BD.asc) `9F99 3663 0B82 D3C7 DFC9  23F6 EB5C F074 AF13 81BD`) * Lorenz Sieben, predsjednik ([lorenz@datenanfragen.de](mailto:lorenz@datenanfragen.de), [PGP key](/pgp/4C44A6EF.asc) @@ -28,3 +29,4 @@ Odbor se može kontaktirati na nekoliko načina: Schreinerweg 6 38126 Braunschweig Germany* +
\ No newline at end of file diff --git a/content/hr/verein/transparency.md b/content/hr/verein/transparency.md index 13780920b..f6ac6dd9f 100644 --- a/content/hr/verein/transparency.md +++ b/content/hr/verein/transparency.md @@ -13,6 +13,7 @@ Ove su informacije zadnji put aktualizirane 30. svibnja 2021. Ovi su podaci također dostupni na našoj stranici {{< link slug="contact" text="Kontakt" >}}. +
- Ime: Datenanfragen.de e. V. - Sjedište: Braunschweig, Njemačka - Registar: Registar udruga pri Okružnom sudu u Braunschweigu @@ -24,6 +25,7 @@ Ovi su podaci također dostupni na našoj stranici {{< link slug="contact" text= Njemačka - Datum osnivanja: 14. lipnja 2018. - Kontakt osoba za transparentnost: Benjamin Altpeter ([transparenz@datenanfragen.de](mailto:transparenz@datenanfragen.de) ili putem gore navedene adrese) +
## 2. Statut i svrha diff --git a/cypress/e2e/old-bugs/donation-widget-nan.spec.js b/cypress/e2e/old-bugs/donation-widget-nan.spec.js index 5d1159984..465b5b088 100644 --- a/cypress/e2e/old-bugs/donation-widget-nan.spec.js +++ b/cypress/e2e/old-bugs/donation-widget-nan.spec.js @@ -31,7 +31,7 @@ describe('Donation widget amount', () => { // testMethod('Credit card'); testMethod('Crypto currency'); testMethod('PayPal'); - testMethod('Other payments'); + //testMethod('Other payments'); }); it('Donation of negative values via bank transfer should not be allowed', () => { diff --git a/cypress/e2e/privacy-controls/company-search-page.spec.js b/cypress/e2e/privacy-controls/company-search-page.spec.js index 42f17494f..ee0f74ab3 100644 --- a/cypress/e2e/privacy-controls/company-search-page.spec.js +++ b/cypress/e2e/privacy-controls/company-search-page.spec.js @@ -4,7 +4,7 @@ describe('Search bar on company search page', () => { cy.contains('Get access').click(); cy.get('.ais-SearchBox-input').type('twitter'); - cy.contains('Twitter International Company'); + cy.contains('Twitter International Unlimited Company'); }); it('is not active when the privacy control is disabled', () => { diff --git a/layouts/company/single.html b/layouts/company/single.html index b5151a5eb..9cb885a67 100644 --- a/layouts/company/single.html +++ b/layouts/company/single.html @@ -21,47 +21,49 @@
- +
+ -

{{ T "cdb-intro" . }}

+

{{ T "cdb-intro" . }}

- {{ with .Params.address }} -
- {{ T "cdb-address" }}
{{ $.Params.name }}
{{ T "cdb-attn" }}
{{ replace . "\n" "
" | safeHTML }} -
- {{ end }} - {{ if or .Params.phone .Params.fax .Params.email .Params.webform .Params.web }} -
- - {{ with .Params.phone }} - - - {{ end }} - {{ with .Params.fax }} - - - {{ end }} - {{ with .Params.email }} - - - {{ end }} - {{ with .Params.webform }} - - - {{ end }} - {{ with .Params.web }} - - - {{ end }} -
{{ T "cdb-phone" }}{{ . }}
{{ T "cdb-fax" }}{{ . }}
{{ T "cdb-email" }}{{ . }}
{{ T "cdb-webform" }}{{ . }}
{{ T "cdb-web" }}{{ . }}
-
- {{ end }} + {{ with .Params.address }} +
+ {{ T "cdb-address" }}
{{ $.Params.name }}
{{ T "cdb-attn" }}
{{ replace . "\n" "
" | safeHTML }} +
+ {{ end }} + {{ if or .Params.phone .Params.fax .Params.email .Params.webform .Params.web }} +
+ + {{ with .Params.phone }} + + + {{ end }} + {{ with .Params.fax }} + + + {{ end }} + {{ with .Params.email }} + + + {{ end }} + {{ with .Params.webform }} + + + {{ end }} + {{ with .Params.web }} + + + {{ end }} +
{{ T "cdb-phone" }}{{ . }}
{{ T "cdb-fax" }}{{ . }}
{{ T "cdb-email" }}{{ . }}
{{ T "cdb-webform" }}{{ . }}
{{ T "cdb-web" }}{{ . }}
+
+ {{ end }} +
{{ if and (index .Params "pgp-fingerprint") (index .Params "pgp-url") }} @@ -116,7 +118,19 @@
{{ T "cdb-warning-unverified" (dict "editUrl" (print ("suggest" | absURL) "#!type=edit&for=cdb&slug=" .Params.slug)) | safeHTML }}
{{ end }} - {{ partialCached "related-companies.html" . .Params.categories (.Param "relevant-countries") }} + {{ $related_pages := partialCached "functions/related-companies.html" . .Params.categories (.Param "relevant-countries") }} + {{ $related_pages := where $related_pages "page.Params.slug" "!=" $.Params.slug }} + {{ with $related_pages }} + + {{ end }}
diff --git a/layouts/partials/functions/related-companies.html b/layouts/partials/functions/related-companies.html new file mode 100644 index 000000000..464681383 --- /dev/null +++ b/layouts/partials/functions/related-companies.html @@ -0,0 +1,67 @@ +{{ $related_pages := slice }} + +{{ if not .Site.Params.devMode }} + + {{ $num_categories := (cond (isset .Params "categories") .Params.categories slice) | len }} + {{ $num_countries := (.Param "relevant-countries") | len }} + + {{ $lowest_score := 999999 }} + + {{ range (where (where .Site.Pages "Section" "company") "Params.categories" "intersect" .Params.categories) }} + {{ if not .Params.nsfw }} + {{ $num_common_categories := intersect $.Params.categories .Params.categories | len }} + {{ $num_common_countries := intersect ($.Param "relevant-countries") (.Param "relevant-countries") | len }} + {{ $score := add (div (float $num_common_categories) $num_categories) (div $num_common_countries $num_countries) }} + + {{ if (or (lt ($related_pages | len) 5) (gt $score $lowest_score)) }} + {{ $related_pages = $related_pages | append (dict "page" . "score" $score) }} + + {{ if lt $score $lowest_score }} + {{ $lowest_score = $score }} + {{ end }} + {{ end }} + {{ end }} + {{ end }} + {{ $related_pages = sort $related_pages "score" "desc" }} +{{ else }} + {{ $datenanfragenPermalink := ref . "company/datenanfragen" }} + {{ $related_pages = slice + (dict + "page" (dict + "Permalink" $datenanfragenPermalink + "Params" (dict "name" "Darkenanfragen AG") + ) + "score" 1.0 + ) + (dict + "page" (dict + "Permalink" $datenanfragenPermalink + "Params" (dict "name" "Acme Inc.") + ) + "score" 1.0 + ) + (dict + "page" (dict + "Permalink" $datenanfragenPermalink + "Params" (dict "name" "Ace Corporation") + ) + "score" 1.0 + ) + (dict + "page" (dict + "Permalink" $datenanfragenPermalink + "Params" (dict "name" "Foo Bar Co.") + ) + "score" 1.0 + ) + (dict + "page" (dict + "Permalink" $datenanfragenPermalink + "Params" (dict "name" "Mum and Pop Ltd.") + ) + "score" 1.0 + ) + }} +{{ end }} + +{{ return $related_pages }} diff --git a/layouts/partials/related-companies.html b/layouts/partials/related-companies.html deleted file mode 100644 index e809e80ed..000000000 --- a/layouts/partials/related-companies.html +++ /dev/null @@ -1,48 +0,0 @@ - -{{ if not .Site.Params.devMode }} - {{ $related_pages := slice }} - - {{ $num_categories := (cond (isset .Params "categories") .Params.categories slice) | len }} - {{ $num_countries := (.Param "relevant-countries") | len }} - - {{ $lowest_score := 999999 }} - - {{ range (where (where .Site.Pages "Section" "company") "Params.categories" "intersect" .Params.categories) }} - {{ if and (ne .Permalink $.Permalink) (not .Params.nsfw) }} - {{ $num_common_categories := intersect $.Params.categories .Params.categories | len }} - {{ $num_common_countries := intersect ($.Param "relevant-countries") (.Param "relevant-countries") | len }} - {{ $score := add (div (float $num_common_categories) $num_categories) (div $num_common_countries $num_countries) }} - - {{ if (or (lt ($related_pages | len) 5) (gt $score $lowest_score)) }} - {{ $related_pages = $related_pages | append (dict "page" . "score" $score) }} - - {{ if lt $score $lowest_score }} - {{ $lowest_score = $score }} - {{ end }} - {{ end }} - {{ end }} - {{ end }} - {{ $related_pages = sort $related_pages "score" "desc" }} - {{ with $related_pages }} - - {{ end }} -{{ else }} - -{{ end }} diff --git a/scripts/build-sample-letters/res/i18n.json b/scripts/build-sample-letters/res/i18n.json index f39e0c8c8..2cc9b28ef 100644 --- a/scripts/build-sample-letters/res/i18n.json +++ b/scripts/build-sample-letters/res/i18n.json @@ -160,7 +160,7 @@ "access-body-030": "Si vous transférez mes données à caractère personnel vers un pays tiers ou une organisation internationale, je demande à être informé des garanties appropriées concernant le transfert, conformément à l'Article 46 du RGPD.", "access-body-040": "[data_portability>Veuillez mettre à ma disposition les données à caractère personnel me concernant que je vous ai fournies dans un format structuré, couramment utilisé et lisible par machine, conformément à l'Article 20, alinéa 1, du RGPD.]", "access-body-050": "Ma demande comprend explicitement [runs>ce qui suit ainsi que ]tous les autres services et sociétés dont vous êtes responsable comme défini dans l'Article 4, alinéa 7 du RGPD [runs>: {runs_list}].", - "access-body-060": "Conformément à l'Article 12, alinéa 3 du RGPD, vous devez me fournir les informations demandées dans les meilleurs délais et, dans tout les cas, dans un délai d'un mois après réception de la demande. Conformément à l'Article 15, alinéa 3 du RGPD, vous devez répondre à cette demande sans frais de ma part.", + "access-body-060": "Conformément à l'Article 12, alinéa 3 du RGPD, vous devez me fournir les informations demandées dans les meilleurs délais et, en tout état de cause, dans un délai d'un mois après réception de la demande. Conformément à l'Article 15, alinéa 3 du RGPD, vous devez répondre à cette demande sans frais de ma part.", "access-filename": "modele-lettre-rdpd-acces-demandetesdonnees.fr", "erasure-subject": "Demande de suppression des données personnelles conformément à l'Art. 17 du RGPD", diff --git a/src/Components/CommentsWidget.tsx b/src/Components/CommentsWidget.tsx index ad853e9f9..39c7dea6d 100644 --- a/src/Components/CommentsWidget.tsx +++ b/src/Components/CommentsWidget.tsx @@ -4,7 +4,7 @@ import { IntlProvider, Text, MarkupText } from 'preact-i18n'; import { FlashMessage, flash } from '../Components/FlashMessage'; import { StarWidget } from './StarWidget'; import t from '../Utility/i18n'; -import { rethrow, WarningException } from '../Utility/errors'; +import { ErrorException, rethrow, WarningException } from '../Utility/errors'; import { useAppStore } from '../store/app'; const api_url = 'https://backend.datenanfragen.de/comments'; @@ -226,8 +226,12 @@ export function CommentForm(props: CommentFormProps) { ...