I'd like to see this go to court, actually. I don't think you have a case, because Google is just acting as a service provider and those have been found to not be liable for actions of their users. Like Google is not at fault if some users conspire for a crime over their services. But as I am not a lawyer, I'd really want to see what a court has to say.
this post was submitted on 20 May 2025
5 points (85.7% liked)
degoogle
210 readers
1 users here now
Quit your Google addiction. Use privacy focused Services.
founded 3 months ago
MODERATORS
Google is certainly obligated to comply with the GDPR. But I suspect they are shielded if they can call themselves a /data processor/ and not a /data controller/.
It’s certainly a big hole in the GDPR. The GDPR framers did not consider the fact that in some situations you have countless data controllers all using the same giant processor, in which case it’s only reasonable for data subjects to be able to go direct to the data processor rather than playing whack-a-mole with controllers.
And that's why I'd like to get a court ruling on this. Would be quite interesting.
For a bit more depth on this, the EDPB elaborates on the controller/processor separation and relationship in their 2020/07 guidelines.
It’s a long read, which I just skimmed. It’s mostly grim news. There is even a specific example in that doc stating that an email provider is a processor. But I see an angle:
A data processor has a duty to offer an appropriate level of security to controllers under Art.32. Another finding by the EDPB is that processors who violate the GDPR can be treated as controllers. It could be argued that (unlike protonmail) Google and MS both fail to offer e2ee and simultaneously supplies its insecure email service to controllers who handle sensitive info like lawyers, hospitals, and banks. The violation of art.32 by Google and MS enables them to be treated as controllers.
Maybe here? https://reportcontent.google.com/forms/rtbf
hmm.. painful. That page assumes I speak the language of whatever country my Tor circuit exited. I see at the bottom there is a Google reCAPTCHA barrier.
Nonetheless, I’m glad to know my options but I guess I’ll have to keep trying that page until it speaks my language before I can work out whether it’s a lesser of evils.
In the end, my question is more legal than technical. I could find out Google’s postal address and send them an anonymous letter. But the problem is perhaps that legally Google only needs to honor the GDPR requests of those whom it can identify. In fact, I think it’s expressly written somewhere that anonymous people do not have GDPR protection.
My question may have no answer. Perhaps I have to let Google have my identity as a trade-off to getting GDPR rights.