NHacker Next
- new
- past
- show
- ask
- show
- jobs
- submit
login
▲I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M (self.__VINEXT_RSC_CHUNKS__=self.__VINEXT_RSC_CHUNKS__||[];self.__VINEXT_RSC_CHUNKS__.push("2:I[\"aadde9aaef29\",[],\"default\",1]\n3:I[\"6e873226e03b\",[],\"Children\",1]\n5:I[\"bc2946a341c8\",[],\"LayoutSegmentProvider\",1]\n6:I[\"6e873226e03b\",[],\"Slot\",1]\n7:I[\"3506b3d116f7\",[],\"ErrorBoundary\",1]\n8:I[\"a9bbde40cf2d\",[],\"default\",1]\n9:I[\"3506b3d116f7\",[],\"NotFoundBoundary\",1]\na:\"$Sreact.suspense\"\n:HL[\"/assets/index-BLEkI_5r.css\",\"style\"]\n")l="noopener noreferrer nofollow" target="_blank">thatprivacyguy.com)
Rendered at 10:44:52 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
Unfortunately, especially in the US, exercising your rights, or even just reading every paper you're expected to put your name to, not only constantly pisses people off for some reason, but also puts you at a significant disadvantage compared to the people that never push back in the interest of not making waves, or even because "whatever it's fine."
As one example, I went to a doctor, he ordered an x-ray. I went over to the x-ray company then back to my doctor. He pulled up the x-ray immediately. He's only able to do that because I signed that he can share my info with the x-ray company and visa-versa.
Again, I don't have a solution. No regulation = he'd probably share my data. But regulation = he gets me to sign so he can legit provide the service, and still shared my data (Because I signed). So all the regs did is make visiting the doctor more annoying, and add $$$$ to push all the paperwork around.
There are sometimes things you might not like hidden in the releases you're signing, beyond the run of the mill acceptance of financial responsibility / assignment of benefits, notice of privacy policy acknowledgment, consent to treat.
I am not familiar with the nitty gritty of US law, but under German law that signature would be worthless. Even signing a document you have but are unwilling to read is legally a bit iffy (which is why for things like real estate a notary will read the paperwork to you and ask if you understood it, or why surprising clauses in terms of service are unenforceable). Signing something without being able to know what you are signing would be worth exactly nothing, because you didn't actually knowingly consent to any particular thing, and neither did you have the "meeting of minds" required to form a contract.
What is so hard in respecting the spirit of the law?
Obviously this doesn’t work in all situations and for all people, but it’s a start.
The flip side of this however is that it’s a very worthwhile pursuit to know consumer protections and what your rights are in the jurisdiction in which you live - and how to enforce them.
Where I live, I unfortunately quite frequently find myself having to go “ok so you want to do the formal process with the regulator then?”, which usually gets them to reconsider - but not always. Three times in the last month I have threatened regulatory action - and of those three, only one chose that path. I have just reported a government agency here to the domestic and EU regulators for failing to fulfil EU FoM treaty rights - and they were even kind enough to put it in writing that they’re ignoring their own domestic laws.
I have yet to lose a case I have brought before a regulator or justice of the peace, and businesses usually only need to do this once, if at all, as it can quite quickly turn a €1,000 dispute into tens or hundreds of thousands of euro of damages and fines. By doing this, following these processes through, I help not just myself but society as a whole.
So - sign away, but have teeth, and know where to bite.
Earlier this week a potential landlord offered me a lease saying I had already inspected the property and found no issues with it.
I asked for a chance to actually inspect before signing, and even said I would settle for a good quality video walkthrough. They told me the unit was "not available for viewing" because it wasn't finished yet, and by the time it was finished it would likely be taken.
So why did you ask me to sign a contract saying I inspected a property that it's conceptually impossible to inspect??
I asked if they could change that part of the lease. They said they were "unable" due to "demand and interest in the property."
Of course, still not as insane as your story.
Was it a paper lease? Because you could always cross out that section before signing, not to mention write in your own addendum. They would probably still balk, but you'd be within your rights to do so.
I would want to read and perhaps get legal advice before relying on that interpretation - and before finding I signed over rights to my landlord to make candid porn of me and all his other tenants.
If the law says you cannot do XYZ, your landlord can state otherwise in whatever verbiage but that's all void.
