Thread by @prevenzione

Today the Italian DPA (Garante) released the GDPR APP "GDPR in your pocket".
The app has 2 trackers for crash management and analytics.
NO CONSENT AND NO OPT-OUT 🤔

The privacy note: smedata.eu/index.php/priv…
NOT IN ITALIAN. 🤔

The app: play.google.com/store/apps/det…

#GDPR @meobaldo

1st #tracker: MS Appcenter Analytics
Real-time #analytics that highlight users’ behavior. It also provides push notifications to mobile devices.

At first sign, a #consent may be asked by a DPA.
and an #OptOut should be granted to users.

None of them in the app!

2nd #tracker: MS Appcenter Crashes
Automatically generates a crash log every crash. The log is written to the device's storage and when the user starts the app again, the crash log will be sent to App Center.

MS will collect a lot of data regarding my mobile, installed app, etc

Both the trackers should be listed and explained in the privacy policy, maybe in italian, just to be intellegible to all.
They are missing.

Both the trackers require CONSENT of the user or, at least, an OPT-OUT function in order do disable the data sharing.
They are missing.

imho, a GDPR App, done by a Data Protection Autority, should be really really well done, and don't fail GDPR compliance. Not this way.

Now, every poorly designed app, will be safe from gdpr enforcement, just because the DPA has failed the same way.

@MCRB_IDside @MCPLLM @gabrielazanfir @IGrobrien @MissIG_Geek @PrivacyMatters @RoccoPanettaIT @dagoneye @gbgallus @sonoclaudio @faffa42 @EmeraldDeLeeuw @Luke_like @raistolo @SofiaSZM @_andrea_lisis @PiracyByDesign @ebobferraris @carlos00110001 @waltervannini @patrizia_meo

The app has been updated today.
No nore crash #Analytics.

IMHO, a good #DPIA, a legitimate interest assessment, a transparent privacy policy and an opt-out trigger could have been a better solution.
Or consent!

Analytic is not evil.
Just do it applying art.5 #GDPR principles.

No more trackers!
An instant fix.