The French data protection authority CNIL fined the French health website http://doctissimo.fr €280k for GDPR infringements plus €100k for ePrivacy infringements:
https://www.cnil.fr/en/health-data-and-use-cookies-doctissimo-fined-eu380000

This is good, but. A few comments.

It's good they took action against a web publisher, which European regulators rarely do.

And the fine may represent a considerable amount of the site's revenue (according to internet sources). It's still not much for Reworld Media though, which appears to own the site.

I understand that regulators have to focus on certain issues. However, closing the procedure with the argument that "the company had taken measures to comply with all the infringements" is not ideal.

This makes it look like everything is fine now, which may not be the case.

There are several unresolved GDPR issues regarding digital tracking.

While doctissimo at least implements the very minimum (top level 'refuse' button), it still uses the TCF and wants users to 'consent' to personal data sharing with ~700 third parties, many of them data brokers.

The GDPR Article 26 infringement identified by CNIL is interesting, but the decision doesn't really address the fundamental issues with extensive personal data sharing across thousands of companies in today's surveillance marketing ecosystem, from ID matching to profiling to RTB.

These issues will remain unaddressed until a DPA starts to question if there can be 'informed' consent to opaque personal data sharing and profiling across so many opaque firms at all.

The Belgian DPA suggested that TCF consent may not be valid. Take a risk and try to prove it!

I just checked the doctissimo website.

During my initial visit, after pseudo-consenting, the site connected to dozens of third parties, from big tech (e.g. G, FB, Amzn, MS/Xandr, TikTok) to other adtech firms and data brokers (e.g. LiveRamp, Tapad, MediaMath, PubMatic, Taboola).

A lot of them received IDs from my browser and stored them, which is not just about 'cookies' but about large-scale *personal data processing*.

Several of them did not only process pseudonymous IDs, but also received the referer, which potentially enables large-scale profiling.

As everyone in the industry knows, this is completely out of control. It's impossible to know which parties receive personal data via rtb. I think it's also impossible to know how hundreds of TCF parties generally process personal data for ID matching, singling out and profiling.

I don't think you can 'consent' to personal data flowing into this interlinked cesspool of tracking+profiling across the digital world.

Btw. I also cannot believe that doctissimo has now clean joint-control contracts with everyone it shares data with and across the supply chain.

In my view, European DPAs often tend to go the easy route by focusing on e.g. special category data, data security, retention, superficial information and 'consent' requirements. And yeah, I'm afraid the strong focus on data transfers, while relevant, has also blocked resources.

To address the unresolved issues in today's interlinked real-time data industry, DPAs must move towards its core.

Take distributed processing, which looks ephemeral and almost meaningless on its own but results in massive processing at scale, seriously.

See e.g. this thread (Twitter):
https://twitter.com/WolfieChristl/status/1488168017729138689

Look into the supply chain, the adtech firms and third-party intermediaries. What about e.g. the third parties doctissimo shared data with (or whose data processing it helped to facilitate), are there any consequences for them?

Ask whether it's possible to consent to it at all.