This is why good consumer protection laws exist, in a well functioning society there things you sign are to protect the landlord from bad renters (don't pay, cause a nuisance etc). The law in general should protect you as the tenant from a bad landlord.
Yeah, if you accidentally recorded families walking through their homes unclothed, this could land a landlord in jail.
Fascism was a scheme to keep the old aristocrats turning industrialists to keep control of the state, whilst still keeping it under the democratic name. This was devised in the US in the 30ies and then in the old states also. Heavily supported by the US industrialists. Without them the fascism movement had no chance.
The US scheme of fascism came up with cooperate contracts overriding state laws, also pleasing the Chicago crowd, with decentralized control. At the will of the cooperations, who know better than the government of course. That's why Rockefeller could gun down strikers without any repercussions. That's why the Railroad Commission could call state military to gun down independent oil cooperations which undercut prizes of the industrialists. That's not liberalism, that's pure fascism/cooperatism/aristocratism.
By the way, I'm not claiming the things you describe didn't take place for the reasons you claimed. I just don't think it's accurate to describe it as based on fascism.
Nothing wrong with cooperatism I think.
Fascism first evolved in Italy, where Mussolini and his Partito Nazionale Fascista took power in 1922.
Even then, I do not consent to work as an unpaid actor even in public spaces. I'm ok to be it at conferences, organized coworking parties -- no problem. But my living space when I don't suspect it -- hell no.
Maybe that's at the gym or by the pool, and maybe you're actually not comfortable becoming a swimsuit model.
Oh man if I had a pound for every time I've had a corporate dogsbody try to invent meanings of legal wording that doesn't actually exist and gaslight me...
They are usually so passionate about it too. A simple "ah ok cool so you can add that word to the document" really annoys them.
The other classic is just "it's just standard wording". Well yeah McDonald's is also "standard" food for many people but I massively disagree with that too
This is the crux of the problem when landlords are allowed to form or join an "association" that gets too pervasive.
This was at the heart of the RealPage lawsuits.
Be reasonable.
The terms and conditions for Tetris on Android were longer than the entire works of Tolkien when combined.
So yes, it would be nice to read all of these things, but we simply do not have the time available to do so.
Always maintain your integrity, a big part of that is honoring your word. Integrity is the only thing you're born with in this life, and if you're lucky you take it with you on the way out. Any person worth getting into contracts with will appreciate the value in that.
Yup. It's particularly sad seeing other people in this very thread talking about how they would "ban this customer for life" just for knowing their rights.
I think it's pathetic that this has become the culture amongst large swathes of Americans - especially ones who consider themselves patriotic. This country was founded in rebellion and the assertion of our rights, and somehow the exact opposite is now the ideal of many citizens now.
DHS is putting on the domestic terrorists watch list those people who took parts in the protests. Or at minimum threatens to put. And if you google a bit more you'd see that it isn't limited to ICE. Any dissent is perceived by the current government in a similar "terrorism" way. For majority of population that would completely chill any desire to assert rights.
https://www.markey.senate.gov/imo/media/doc/letter_to_dhs_on...
"U.S. Immigrations and Customs Enforcement (ICE) officers and senior Trump administration officials have repeatedly suggested that the Department of Homeland Security (DHS) is building a “domestic terrorists” database comprising information on U.S. citizens protesting ICE’s actions in recent weeks.
...
In recent weeks, DHS personnel and senior officials have repeatedly stated that the agency is engaged in efforts to monitor, catalog, and intimidate individuals engaged in peaceful protests"
[1] - https://en.wikipedia.org/wiki/Occupy_Wall_Street#Government_...
[2] - https://en.wikipedia.org/wiki/COINTELPRO
It’s reprehensible and I am demanding accountability from my elected politicians. The only way we’ll see someone answer for these crimes, though, is if enough Americans give a shit to get off their fucking asses and actually put people into office who will bring change.
Machine translation of overview & 5.1 which is what the blog post is about (covers some other things as well): https://chatgpt.com/share/6a34732c-0fa4-83e8-aae1-95c25dd117...
[EDIT] Oh, there was actually official English decision available as well: https://www.datatilsynet.no/contentassets/59addbef9c1b48a28f...