(props.allowRating && rating ? { additional: { rating } } : {}), }), }) - .then((res) => { - if (!res.ok) throw new Error('Unexpected response from comments server.'); + .then(async (res) => { + const payload = await res.json(); + + if (payload.message?.includes('length must be less than')) { + flash({t('send-too-long', 'comments')}); + } else if (!res.ok) throw new ErrorException('Unexpected response from comments server.', payload); flash({t('send-success', 'comments')}); setMessage(''); diff --git a/src/Components/DonationWidget.tsx b/src/Components/DonationWidget.tsx index d043bf3e5..7313c9b3b 100644 --- a/src/Components/DonationWidget.tsx +++ b/src/Components/DonationWidget.tsx @@ -12,7 +12,7 @@ import { Radio } from './Radio'; const DONATIONS_API = 'https://backend.datenanfragen.de/donation'; const SUGGESTED_AMOUNTS = [5, 10, 15, 25, 50, 75, 100, 150, 200, 250]; -const PAYMENT_METHODS = ['bank-transfer', /*'creditcard',*/ 'cryptocurrency', 'paypal', 'mollie']; +const PAYMENT_METHODS = ['bank-transfer', /*'creditcard',*/ 'cryptocurrency', 'paypal' /*, 'mollie'*/]; const amount_after_linear_fee = (fee_percent: number, fee_fixed: number, x: number) => x - fee_fixed - x * fee_percent; diff --git a/src/Components/RequestList.tsx b/src/Components/RequestList.tsx index 9d16b7e1e..4b23cab1d 100644 --- a/src/Components/RequestList.tsx +++ b/src/Components/RequestList.tsx @@ -111,6 +111,17 @@ export const RequestList = (props: RequestListProps) => { onClick={() => setSelectionMode(!selectionMode)}> {selectionMode ? : } + + {!selectionMode && ( + + {t('new-request', 'generator')} + + )} + {!selectionMode && ( <> {props.importEmailsButton} diff --git a/src/general.tsx b/src/general.tsx index a2cf4c048..b30cf9e3c 100644 --- a/src/general.tsx +++ b/src/general.tsx @@ -171,14 +171,18 @@ const unsubscribeFromHydration = useProceedingsStore.persist.onFinishHydration(( }); const renderNewFootnotes = (hugoFootnotes: Element[]) => { - hugoFootnotes.forEach((hugoFootnote, index) => { - const footnoteContent = document.querySelector(`li[id="fn:${index + 1}"]`)?.cloneNode(true) as Element; + hugoFootnotes.forEach((hugoFootnote) => { + const index = +hugoFootnote.id.replace(/fnref\d*:/, ''); + + const footnoteContent = document.querySelector(`li[id="fn:${index}"]`)?.cloneNode(true) as Element | undefined; + if (!footnoteContent) return; + // Since the text content is taken from the bottom footnotes, it contains an arrow at the end that needs to be // removed when the content is displayed within the embedded footnote. - footnoteContent?.querySelector('.footnote-backref')?.remove(); + for (const backrefElement of footnoteContent.querySelectorAll('.footnote-backref')) backrefElement.remove(); render( - + {/* I unfortunately don't see a way to avoid the dangerouslySetInnerHTML here… I'd also love to avoid the nested div. diff --git a/src/i18n/de.json b/src/i18n/de.json index 7942d97b5..55b49f26e 100644 --- a/src/i18n/de.json +++ b/src/i18n/de.json @@ -660,6 +660,7 @@ "sending": "Verschicke Deinen Kommentar…", "send-success": "Kommentar erfolgreich abgesendet. Der Kommentar wird erst angezeigt, wenn er von einer Administrator_in überprüft wurde.", "send-error": "Fehler beim Absenden des Kommentars. Bitte versuche es später erneut.", + "send-too-long": "Fehler beim Absenden des Kommentars. Dein Kommentar ist zu lang.", "error-no-message": "Bitte gib einen Kommentar zum Absenden ein.", "warning-loading-failed": "Das Laden der Kommentare zu diesem Artikel ist fehlgeschlagen. Bitte stelle sicher, dass Du mit dem Internet verbunden bist und Anfragen an backend.datenanfragen.de nicht mit einem Add-On wie uMatrix oder NoScript blockierst.", "no-comments": "Noch keine Kommentare vorhanden. Schreib’ doch einen!", diff --git a/src/i18n/en.json b/src/i18n/en.json index e49ac953b..7a002dd9a 100644 --- a/src/i18n/en.json +++ b/src/i18n/en.json @@ -659,6 +659,7 @@ "sending": "Submitting your comment…", "send-success": "Comment sent successfully. It will have to be accepted by an administrator first before it is shown here.", "send-error": "An error occurred while sending your comment. Please try again later.", + "send-too-long": "An error occurred while sending your comment. Your comment is too long.", "error-no-message": "Please enter a comment to send.", "warning-loading-failed": "Loading the comments for this page failed. Please make sure that you are connected to the internet and not blocking requests to backend.datenanfragen.de through an add-on like uMatrix or NoScript.", "no-comments": "No comments here yet. Why don’t you leave one?", diff --git a/src/i18n/pl.json b/src/i18n/pl.json index 907ba4ff8..ab096927c 100644 --- a/src/i18n/pl.json +++ b/src/i18n/pl.json @@ -175,7 +175,12 @@ "header-home": "Strona główna", "header-generator": "Generator zapytań", "public body": "instytucja publiczna", - "commerce": "handel" + "commerce": "handel", + "home-claim-choose-company-title": "Wybierz firmy", + "home-blog-section-title": "Nasz blog", + "home-blog-section-read-more": "Więcej artykułów", + "footer-advanced-generator": "Zaawansowany generator", + "blog-devlog": "Dziennik deweloperski" }, "countries": { "et": "Etiopia", @@ -420,7 +425,8 @@ "no-results": "Niestety nie znaleziono wyników dla Twojego zapytania.", "suggest-a-company": "Zasugeruj nową firmę", "also-runs": "Działa również: ", - "search-disabled": "Funkcja wyszukiwania została wyłączona. Jeśli chcesz ją włączyć, zapoznaj się z ustawieniami prywatności ." + "search-disabled": "Funkcja wyszukiwania została wyłączona. Jeśli chcesz ją włączyć, zapoznaj się z ustawieniami prywatności .", + "search-results": "Wyniki wyszukiwania" }, "sva-finder": { "private-other-q": "W jakim stanie Pan/Pani mieszka?", @@ -584,7 +590,9 @@ "mailto-dropdown-explanation": "W jaki sposób chcesz wysłać e-mail?", "signature": "Podpis", "include-objection": "Dodatkowo, dodaj sprzeciw w Twojej konkretnej sprawie", - "objection-reason": "Powód sprzeciwu" + "objection-reason": "Powód sprzeciwu", + "continue": "Kontynuuj", + "back": "Wstecz" }, "blog": { "footnote": "Notatka" @@ -634,7 +642,22 @@ "delete-all-btn": "Usuń wszystkie prośby", "export-btn": "Eksportuj wybrane żądania jako CSV", "export-ics": "Eksportuj wybrane