Brave, a privacy-focused web browser set up by Silicon Valley engineering guru Brendan Eich, filed privacy complaints in Britain and Ireland that could become a test case against search company Google and other digital advertising firms.
The petitioners say they want to trigger an article in the new European General Data Protection Regulation (GDPR) requiring an EU-wide investigation, making it a test case for a new European Data Protection Board created to give the privacy regime more teeth.
The GDPR seeks to ensure that individuals have greater control over the data that companies hold about them. Brave and the co-plaintiffs say Google and others are playing fast and loose with people’s data.
“There is a massive and systematic data breach at the heart of the behavioral advertising industry. Despite the two-year lead-in period before the GDPR, adtech companies have failed to comply,” Brave’s chief policy officer Johnny Ryan told Reuters.
The complaint argues that when a person visits a website, intimate personal data that describe them and what they are doing online is broadcast to tens or hundreds of companies without their knowledge in order to auction and place ads.
This, it says in the complaints filed on Wednesday, violates the GDPR’s requirement for personal data to be processed in a way that ensures they are properly secured, including against unauthorized or unlawful processing and against accidental loss.
Google says it is has already implemented strong privacy protections in consultation with European regulators and is committed to complying with the GDPR.
Brave operates as a private browser and ad blocker, preventing the use of trackers on web pages to harvest data about people’s online behavior – giving it detailed insight into the inner workings of the online ad industry.
The new data privacy law could also have a huge impact on the small army of tech firms that comes between giants like Google and its users to harvest and crunch data from websites to form very specific consumer profiles.