I don’t understand… it would be one thing if it said “receiving marketing/offers is a condition of being a member of the customer club” but that’s not what is being stated above… rather that being a member of the club is required to receive marketing — perhaps something has been misworded or lost in translation?
The company was also processing, transferring and selling private data without doing as much as informing their customers.
It's perfectly possible to offer discounts to customers without egregious violations of law and privacy.
e.g. "to receive offers...is a condition to be in..."
To me, Elkjop seems perfectly reasonable here. But EU policy disagrees.
The company was selling the data without checking if buyers would offer similar levels of protection (LOL, in that case). It was found the members weren't properly informed SO the consent was not freely given, they basically extorted and lied to their customers. I'm very happy they were fined.
I'm very happy you're not in charge of privacy laws, but seriously, I don't see how would a consumer ever want more surveillance? Unless you're not a consumer.
This is not new, we have a lot of case law and regulatory guidance on this.
* Published benefits: https://web.archive.org/web/20220613175535/https:/www.elkjop... (e.g. "Rabatt på en rekke av våre tjenester utført i varehus", i.e. something like "Discount on a number of our services performed in warehouses")
* Conditions to join, i.e. to receive the benefits (DPA's translation):
* You may be contacted electronically (e.g via SMS and e-mail), via phone and mail with personal offers and other relevant information
* Collect and analyse information about you and your customer relationship.
* Create a customer profile, in order to provide more relevant information and a better service.
* You have to be minimum 15 years old and you can choose to leave the customer club at any time.
So to get the discount you would need to consent to being contacted for "personal offers and other relevant information".
Which is why my next step is litigation.
Those anti-privacy policies will state, that you grant the company and third-parties (so, anyone) permissions to use your data (including voice and image) for any purpose. (Of course, it is stated in a slightly obscure fashion, so a layman may not comprehend it.)
I wonder if there has been any similar action taken against those.
That exact language is unlikely to be compliant. If you want to maximize your effect you could make Article 15 request to the company in question, get the list of actual recipients of data (make sure to be ask for this specifically) and then make another request to all of those companies. That will then allow you to possibly make further complaints (e.g. why exactly they didn't send Article 14 information to you, are the legal basis they use actually proper in your case especially if the original one was consent and it was not freely given).
[0] https://noyb.eu/en/project/dpa/dpc-ireland - 80% of complaints pending a reply for more than 1.5 years
What if you didn't and did not proceed with the process? Can you complain still?
As in - if you didn't give your consent there's no violation has occurred and they don't have your data, so nothing to ask for?
In general, I'm not sure a company processing my data on the basis of consent would stop all processing of my data just because I withdraw my consent. Some processing of some of my data might have a different legal basis. Judging by some websites' privacy options, there's a distinction between consent (opt-in), legitimate interest (opt-out) and other legal bases (maybe neither). I'm confused about website forms that have separate reject and object options for each category of data processing and a reject-all button that closes the form. Does clicking "reject all" mean I have or haven't objected?
Everyone is free to make a tip to DPA. However DPA is free to decide if they want to start their own investigation based on that unlike when you make Article 77 complaint.
There isn't a lot of case law around the threshold of Article 77. The text says "if the data subject considers that the processing of personal data relating to him or her infringes this Regulation". If read completely alone one could make argument that since you didn't consent no processing occurred -> you do not have right to make an Article 77 complaint.
However when taking the in account the goals and purpose of GDPR as well as recital 141 I would argue otherwise. To be specific recital 141 says "if the data subject considers that his or her rights under this Regulation". CJEU also often refers to GDPR's objective of ensuring high level of protection of fundamental rights and freedoms of natural persons. I feel that ex post requirement would be quite contrary to that.
Due to this my personal stance would be that just offering invalid consent choice where refusal has negative consequences is something that violates data subject's rights even if processing didn't occur and would be eligible for actual Article 77 complaint rather than just tip to DPA.
[EDIT] Also, there is Article 82 path via damages. In your case you could potentially argue that you suffered damages (like lost wages) due to company's invalid consent requirement. This, however, is generally a lot harder and more expensive path. Depending on how legal costs are allocated in your jurisdiction you could also end up with judgement where you need to pay your opponent's legal costs if you lose.
For Article 82 claim you almost definitely will need a lawyer.
