Here is some more commentary bsky.app/profile/rike...

I am not saying the ruling is a good ruling. It has a lot of issues, it doesn't discuss freedom of expression for instance, which makes it easy to misinterpret. It's giving plenty of space for corrections, though, like many of the rulings in this space in the last 10 years.

You can organize it in a way that puts the advertiser in the lead (and make them liable for damages, i would assume). This is not general monitoring in my book.

Back to Russmedia, and GDPR compliance, as a host you can add some stuff to the interfacing with advertisers, asking if they are posting personal data, if it is sensitive data, and then organize compliance (consent, or legitimate ground).

And do a good job, there are plenty ways in which stuff can be improved in terms of ensuring that you are not basically a channel for garbage or scams. I am not going to review the evidence here, but there is plenty.

And in practice, when thinking of how to comply, one can follow the state to the art. Ask GDPR lawyers and figure it out. @gzf.bsky.social

Now what is important is that because we have the EU Charter and ECHR, you do not have to take draconian measures, like scanning all the content for all possible liability issues (See Sabam and fair balance cases).

Specifically in this case, it is clear that some compliance would need to be organized for sites that allow ads, and which do so in ways that are not fully under the control of the advertisers. This is a subset of hosting activity.

The GDPR is a law that tries to ensure that personal data is processed fairly, lawfully, and transparently, and it offers very broad standing on rights for people, but it's not that there is no personal data processing in Europe, it has room for interpretation and is a human rights based instrument.

It is a different thing to be responsible under data protection law than to be liable for content/communication/information like in the situation of copyright infringement or defamation law.

This is not new, Facebook is clearly joint controller for a lot of personal data on their site. They explicitly invite and offer tools to manage the posting of personal data, like group foto's.

Here I disagree with some of the analysis that is going around. The ruling means that some hosting intermediaries, under some circumstances are considered joint controllers under the GDPR for what is posted on their services.

One of the main questions is: does the ruling require general monitoring for hosting intermediaries and online platforms?

The piece is here, and it will be read by many in US circles that are expert in this area but don't have the time themselves to read the full ruling or do not understand the GDPR bsky.app/profile/mmas...