żądania do kalendarza", - "no-requests-heading": "Brak zapytań" + "no-requests-heading": "Brak zapytań", + "original-request": "Oryginalna prośba", + "selection-mode": "Wybierz", + "more-options": "Więcej opcji", + "message-reactivate": "Reaktywuj", + "import-message": "Dodaj wiadomość", + "complaint": "Skarga", + "content": "Treść", + "cancel": "Anuluj", + "overdue": "Zaległe", + "response": "Odpowiedź", + "select-all": "Wybierz wszystkie", + "deselect-all": "Odznacz wszystkie", + "correspondent-email": "Adres e-mail", + "subject": "Temat", + "add-message": "Dodaj wiadomość" }, "mailto": { "mailto": "Domyślne oprogramowanie do obsługi poczty e-mail", diff --git a/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.dotx b/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.dotx index 4f7fcc776..bd503074d 100644 Binary files a/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.dotx and b/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.dotx differ diff --git a/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.ott b/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.ott index 674c3d2cf..67ba8c48b 100644 Binary files a/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.ott and b/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.ott differ diff --git a/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.pdf b/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.pdf index 04233d0e7..7e7f2a7d3 100644 Binary files a/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.pdf and b/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.pdf differ diff --git a/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.txt b/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.txt index 5717a913e..bb1b2408a 100644 --- a/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.txt +++ b/static/downloads/modele-lettre-rdpd-acces-demandetesdonnees.fr.txt @@ -29,7 +29,7 @@ Si vous transférez mes données à caractère personnel vers un pays tiers ou u Ma demande comprend explicitement tous les autres services et sociétés dont vous êtes responsable comme défini dans l'Article 4, alinéa 7 du RGPD . -Conformément à l'Article 12, alinéa 3 du RGPD, vous devez me fournir les informations demandées dans les meilleurs délais et, dans tout les cas, dans un délai d'un mois après réception de la demande. Conformément à l'Article 15, alinéa 3 du RGPD, vous devez répondre à cette demande sans frais de ma part. +Conformément à l'Article 12, alinéa 3 du RGPD, vous devez me fournir les informations demandées dans les meilleurs délais et, en tout état de cause, dans un délai d'un mois après réception de la demande. Conformément à l'Article 15, alinéa 3 du RGPD, vous devez répondre à cette demande sans frais de ma part. J'inclus les informations suivantes nécessaires pour m'identifier : {Insère ici tes données pour l'identification. Ce sont souvent des informations telles que ton nom, ta date de naissance, ton adresse, ton adresse e-mail, etc.} diff --git a/static/pgp/4C44A6EF.asc b/static/pgp/4C44A6EF.asc index 34f2c769a..e4dce846c 100644 --- a/static/pgp/4C44A6EF.asc +++ b/static/pgp/4C44A6EF.asc @@ -11,46 +11,46 @@ ZybzYKzzLZYwvqnF8gAQYbdYESmmkfhWXQgjosNYIfy3e1iBkY5cjb7rfm05V5Rs y3AYsK2+eur1urzhepNPZj0M63fmb3rV4e9sHBSOpFnOCXahk8L8mhw6tH+e2boF Q45iq9i7oiRf1+smrNYYaeMM2uPE/P/gIKdcOD2pS1f7LORW4AFTFwccK21Hi6eI 1KfMs63piMt+hp7zniQpwrEHFS4kY1K5Y3mWipS/AinGVrtPu748TjLwqwARAQAB -tCxMb3JlbnogU2llYmVuIDxidWNoaGFsdHVuZ0BkYXRlbmFuZnJhZ2VuLmRlPokC -VAQTAQoAPhYhBFtQ16B1hSbUVarzBd+vErtMRKbvBQJhHi/AAhsDBQkMtbYABQsJ -CAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEN+vErtMRKbvvy4P/3OnUTB+gCTsZYwx -tRlkYnd97JUplpbfXEl1Rt8/y+0DczbRlgmmsyb7AsLjQ/P9RM+8SEztmFZMJFsO -skX8vqhha0hmW1C3ryBGhaZxlZRaq8/1WnLRdOgLC77pcYN5NA6DDCNV3if6qCsE -6TwReVWGugBiTWbtxZ+d5yf+xje+OCp8577VzTRc7NzY35TKUS1i4cFW7Ys6jEdL -WYk8yuVgdmeR2SLNtWEgayPwy2PvL1LdIrVdLUVtAkmOrA/X4Tkh+FxKEWRp3yxg -EGi4ZgRlfBqevFqSXcAjcbBZJcMimFIzpidBu7xVN5t0lO9G368PMDTXPUHSSYuC -zjNFM3UqC/BnSYTCtxEOz1643AmZ1NcjJ5u8WbCUcB3w7Rz2x2NcUiuW4B+axYGX -SKJQzUDStMqJxcX1QihFEB1tYgOAv8w8DoTTFBJnEdTkF1GqJpqRlejK2JRFUJ8u -qbbHHHD2PHBfSz8TdXw6O5MXgqSWN08LsygqVVk1ffkV12jQMlkNCdkuhII9YnBR -DGU//AUhu2Fd7FYIaKGM7SG0cuNLh7rrvFaSkheRFnUYUUiR2VGpyHjIeIy0/FXl -zU+Caxag3KG3rZZbAfzggu+zsH+1J/p+gdQFTIi4UJ/u+fvtM4f/keLXr+3r4BQz -EWX7tmmJ/4KfsDpM/i4X7OadHHcNtCdMb3JlbnogU2llYmVuIDxsb3JlbnpAZGF0 -ZW5hbmZyYWdlbi5kZT6JAlcEEwEKAEECGwMFCQy1tgAFCwkIBwMFFQoJCAsFFgID -AQACHgECF4AWIQRbUNegdYUm1FWq8wXfrxK7TESm7wUCYR4vwQIZAQAKCRDfrxK7 -TESm774MEACEsvl4DzM/jvcvJnKtARWso6ePwNSIZLT9oHC83UXxM8CjOmDS8pKy -a+4Wrmc53wrekm823h2ANOPUAEbNKGej0OBMDkMFvmkujGQdOuHFUcJcc+qpaI3P -sj+94LC5aFLILpOeUvaFyHF1hfkSp+VqEfVKkp2QtC/zSlMAD2sMeHLmXgnlKo30 -cBsHExGGsicdOn1XI5sBZFata54Dk5qP9/cG5P/wsTSGFyrDT4qgogUTcK7r9JU+ -drr/SDY7cMwPVv+OEiaikzfVsS+8/jozR1Rgan4u2be2gMBS01ljTe50laQEhjel -U7hjQAY+MPhtrAne4WqWB45KCalwsjPOPo6OBot9r8xjdEcg1N6kIVQ60b4ZN0g1 -589wqjyFJR3eABj8T6PBm7WmBIegfsOhDU5Km9xI2kJYyvKOUy769RrJPuNDL+MP -4OJEXlWM3sOUBxE3GkSvmVsj2h+cD0ZG5VvmaGgxVFahq8dsorfu7fzQqcdFhdLX -Rr0mr/NihxKYIaPUSZUxu/VVXXpNLOjTgMsgOh4aHg2medajGTe8oFG5NE7RagGH -z6ZQtKEDl79nmL2jWUvF1ygqopi1n6YKYm3EibyW+rgdnDBn3ndViOfSFOMQmjMi -cJ6LCunqVastQkfaYghjS1ifl6o2XWwHAJ4DGHSvRN5IKOLKnQNy0YkCVAQTAQoA -PhYhBFtQ16B1hSbUVarzBd+vErtMRKbvBQJbHyMUAhsDBQkMtbYABQsJCAcDBRUK -CQgLBRYCAwEAAh4BAheAAAoJEN+vErtMRKbvpnkP/0PqhhbAa8Rou46Mmb02YzxF -lKyUvOm0TG5dbgAUXbHkb1RqSaRiv/tr30C/vGNDB10XQAA1368s8pNXzdLHFwvB -q65cz2H1L6ra4eLvMXx9/iPYIlLSAgo5gDVh/WPaKRsZtT8w/bNK1F1BVEBvDQ83 -un9Ur7c5RjnwaR6DeMJHS1+h0B5hsHcAEvaPGzLVpecR7oL9fT6ee2vwVtyFEzkY -ddVC6o/i60YsPucUJqDpSrKLZLId2H03bLySufY/pLwc77VFNT5fG2qagi6jMIzV -qKYTx4xXBa0fse56ue7xyvNrxJ01Wd3nGqRSpkrzl3xyRkopBH647GW63m2We6XR -8QjTuYqjFDzeoqpi2qALdnwCaYFOYE47Qjinnx5+A5wfHKXpU9DmSNFbvRMMPngZ -hMiiWmdbrbtw4HoYt9SmEtKNq8bwpA0SrjjAPx5SccKCM99MVCWmP/s0HZ6fijI4 -zYgvBPx6uqkIv6pEzqAYKgYHhdhD1gOjSxEA9BhEx2ZHV0YG29eU/2UPzFcws/AO -ZKXMGA6obrN0Ka0DQAc9hzyv0s1H/dYDOSZ23UERH5Kz2jrU06ZnjcMFF2XfupGe -3tmIGQyVveXT3j5cuQOQ5UYxyqD3sFJjrjBBrcIyhvJG8jGsxPMhh51PlhMIywtm -2GZV5iu/R/GOhB0GqgUeuQINBFsfIxQBEADEMH6MchFl4NbkKarQZaC8GplNP96K +tCdMb3JlbnogU2llYmVuIDxsb3JlbnpAZGF0ZW5hbmZyYWdlbi5kZT6JAlcEEwEK +AEECGwMFCQy1tgAFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AWIQRbUNegdYUm1FWq +8wXfrxK7TESm7wUCYR4vwQIZAQAKCRDfrxK7TESm774MEACEsvl4DzM/jvcvJnKt +ARWso6ePwNSIZLT9oHC83UXxM8CjOmDS8pKya+4Wrmc53wrekm823h2ANOPUAEbN +KGej0OBMDkMFvmkujGQdOuHFUcJcc+qpaI3Psj+94LC5aFLILpOeUvaFyHF1hfkS +p+VqEfVKkp2QtC/zSlMAD2sMeHLmXgnlKo30cBsHExGGsicdOn1XI5sBZFata54D +k5qP9/cG5P/wsTSGFyrDT4qgogUTcK7r9JU+drr/SDY7cMwPVv+OEiaikzfVsS+8 +/jozR1Rgan4u2be2gMBS01ljTe50laQEhjelU7hjQAY+MPhtrAne4WqWB45KCalw +sjPOPo6OBot9r8xjdEcg1N6kIVQ60b4ZN0g1589wqjyFJR3eABj8T6PBm7WmBIeg +fsOhDU5Km9xI2kJYyvKOUy769RrJPuNDL+MP4OJEXlWM3sOUBxE3GkSvmVsj2h+c +D0ZG5VvmaGgxVFahq8dsorfu7fzQqcdFhdLXRr0mr/NihxKYIaPUSZUxu/VVXXpN +LOjTgMsgOh4aHg2medajGTe8oFG5NE7RagGHz6ZQtKEDl79nmL2jWUvF1ygqopi1 +n6YKYm3EibyW+rgdnDBn3ndViOfSFOMQmjMicJ6LCunqVastQkfaYghjS1ifl6o2 +XWwHAJ4DGHSvRN5IKOLKnQNy0YkCVAQTAQoAPhYhBFtQ16B1hSbUVarzBd+vErtM +RKbvBQJbHyMUAhsDBQkMtbYABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEN+v +ErtMRKbvpnkP/0PqhhbAa8Rou46Mmb02YzxFlKyUvOm0TG5dbgAUXbHkb1RqSaRi +v/tr30C/vGNDB10XQAA1368s8pNXzdLHFwvBq65cz2H1L6ra4eLvMXx9/iPYIlLS +Ago5gDVh/WPaKRsZtT8w/bNK1F1BVEBvDQ83un9Ur7c5RjnwaR6DeMJHS1+h0B5h +sHcAEvaPGzLVpecR7oL9fT6ee2vwVtyFEzkYddVC6o/i60YsPucUJqDpSrKLZLId +2H03bLySufY/pLwc77VFNT5fG2qagi6jMIzVqKYTx4xXBa0fse56ue7xyvNrxJ01 +Wd3nGqRSpkrzl3xyRkopBH647GW63m2We6XR8QjTuYqjFDzeoqpi2qALdnwCaYFO +YE47Qjinnx5+A5wfHKXpU9DmSNFbvRMMPngZhMiiWmdbrbtw4HoYt9SmEtKNq8bw +pA0SrjjAPx5SccKCM99MVCWmP/s0HZ6fijI4zYgvBPx6uqkIv6pEzqAYKgYHhdhD +1gOjSxEA9BhEx2ZHV0YG29eU/2UPzFcws/AOZKXMGA6obrN0Ka0DQAc9hzyv0s1H +/dYDOSZ23UERH5Kz2jrU06ZnjcMFF2XfupGe3tmIGQyVveXT3j5cuQOQ5UYxyqD3 +sFJjrjBBrcIyhvJG8jGsxPMhh51PlhMIywtm2GZV5iu/R/GOhB0GqgUetCxMb3Jl +bnogU2llYmVuIDxidWNoaGFsdHVuZ0BkYXRlbmFuZnJhZ2VuLmRlPokCVAQTAQoA +PhYhBFtQ16B1hSbUVarzBd+vErtMRKbvBQJhHi/AAhsDBQkMtbYABQsJCAcDBRUK +CQgLBRYCAwEAAh4BAheAAAoJEN+vErtMRKbvvy4P/3OnUTB+gCTsZYwxtRlkYnd9 +7JUplpbfXEl1Rt8/y+0DczbRlgmmsyb7AsLjQ/P9RM+8SEztmFZMJFsOskX8vqhh +a0hmW1C3ryBGhaZxlZRaq8/1WnLRdOgLC77pcYN5NA6DDCNV3if6qCsE6TwReVWG +ugBiTWbtxZ+d5yf+xje+OCp8577VzTRc7NzY35TKUS1i4cFW7Ys6jEdLWYk8yuVg +dmeR2SLNtWEgayPwy2PvL1LdIrVdLUVtAkmOrA/X4Tkh+FxKEWRp3yxgEGi4ZgRl +fBqevFqSXcAjcbBZJcMimFIzpidBu7xVN5t0lO9G368PMDTXPUHSSYuCzjNFM3Uq +C/BnSYTCtxEOz1643AmZ1NcjJ5u8WbCUcB3w7Rz2x2NcUiuW4B+axYGXSKJQzUDS +tMqJxcX1QihFEB1tYgOAv8w8DoTTFBJnEdTkF1GqJpqRlejK2JRFUJ8uqbbHHHD2 +PHBfSz8TdXw6O5MXgqSWN08LsygqVVk1ffkV12jQMlkNCdkuhII9YnBRDGU//AUh +u2Fd7FYIaKGM7SG0cuNLh7rrvFaSkheRFnUYUUiR2VGpyHjIeIy0/FXlzU+Caxag +3KG3rZZbAfzggu+zsH+1J/p+gdQFTIi4UJ/u+fvtM4f/keLXr+3r4BQzEWX7tmmJ +/4KfsDpM/i4X7OadHHcNuQINBFsfIxQBEADEMH6MchFl4NbkKarQZaC8GplNP96K i6vMVzqs0N16IsPLgzWLAYtID1+LmDWrbSzqD22eKoZbatQ8UetWoDTXQGRPV433 u0WIM1Uw95M30K/OBO7OyP5NudO9nancSIqELEt/jt9coZWPOy9bCuikEF/bC6U5 PsLE3KDCIl+X9n3qW82SFoECz6FDmrZ5bvcgR4lOarS+UWKTYmlHyksgWcDlkDer @@ -74,5 +74,5 @@ ZP4arpgc6j0TXUrJFWmlIcq2FlGPLtfhPCXjw+mmgFIONOjfQwkYXjQvfHzu/xRX fMI3uldr8o4//0RkqNKnk8GJJsUHN37E/jwEwe4WGOLtoYDpgowx1e9iHYWHYtIp FLVz+zQxV7pG+O+aDIpppC/IIEgiFwyjinGaAbCAwWs4v3ZP9STycRL3vQu1b9bd TIObDI2qR7ke2cnGy5E= -=NfyD +=fDdk -----END PGP PUBLIC KEY BLOCK----- diff --git a/yarn.lock b/yarn.lock index 0a5784c1f..612d21d4e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -132,6 +132,14 @@ dependencies: "@babel/highlight" "^7.16.7" +"@babel/code-frame@^7.22.13": + version "7.22.13" + resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.22.13.tgz#e3c1c099402598483b7a8c46a721d1038803755e" + integrity sha512-XktuhWlJ5g+3TJXc5upd9Ks1HutSArik6jf2eAjYFyIOf4ej3RN+184cZbzDvbPnuTJIUhPKKJE3cIsYTiAT3w== + dependencies: + "@babel/highlight" "^7.22.13" + chalk "^2.4.2" + "@babel/compat-data@^7.10.4", "@babel/compat-data@^7.11.0": version "7.11.0" resolved "https://registry.yarnpkg.com/@babel/compat-data/-/compat-data-7.11.0.tgz#e9f73efe09af1355b723a7f39b11bad637d7c99c" @@ -211,16 +219,7 @@ eslint-visitor-keys "^2.1.0" semver "^6.3.0" -"@babel/generator@^7.11.0": - version "7.11.0" - resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.11.0.tgz#4b90c78d8c12825024568cbe83ee6c9af193585c" - integrity sha512-fEm3Uzw7Mc9Xi//qU20cBKatTfs2aOtKqmvy/Vm7RkJEGFQ4xc9myCfbXxqK//ZS8MR/ciOHw6meGASJuKmDfQ== - dependencies: - "@babel/types" "^7.11.0" - jsesc "^2.5.1" - source-map "^0.5.0" - -"@babel/generator@^7.17.3", "@babel/generator@^7.17.7": +"@babel/generator@^7.17.7": version "7.17.7" resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.17.7.tgz#8da2599beb4a86194a3b24df6c085931d9ee45ad" integrity sha512-oLcVCTeIFadUoArDTwpluncplrYBmTCCZZgXCbgNGvOBBiSDDK3eWO4b/+eOTli5tKv1lg+a5/NAXg+nTcei1w== @@ -238,6 +237,16 @@ "@jridgewell/gen-mapping" "^0.3.0" jsesc "^2.5.1" +"@babel/generator@^7.23.0": + version "7.23.0" + resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.23.0.tgz#df5c386e2218be505b34837acbcb874d7a983420" + integrity sha512-lN85QRR+5IbYrMWM6Y4pE/noaQtg4pNiqeNGX60eqOfo6gtEj6uw/JagelB8vVztSd7R6M5n1+PQkDbHbBRU4g== + dependencies: + "@babel/types" "^7.23.0" + "@jridgewell/gen-mapping" "^0.3.2" + "@jridgewell/trace-mapping" "^0.3.17" + jsesc "^2.5.1" + "@babel/helper-annotate-as-pure@^7.10.4": version "7.10.4" resolved "https://registry.yarnpkg.com/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.10.4.tgz#5bf0d495a3f757ac3bda48b5bf3b3ba309c72ba3" @@ -358,10 +367,10 @@ dependencies: "@babel/types" "^7.16.7" -"@babel/helper-environment-visitor@^7.18.2": - version "7.18.2" - resolved "https://registry.yarnpkg.com/@babel/helper-environment-visitor/-/helper-environment-visitor-7.18.2.tgz#8a6d2dedb53f6bf248e31b4baf38739ee4a637bd" - integrity sha512-14GQKWkX9oJzPiQQ7/J36FTXcD4kSp8egKjO9nINlSKiHITRA9q/R74qu8S9xlc/b/yjsJItQUeeh3xnGN0voQ== +"@babel/helper-environment-visitor@^7.22.20": + version "7.22.20" + resolved "https://registry.yarnpkg.com/@babel/helper-environment-visitor/-/helper-environment-visitor-7.22.20.tgz#96159db61d34a29dba454c959f5ae4a649ba9167" + integrity sha512-zfedSIzFhat/gFhWfHtgWvlec0nqB9YEIVrpuwjruLlXfUSnA8cJB0miHKwqDnQ7d32aKo2xt88/xZptwxbfhA== "@babel/helper-explode-assignable-expression@^7.10.4": version "7.10.4" @@ -389,13 +398,13 @@ "@babel/template" "^7.16.7" "@babel/types" "^7.16.7" -"@babel/helper-function-name@^7.17.9": - version "7.17.9" - resolved "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.17.9.tgz#136fcd54bc1da82fcb47565cf16fd8e444b1ff12" - integrity sha512-7cRisGlVtiVqZ0MW0/yFB4atgpGLWEHUVYnb448hZK4x+vih0YO5UoS11XIYtZYqHd0dIPMdUSv8q5K4LdMnIg== +"@babel/helper-function-name@^7.23.0": + version "7.23.0" + resolved "https://registry.yarnpkg.com/@babel/helper-function-name/-/helper-function-name-7.23.0.tgz#1f9a3cdbd5b2698a670c30d2735f9af95ed52759" + integrity sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw== dependencies: - "@babel/template" "^7.16.7" - "@babel/types" "^7.17.0" + "@babel/template" "^7.22.15" + "@babel/types" "^7.23.0" "@babel/helper-get-function-arity@^7.10.4": version "7.10.4" @@ -418,12 +427,12 @@ dependencies: "@babel/types" "^7.10.4" -"@babel/helper-hoist-variables@^7.16.7": - version "7.16.7" - resolved "https://registry.yarnpkg.com/@babel/helper-hoist-variables/-/helper-hoist-variables-7.16.7.tgz#86bcb19a77a509c7b77d0e22323ef588fa58c246" - integrity sha512-m04d/0Op34H5v7pbZw6pSKP7weA6lsMvfiIAMeIvkY/R4xQtBSMFEigu9QTZ2qB/9l22vsxtM8a+Q8CzD255fg== +"@babel/helper-hoist-variables@^7.22.5": + version "7.22.5" + resolved "https://registry.yarnpkg.com/@babel/helper-hoist-variables/-/helper-hoist-variables-7.22.5.tgz#c01a007dac05c085914e8fb652b339db50d823bb" + integrity sha512-wGjk9QZVzvknA6yKIUURb8zY3grXCcOZt+/7Wcy8O2uctxhplmUPkOdlgoNhmdVee2c92JXbf1xpMtVNbfoxRw== dependencies: - "@babel/types" "^7.16.7" + "@babel/types" "^7.22.5" "@babel/helper-member-expression-to-functions@^7.10.4", "@babel/helper-member-expression-to-functions@^7.10.5": version "7.11.0" @@ -593,6 +602,18 @@ dependencies: "@babel/types" "^7.16.7" +"@babel/helper-split-export-declaration@^7.22.6": + version "7.22.6" + resolved "https://registry.yarnpkg.com/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.22.6.tgz#322c61b7310c0997fe4c323955667f18fcefb91c" + integrity sha512-AsUnxuLhRYsisFiaJwvp1QF+I3KjD5FOxut14q/GzovUe6orHLesW2C7d754kRm53h5gqrz6sFl6sxc4BVtE/g== + dependencies: + "@babel/types" "^7.22.5" + +"@babel/helper-string-parser@^7.22.5": + version "7.22.5" + resolved "https://registry.yarnpkg.com/@babel/helper-string-parser/-/helper-string-parser-7.22.5.tgz#533f36457a25814cf1df6488523ad547d784a99f" + integrity sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw== + "@babel/helper-validator-identifier@^7.10.4": version "7.10.4" resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.10.4.tgz#a78c7a7251e01f616512d31b10adcf52ada5e0d2" @@ -603,6 +624,11 @@ resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.16.7.tgz#e8c602438c4a8195751243da9031d1607d247cad" integrity sha512-hsEnFemeiW4D08A5gUAZxLBTXpZ39P+a+DGDsHw1yxqyQ/jzFEnxf5uTEGp+3bzAbNOxU1paTgYS4ECU/IgfDw== +"@babel/helper-validator-identifier@^7.22.20": + version "7.22.20" + resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.20.tgz#c4ae002c61d2879e724581d96665583dbc1dc0e0" + integrity sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A== + "@babel/helper-validator-option@^7.16.7": version "7.16.7" resolved "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.16.7.tgz#b203ce62ce5fe153899b617c08957de860de4d23" @@ -654,17 +680,26 @@ chalk "^2.0.0" js-tokens "^4.0.0" +"@babel/highlight@^7.22.13": + version "7.22.20" + resolved "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.22.20.tgz#4ca92b71d80554b01427815e06f2df965b9c1f54" + integrity sha512-dkdMCN3py0+ksCgYmGG8jKeGA/8Tk+gJwSYYlFGxG5lmhfKNoAy004YpLxpS1W2J8m/EK2Ew+yOs9pVRwO89mg== + dependencies: + "@babel/helper-validator-identifier" "^7.22.20" + chalk "^2.4.2" + js-tokens "^4.0.0" + "@babel/parser@^7.0.0": version "7.11.5" resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.11.5.tgz#c7ff6303df71080ec7a4f5b8c003c58f1cf51037" integrity sha512-X9rD8qqm695vgmeaQ4fvz/o3+Wk4ZzQvSHkDBgpYKxpD4qTAUm88ZKtHkVqIOsYFFbIQ6wQYhC6q7pjqVK0E0Q== -"@babel/parser@^7.10.4", "@babel/parser@^7.11.0": +"@babel/parser@^7.10.4": version "7.11.3" resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.11.3.tgz#9e1eae46738bcd08e23e867bab43e7b95299a8f9" integrity sha512-REo8xv7+sDxkKvoxEywIdsNFiZLybwdI7hcT5uEPyQrSMB4YQ973BfC9OOrD/81MaIjh6UxdulIQXkjmiH3PcA== -"@babel/parser@^7.16.7", "@babel/parser@^7.17.3": +"@babel/parser@^7.16.7": version "7.17.7" resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.17.7.tgz#fc19b645a5456c8d6fdb6cecd3c66c0173902800" integrity