So no, I have not sued the Norwegian DPA and actually have a very good relationship with them along with most of the other EU DPAs (I am an advisor to them, I sit in the pool of experts for law and new technologies at the EDPB which includes ALL EU data protection authorities).
I guess the web server was temporarily overwhelmed by traffic resulting in images (like for you) and css files (like for me) not being consistently served to all visitors.
The blog is running on a Mac Mini on a 1Gb/s uplink so when it gets hit with a front page HN post, it does creak a little but I try to be environmentally responsible with my technology (as much as possible) so I am not in a hurry to move it into a datacentre when currently it only pulls 15-25W from the wall during peak traffic.
There's nothing problematic about having Stihl advertise chainsaws on a page for lumberjack. There is a problem when you collect data from across the internet, conclude that a person might be a lumberjack and serve the chainsaw ads based on that information on a news site.
Sadly the advertising industry is mostly dead, at least online. We're left with online marketing experts that are basically just clicking around in Google and Meta ad-management interfaces. They know nothing about the sites or content, nor do they care. The magical box will find the customers... and if it gets it wrong, no worries, it wasn't their money anyway and you can always just go "Well, advertising isn't an exact science, some of your spending was always going to be wasted, you just don't know which part".
Now we're left with an online advertising industry that can't tell advertising and tracking apart, and it doesn't have the skills or the network to go directly to sites and buy ad-space.
There is one case where DPA ruled in favor of the company, but it's currently being appealed: https://noyb.eu/en/pay-or-ok-der-spiegel-noyb-sues-hamburg-d...
Another one ruled against company and court agreed: https://noyb.eu/en/court-decides-pay-or-okay-derstandardat-i...
Thank you for sharing!
I have found this to be true not just when it comes to companies breaking laws, but also to much more benign things. Such as reporting potholes in town or broken microwaves at work. Those can be in need of fixing for an extended period of time, yet when I report them, they usually get fixed within days. I suspect most people can't be bothered or think that surely someone else will report the issue. But that doesn't work if everyone thinks that way.
So the fine is the first step to a much wider legal action.
The fine also puts other loyalty clubs on notice that if they do this, they are going to face consequences - so it has a much wider impact than simply monetary.
Just for fun I signed up. During the signup they say that by becoming a member you accept that they will send things via email etc, but its optional to accept this, you can still click the signup button but then you don't get membership status, you just get an account. Then on the kundklubb page it says that you are not a member, if you click join it will automatically enable email, sms and phone communication, but you can disable them.
Its why you find the Australian regulator for consumer affairs handing out $200m+ fines to telecommunications companies, for example.
Not that it is likely that they make that much in profit, but still. There probably shouldn’t be a limit, and there probably should be personal legal consequences such as jail time for repeat offenders.
Anyway this is all purely academic. 99% of violations aren't going to increase profit by more than the maximum fine (or even anywhere remotely near that) thus it seems to me that the law has sufficiently broad coverage for addressing a behavior that does not directly result in physical injury.
Instead, it’s much better to scale fines based on the scale of the entity involved, which also results in huge fines, but it’s easier to measure revenue. Thus the fines are more broadly effective, and you can still escalate if they don’t stop.
If they made a profit and I want them to pay more than the base fine doesn't mean if they made a loss I want them to pay less than the base fine.
I think the rest of your come t stands though. There is difficulty I proving profit and Hollywood accounting can probably change those numbers.
I’m not saying they would get a rebate just that for this to be meaningful for a mid sized or larger company requires a large portion of a given fine to be based on profits. So a company receiving a fine based on their profits would argue they made less money from the behavior, it’s a legal argument without any risk.
Consider a fine for a mid sized company that’s base 100k + 10m based on profits it ‘goes away’ if they win but it also ‘goes away’ if they drop it by 99%. Thus just as much effort would be spent on how much money they made as is put forth to defend the fine in the first place.
Now obviously you could set the base large enough to offset that, but doing so defeats the point of profit based fines in the first place. Which means inherent to the idea of profit based fines is the concept they largely go away if a major company can argue their profits where non existent.
Targeting management seems like a tactic that should only be employed where great urgency exists such as life threatening danger. I don't think marketing material is anywhere close to qualifying.
I hate my inbox being inundated with spam as much as the next guy but that doesn't mean drawing and quartering the perpetrators is justified.
No? You don’t need to adjust the floor, only the ceiling.
