gdpr european-union data-protection
Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?
<p><strong>Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)?</strong></p>
<ul>
<li>I am following the current issue about Anker and its eufy camera products and the storage of thumbnails (photos) on AWS servers. It has become clear that despite the official documentation stating that data is only stored locally, data has been stored on AWS servers.</li>
<li><a href="https://gizmodo.com/eufy-security-cameras-unencrypted-footage-cloud-scandal-1849833489" rel="noreferrer">News report highlighting the issue</a>.
Can the complaint be filed and a lawsuit be created, because of this, since a) the potential misuse of eufy camera feeds, and b), because eufy has lied to its customer, <a href="https://www.theverge.com/2022/11/30/23486753/anker-eufy-security-camera-cloud-private-encryption-authentication-storage" rel="noreferrer">article by The Verge</a>.
Has there been other similar cases of European Citizen &quot;local data&quot; found to be stored on cloud servers, and data been able to be accessed, despite the contrary having been claimed by a product maker (company)?</li>
</ul>
<p>To elaborate, so-called &quot;local data&quot; has been caught as stored in AWS cloud servers, <a href="https://www.cnet.com/home/security/eufy-cameras-caught-sending-local-only-data-to-cloud-servers/" rel="noreferrer">article in CNET</a>.</p>
<p>Thank you for initial information and pointing me in the right direction.</p>

<p>The key issue here is the unauthorized collection of video thumbnails, not the use of cloud services.</p>
<p>Under GDPR, every personal data processing activity has one or more controllers who are responsible for the activity, and every such activity needs a “legal basis”. With such cameras, the operator will typically be a controller, since they determine the purposes for which this camera is used. In this scenario, the operators – as part of their responsibility to conduct the data processing activity in a GDPR-compliant manner – had disabled any cloud features provided by the camera manufacturer.</p>
<p>Despite this configuration, the camera manufacturer collected thumbnails and uploaded them to servers under their control.</p>
<p>So, we likely have two distinct issues at hand:</p>
<ul>
<li>the camera manufacturer misled its customers about the privacy settings of the cameras. This is not necessarily a GDPR issue by itself.</li>
<li>the manufacturer performed data processing activities in contravention of various aspects of the GDPR.</li>
</ul>
<p>Relevant aspects of the GDPR that might have been violated:</p>
<ul>
<li>the manufacturer did not have an Art 6 GDPR legal basis for this processing activity, such as a “legitimate interest”</li>
<li>the manufacturer did not provide information per Art 13 GDPR to the people being monitored this way</li>
<li>even if the cloud-based thumbnail processing were intended, this could be a violation against the Art 25 obligation to ensure “data protection by design and by default”</li>
<li>depending on how  the cloud storage services were configured, there might be violations against the Art 28 responsibility to contractually bind such vendors as data processors, or against the Chapter V rules on international data transfers</li>
</ul>
<p>Different actors might have different remedies against this violations:</p>
<ul>
<li>buyers of the camera might have remedies under consumer protection and product liability laws against the manufacturer</li>
<li>data subjects of the illegal processing activity have remedies under the GDPR
<ul>
<li>they can exercise their data subject rights against the data controllers, such as erasure of the thumbnails. However, this will be difficult to exercise in practice since the manufacturer will not have identifying information, and would then be free from having to fulfil certain data subject requests per Art 11 GDPR.</li>
<li>they can lodge a complaint with a responsible supervisory authority, which would be the data protection agency in their EU/EEA member state (or the ICO in the UK). The EDPS is irrelevant here, since it is only the internal supervision authority for EU institutions. The competent supervisory authorities can levy fines.</li>
<li>they can sue the data controllers, both for compliance (e.g. deleting unauthorized thumbnails) and for damages, if any were suffered. However, immaterial damages awarded for GDPR violations are typically fairly low, if they are recognized by the court at all.</li>
<li>the right to judicial remedy (sue the controllers in court) and to lodge a complaint are independent. They largely pursue different remedies. Both can be used to seek compliance, but only supervisory authorities can impose fines, and only direct lawsuits by the data subjects can seek damages.</li>
</ul>
</li>
</ul>