sha512-bm3AQf45vR4gKggRfvJdYJ0gFLoCbsPxiFLSH6hTVYABptNHY6l9NrhnucVjQ/X+SPtLANT9lc0fFhikj+VBRA== @@ -679,6 +714,11 @@ resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.18.4.tgz#6774231779dd700e0af29f6ad8d479582d7ce5ef" integrity sha512-FDge0dFazETFcxGw/EXzOkN8uJp0PC7Qbm+Pe9T+av2zlBpOgunFHkQPPn+eRuClU73JF+98D531UgayY89tow== +"@babel/parser@^7.22.15", "@babel/parser@^7.23.0": + version "7.23.0" + resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.23.0.tgz#da950e622420bf96ca0d0f2909cdddac3acd8719" + integrity sha512-vvPKKdMemU85V9WE/l5wZEmImpCtLqbnTvqDS2U1fJ96KrxoW7KrXhNsNCblQlg8Ck4b85yxdTyelsMUgFUXiw== + "@babel/plugin-proposal-async-generator-functions@^7.10.4": version "7.10.5" resolved "https://registry.yarnpkg.com/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.10.5.tgz#3491cabf2f7c179ab820606cec27fed15e0e8558" @@ -1326,50 +1366,28 @@ "@babel/parser" "^7.16.7" "@babel/types" "^7.16.7" -"@babel/traverse@^7.10.4": - version "7.11.0" - resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.11.0.tgz#9b996ce1b98f53f7c3e4175115605d56ed07dd24" - integrity sha512-ZB2V+LskoWKNpMq6E5UUCrjtDUh5IOTAyIl0dTjIEoXum/iKWkoIEKIRDnUucO6f+2FzNkE0oD4RLKoPIufDtg== - dependencies: - "@babel/code-frame" "^7.10.4" - "@babel/generator" "^7.11.0" - "@babel/helper-function-name" "^7.10.4" - "@babel/helper-split-export-declaration" "^7.11.0" - "@babel/parser" "^7.11.0" - "@babel/types" "^7.11.0" - debug "^4.1.0" - globals "^11.1.0" - lodash "^4.17.19" - -"@babel/traverse@^7.16.7", "@babel/traverse@^7.17.3": - version "7.17.3" - resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.17.3.tgz#0ae0f15b27d9a92ba1f2263358ea7c4e7db47b57" - integrity sha512-5irClVky7TxRWIRtxlh2WPUUOLhcPN06AGgaQSB8AEwuyEBgJVuJ5imdHm5zxk8w0QS5T+tDfnDxAlhWjpb7cw== - dependencies: - "@babel/code-frame" "^7.16.7" - "@babel/generator" "^7.17.3" - "@babel/helper-environment-visitor" "^7.16.7" - "@babel/helper-function-name" "^7.16.7" - "@babel/helper-hoist-variables" "^7.16.7" - "@babel/helper-split-export-declaration" "^7.16.7" - "@babel/parser" "^7.17.3" - "@babel/types" "^7.17.0" - debug "^4.1.0" - globals "^11.1.0" - -"@babel/traverse@^7.18.0", "@babel/traverse@^7.18.2": - version "7.18.2" - resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.18.2.tgz#b77a52604b5cc836a9e1e08dca01cba67a12d2e8" - integrity sha512-9eNwoeovJ6KH9zcCNnENY7DMFwTU9JdGCFtqNLfUAqtUHRCOsTOqWoffosP8vKmNYeSBUv3yVJXjfd8ucwOjUA== - dependencies: - "@babel/code-frame" "^7.16.7" - "@babel/generator" "^7.18.2" - "@babel/helper-environment-visitor" "^7.18.2" - "@babel/helper-function-name" "^7.17.9" - "@babel/helper-hoist-variables" "^7.16.7" - "@babel/helper-split-export-declaration" "^7.16.7" - "@babel/parser" "^7.18.0" - "@babel/types" "^7.18.2" +"@babel/template@^7.22.15": + version "7.22.15" + resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.22.15.tgz#09576efc3830f0430f4548ef971dde1350ef2f38" + integrity sha512-QPErUVm4uyJa60rkI73qneDacvdvzxshT3kksGqlGWYdOTIUOwJ7RDUL8sGqslY1uXWSL6xMFKEXDS3ox2uF0w== + dependencies: + "@babel/code-frame" "^7.22.13" + "@babel/parser" "^7.22.15" + "@babel/types" "^7.22.15" + +"@babel/traverse@^7.10.4", "@babel/traverse@^7.16.7", "@babel/traverse@^7.17.3", "@babel/traverse@^7.18.0", "@babel/traverse@^7.18.2": + version "7.23.2" + resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.23.2.tgz#329c7a06735e144a506bdb2cad0268b7f46f4ad8" + integrity sha512-azpe59SQ48qG6nu2CzcMLbxUudtN+dOM9kDbUqGq3HXUJRlo7i8fvPoxQUzYgLZ4cMVmuZgm8vvBpNeRhd6XSw== + dependencies: + "@babel/code-frame" "^7.22.13" + "@babel/generator" "^7.23.0" + "@babel/helper-environment-visitor" "^7.22.20" + "@babel/helper-function-name" "^7.23.0" + "@babel/helper-hoist-variables" "^7.22.5" + "@babel/helper-split-export-declaration" "^7.22.6" + "@babel/parser" "^7.23.0" + "@babel/types" "^7.23.0" debug "^4.1.0" globals "^11.1.0" @@ -1398,6 +1416,15 @@ "@babel/helper-validator-identifier" "^7.16.7" to-fast-properties "^2.0.0" +"@babel/types@^7.22.15", "@babel/types@^7.22.5", "@babel/types@^7.23.0": + version "7.23.0" + resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.23.0.tgz#8c1f020c9df0e737e4e247c0619f58c68458aaeb" + integrity sha512-0oIyUfKoI3mSqMvsxBdclDwxXKXAUA8v/apZbc+iSyARYou1o8ZGDxbUYyLFoW2arqS2jDGqJuZvv1d/io1axg== + dependencies: + "@babel/helper-string-parser" "^7.22.5" + "@babel/helper-validator-identifier" "^7.22.20" + to-fast-properties "^2.0.0" + "@colors/colors@1.5.0": version "1.5.0" resolved "https://registry.yarnpkg.com/@colors/colors/-/colors-1.5.0.tgz#bb504579c1cae923e6576a4f5da43d25f97bdbd9" @@ -1523,21 +1550,45 @@ "@jridgewell/sourcemap-codec" "^1.4.10" "@jridgewell/trace-mapping" "^0.3.9" +"@jridgewell/gen-mapping@^0.3.2": + version "0.3.3" + resolved "https://registry.yarnpkg.com/@jridgewell/gen-mapping/-/gen-mapping-0.3.3.tgz#7e02e6eb5df901aaedb08514203b096614024098" + integrity sha512-HLhSWOLRi875zjjMG/r+Nv0oCW8umGb0BgEhyX3dDX3egwZtB8PqLnjz3yedt8R5StBrzcg4aBpnh8UA9D1BoQ== + dependencies: + "@jridgewell/set-array" "^1.0.1" + "@jridgewell/sourcemap-codec" "^1.4.10" + "@jridgewell/trace-mapping" "^0.3.9" + "@jridgewell/resolve-uri@^3.0.3": version "3.0.5" resolved "https://registry.yarnpkg.com/@jridgewell/resolve-uri/-/resolve-uri-3.0.5.tgz#68eb521368db76d040a6315cdb24bf2483037b9c" integrity sha512-VPeQ7+wH0itvQxnG+lIzWgkysKIr3L9sslimFW55rHMdGu/qCQ5z5h9zq4gI8uBtqkpHhsF4Z/OwExufUCThew== +"@jridgewell/resolve-uri@^3.1.0": + version "3.1.1" + resolved "https://registry.yarnpkg.com/@jridgewell/resolve-uri/-/resolve-uri-3.1.1.tgz#c08679063f279615a3326583ba3a90d1d82cc721" + integrity sha512-dSYZh7HhCDtCKm4QakX0xFpsRDqjjtZf/kjI/v3T3Nwt5r8/qz/M19F9ySyOqU94SXBmeG9ttTul+YnR4LOxFA== + "@jridgewell/set-array@^1.0.0": version "1.1.1" resolved "https://registry.yarnpkg.com/@jridgewell/set-array/-/set-array-1.1.1.tgz#36a6acc93987adcf0ba50c66908bd0b70de8afea" integrity sha512-Ct5MqZkLGEXTVmQYbGtx9SVqD2fqwvdubdps5D3djjAkgkKwT918VNOz65pEHFaYTeWcukmJmH5SwsA9Tn2ObQ== +"@jridgewell/set-array@^1.0.1": + version "1.1.2" + resolved "https://registry.yarnpkg.com/@jridgewell/set-array/-/set-array-1.1.2.tgz#7c6cf998d6d20b914c0a55a91ae928ff25965e72" + integrity sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw== + "@jridgewell/sourcemap-codec@^1.4.10": version "1.4.11" resolved "https://registry.yarnpkg.com/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.11.tgz#771a1d8d744eeb71b6adb35808e1a6c7b9b8c8ec" integrity sha512-Fg32GrJo61m+VqYSdRSjRXMjQ06j8YIYfcTqndLYVAaHmroZHLJZCydsWBOTDqXS2v+mjxohBWEMfg97GXmYQg== +"@jridgewell/sourcemap-codec@^1.4.14": + version "1.4.15" + resolved "https://registry.yarnpkg.com/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.15.tgz#d7c6e6755c78567a951e04ab52ef0fd26de59f32" + integrity sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg== + "@jridgewell/trace-mapping@^0.3.0": version "0.3.4" resolved "https://registry.yarnpkg.com/@jridgewell/trace-mapping/-/trace-mapping-0.3.4.tgz#f6a0832dffd5b8a6aaa633b7d9f8e8e94c83a0c3" @@ -1546,6 +1597,14 @@ "@jridgewell/resolve-uri" "^3.0.3" "@jridgewell/sourcemap-codec" "^1.4.10" +"@jridgewell/trace-mapping@^0.3.17": + version "0.3.19" + resolved "https://registry.yarnpkg.com/@jridgewell/trace-mapping/-/trace-mapping-0.3.19.tgz#f8a3249862f91be48d3127c3cfe992f79b4b8811" + integrity sha512-kf37QtfW+Hwx/buWGMPcR60iF9ziHa6r/CZJIHbmcm4+0qrXiVdxegAH0F6yddEVQ7zdkjcGCgCzUu+BcbhQxw== + dependencies: + "@jridgewell/resolve-uri" "^3.1.0" + "@jridgewell/sourcemap-codec" "^1.4.14" + "@jridgewell/trace-mapping@^0.3.9": version "0.3.13" resolved "https://registry.yarnpkg.com/@jridgewell/trace-mapping/-/trace-mapping-0.3.13.tgz#dcfe3e95f224c8fe97a87a5235defec999aa92ea" @@ -3804,9 +3863,9 @@ crypto-browserify@^3.11.0: randomfill "^1.0.3" crypto-js@^4.0.0: - version "4.1.1" - resolved "https://registry.yarnpkg.com/crypto-js/-/crypto-js-4.1.1.tgz#9e485bcf03521041bd85844786b83fb7619736cf" - integrity sha512-o2JlM7ydqd3Qk9CA0L4NL6mTzU2sdx96a+oOfPu8Mkl/PK51vSyoi8/rQ8NknZtk44vq15lmhAj9CIAGwgeWKw== + version "4.2.0" + resolved "https://registry.yarnpkg.com/crypto-js/-/crypto-js-4.2.0.tgz#4d931639ecdfd12ff80e8186dba6af2c2e856631" + integrity sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q== crypto-random-string@^1.0.0: version "1.0.0" @@ -11077,16 +11136,16 @@ semver-truncate@^1.1.2: semver "^5.3.0" "semver@2 || 3 || 4 || 5", semver@^5.3.0, semver@^5.5.0, semver@^5.5.1, semver@^5.6.0, semver@^5.7.1: - version "5.7.1" - resolved "https://registry.yarnpkg.com/semver/-/semver-5.7.1.tgz#a954f931aeba508d307bbf069eff0c01c96116f7" - integrity sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ== + version "5.7.2" + resolved "https://registry.yarnpkg.com/semver/-/semver-5.7.2.tgz#48d55db737c3287cd4835e17fa13feace1c41ef8" + integrity sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g== semver@7.0.0: version "7.0.0" resolved "https://registry.yarnpkg.com/semver/-/semver-7.0.0.tgz#5f3ca35761e47e05b206c6daff2cf814f0316b8e" integrity sha512-+GB6zVA9LWh6zovYQLALHwv5rb2PHGlJi3lfiqIHxR0uuwCgefcOJc59v9fv1w8GbStwxuuqqAjI9NMAOOgq1A== -semver@7.3.5, semver@^7.3.4, semver@^7.3.5: +semver@7.3.5: version "7.3.5" resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.5.tgz#0b621c879348d8998e4b0e4be94b3f12e6018ef7" integrity sha512-PoeGJYh8HK4BTO/a9Tf6ZG3veo/A7ZVsYrSA6J8ny9nb3B1VrpkuN+z9OE5wfE5p6H4LchYZsegiQgbJD94ZFQ== @@ -11094,14 +11153,16 @@ semver@7.3.5, semver@^7.3.4, semver@^7.3.5: lru-cache "^6.0.0" semver@^6.0.0, semver@^6.3.0: - version "6.3.0" - resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.0.tgz#ee0a64c8af5e8ceea67687b133761e1becbd1d3d" - integrity sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw== + version "6.3.1" + resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.1.tgz#556d2ef8689146e46dcea4bfdd095f3434dffcb4" + integrity sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA== -semver@^7.2.1, semver@^7.3.2: - version "7.3.2" - resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.2.tgz#604962b052b81ed0786aae84389ffba70ffd3938" - integrity sha512-OrOb32TeeambH6UrhtShmF7CRDqhL6/5XpPNp2DuRH6+9QLw/orhp72j87v8Qa1ScDkvrrBNpZcDejAirJmfXQ== +semver@^7.2.1, semver@^7.3.2, semver@^7.3.4, semver@^7.3.5: + version "7.5.4" + resolved "https://registry.yarnpkg.com/semver/-/semver-7.5.4.tgz#483986ec4ed38e1c6c48c34894a9182dbff68a6e" + integrity sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA== + dependencies: + lru-cache "^6.0.0" serialize-javascript@^4.0.0: version "4.0.0" @@ -12951,9 +13012,9 @@ wide-align@^1.1.2: string-width "^1.0.2 || 2 || 3 || 4" word-wrap@^1.2.3, word-wrap@~1.2.3: - version "1.2.3" - resolved "https://registry.yarnpkg.com/word-wrap/-/word-wrap-1.2.3.tgz#610636f6b1f703891bd34771ccb17fb93b47079c" - integrity sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ== + version "1.2.4" + resolved "https://registry.yarnpkg.com/word-wrap/-/word-wrap-1.2.4.tgz#cb4b50ec9aca570abd1f52f33cd45b6c61739a9f" + integrity sha512-2V81OA4ugVo5pRo46hAoD2ivUJx8jXmWXfUkY4KFNw0hEptvN0QfH3K4nHiwzGeKl5rFKedV48QVoqYavy4YpA== worker-farm@^1.7.0: version "1.7.0"