The goal is to prevent businesses from pricing fines into their margins.
He has largely been ostracised by the privacy and data protection community (even at regulatory events) I have seen him wandering around alone and aimlessly at a number of regulatory events, he didn't seem very comfortable and didn't really have a lot of interaction with his peers.
But usually even the extensive evidence is indeed met with "eh, mate, can't you just ask them again?"
This, at least to my understanding, runs contrary to the spirit of the GDPR regulations. Permission has to be freely given which, when the alternative is paying a subscription, it quite obviously isn't.
It's a shame, but it probably says more about Datatilsynet's capacity. Frankly it would be great if you could simply say "this company did something dodgy", provide proof, and immediately get results. But that's not the world we live in.
If you unclicked it, the 'connect to wifi' button greyed out and a notification appears saying that Opt In is required for wifi.
One day, end of April when the grass is growing very rapidly, they presented me with a dialog in the app that basically said.
"We updated the EULA with the explanation "optimized wordings". Please accept."
There was no reference to the new or old EULA, and if I didn't accept I could not start the app and use my new mower. It was bricked.
I am now checking their compliance with GDPR. It is a tedious process because they keep stalling, but I still feel I have all the rights.
And I get a lot of help from chatgpt who works as a patient secretary that translates my "f-fck sake give me my stuff" into formal/friendly legalese with counter questions designed to be difficult to duck.
As of now, 2 months later, they have finally pointed me to "download personal data" in the application which gives me back a PDF with mower model, my email address and some push notification history.
But I know they store much more than that. And I think they know that I know. If nothing else my customer support history. But also for example a map of my garden.
But EU countries have authorities for this that helps filing issues they find legitimate. e.g. https://www.imy.se/en/news/administrative-fee-against-spotif...
But also the Norwegian twin mentioned in TFA.
As of now I am mostly collecting data to probe their compliance.
[0] "Under Article 77(2) of the GDPR a supervisory authority is under a binding legal obligation to keep a complainant informed of the progress and the outcome of their complaint. It is not a courtesy and it is not discretionary - it is written into the law. I filed my complaint with IMY, IMY passed it on, the case ended in a multi-million euro enforcement action, and not one of the authorities involved thought to tell the person who started it."
The former is the one he seems to be currently taking to task for failing to follow the law, the latter is the one that meaningfully handled the case.
https://noyb.eu/en/gdpr-rights-sweden "GDPR Rights in Sweden: Court confirms that authority must investigate complaints. So far, the Swedish IMY has taken the view that users don’t have party rights in GDPR procedures."
https://noyb.eu/en/noyb-takes-swedish-dpa-court-refusing-pro... "IMY frequently just forwards a complaint to the company that illegally processes personal data - and then immediately closes the case without investigating." (no decision on this as far as I know. A bit surprising since it has been almost 2 years)
I personally never specifically consent to anything, yet get a ton of marketing emails. To most companies that send me those emails 1.8m would be a slap on the wrist.
has any calculations been made on how much actual profit was made by these unlawful actions?
https://www.datatilsynet.no/contentassets/59addbef9c1b48a28f...
okay then...
I have experienced this same thing with at least one other big company in Norway.
I could opt out of either SMS or e-mail, but not both, or I would not be able to keep the membership.
Unfortunately, I never made a note of which one that was exactly so I can’t name them and shame them on the spot.
Despite half-hearted attempts at stopping marketing emails now and then by individually logging in and opting out, or clicking unsubscribe links embedded in the email, my email continues to be flooded with marketing both from domestic and foreign companies that I’ve done business with. There is so many companies that even going through a handful of them at a time and unsubscribing there is a seemingly endless amount of companies that remain to unsubscribe from.
It is great to see that someone fights back, and that it is resulting in fines.
Going through the hassle of policing individual company behavior is beyond silly and a giant waste of resources when you can literally just force the behavior at client level.
This is also basically the story of why GDPR popups are stupid. Set it at the client (browser) level, not on 100,000,000 individual websites done slightly differently every time and try to setup an enforcement dragnet to have expensive fights over misplaced commas.
This should have always been a browser setting and not a multi-billion dollar Kafka-esque nightmare of lawyers and regulators policing policing every company on earth, wasting Europe's productivity and resources.
It's like how the US makes you file your own taxes when for 99% of people they already know the amount you owe, and then randomly will decide to fine you if your calculated number doesn't line up with their number. It's giant waste of everyones time.
> This decision can nevertheless be challenged before Norwegian courts in accordance with Article 78(1) of the GDPR. [0]
Time will tell I guess?
[0] https://www.datatilsynet.no/contentassets/59addbef9c1b48a28f...
Bro, you alright?
You can always not use their service. Plenty of alternatives out there.
The more annoying is that I gave him my regular email address and not a generated alias that I always give to companies.
Was super pissed when spam started landing on my main address.
So no, not plenty alternatives here.
But I only buy from there if it's the only option. (Other than Amazon, which I refuse to use at all.)
It is mostly just a theater (like endless cookie consent dialogs in anonymous browsing), to employ more experts and bureaucrats.
EU is now pushing privacy laws that severely undermine privacy.
When the cookie-law was first instituted I worked for an e-commerce site and was tasked with ensuring that we'd be compliant. It would have been crazy simple to implement, but no, because management, encouraged by the companies selling the tracking and re-targeting solutions kept insisting that I was reading the rules incorrectly. By incorrectly they meant: We want to be able to track and target customers all the time, regardless of the rules. The result was scraping my solution that truly allowed users to opt in, in favour of a commercial solution that just blocked then entire site until you clicked "Okay" and which wouldn't actually stop tracking if you dismissed it somehow.
Yeah, the rules are getting increasingly complicate and to some extend requires experts. That is because of businesses that have failed so miserably in regulating itself.
To be clear, if you ask for consent in a way that is actually legal, almost nobody will actually consent.
That was literally just malicious compliance in order to get people mad at the law instead of the companies (at least at first, there's also a huge amount of cargo-culting nowadays). Congrats, you've been psy-opped.
https://www.linkedin.com/pulse/truth-behind-cookie-banners-a...
I actually wrote to the EDPB on 25th May 2018 (the day GDPR came into effect) and forced them to make their own website compliant with the ePrivacy Directive (I still have the email thread, it was quite an interesting discussion).
I also filed a complaint against the Court of Justice on October 1st 2019 within minutes of them publishing their Judgment on the Planet49 case (C-673/17) because their own website didn't comply with the judgment - they fixed it within 18 minutes.
So yes EU institutions get it wrong sometimes, but they generally fix it quickly when they are informed. I currently have a big case ongoing with the EDPS against the European Commission and the European Parliament for hosting live streams directly on social media instead of the official live streaming platform setup for EU bodies (on the basis that forcing people to engage on social media is a breach of fundamental rights because it allows those platforms to infer special category data (political interests and others depending on the topic of the live stream).
EDPS just actually updated me this week that they have concluded their side and are now waiting on the final responses from the Commission and Parliament.
So yes, the rules do work, but you have to be pro-active, armchair activism doesn't work.
Even if it’s most just theater, you don’t make the case at all how it undermines privacy.
Also cookies literally have nothing to do with GDPR other than the definition of consent - Cookies are governed under and entirely different law which has existed since 2002 (Directive 2002/58/EC).
It bugs me when I see people criticising the law when they actually havent even bothered to research and understand it or even look at the correct law.
How refreshingly European.
I know, it's like complaining about JS etc. but it's like walking into an elevator and smelling very strong perfume. It's hard not to go "whew!"
The word is “cliches”, and they existed long before LLMs.
> That one sentence is the whole case
This example, for instance, is more uniquely LLM than mere common cliche.
If it's something humans don't do and unique to certain programs, then "cliche" is probably not the correct term.
"I read the article, but it was full of improperly-escaped HTML entity references, how cliche."
Follow the laws and it isn't an issue. I'm pretty sure banning someone for that stuff is probably illegal, too.
For example, in the UK we have a very famous case (The Consulting Association (TCA)) where building contractors joined together to build a list of construction workers they didn't want to hire - this was determined as a criminal breach of UK data protection law.
So have at it, I love a challenge...
I don't think you should be doing business anywhere if customers being familiar with the law and knowing their rights scares you. Frankly if you are running a business, you should be familiar with the laws and regulations, doing otherwise - especially when someone points out that your behaviour is illegal - is negligence and punishment with a fine is completely appropriate. Welcome to living in a society.
https://www.enforcementtracker.com/