5 ms·

The GDPR is a huge deal and absolutely no joke. This is part of the compliance for that. https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https

The GDPR is a huge deal and absolutely no joke. This is part of the compliance for that. https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula... It has the potential to completely change the way tech giants are able to provide their services. Each "purpose" that data is collected for must be individually consented, and it's prohibited for purposes to be withheld if others are not consented to. This allows a user to allow the purposes that are a cost on the company, and deny those that are revenue earners. Will be very interesting to see how these heavily data based companies adapt.

an_account 9y ago
I assume that companies can deny services that cost them money if you don’t consent to services that create revenue. Is this true?
- andkenneth 9y ago
  No it's not true. That's exactly why this is so interesting and potentially devastating.
- dannyw 9y ago
  No, the EU doesn’t mess around. I don’t see any provisions in the GDPR allowing companies to do that. I guess companies can charge money for services that cost them money, and give you money if you enable certain services.
  - Terribledactyl 9y ago
    GDPR doesn't need to reenumerate this. Selling service above cost is already allowed.
    - dannyw 9y ago
      I mean as, want to use Messenger? That's $20 a month. Want to let us monetise your messages for ads? We'll pay you $20 a month. Of course, I don't see Facebook actually doing this, but just food for thought.
- PeterisP 9y ago
  It appears not - it requires the consent to be freely given, as in, the customer actually wants you to process the data or the data is inherently necessary for the service e.g. a shipping address to ship goods. "'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;" Article 7.4 "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." Recital 43 "...Consent is presumed not to be freely given if [...] or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." Companies can deny services that cost them money unless you pay; but if you make "consent" as a condition for everyone then it's assumed that it's not freely given consent. You can deny service to everyone, but you can't require consent from everyone. That's not a new thing - that's exactly how the law works already regarding e.g. spam restrictions; you can have opt-in confirmation only if it's optional, if you make it mandatory to "opt-in" (e.g. deny registration unless the opt-in is checked) then it's not consent. Also, even if you have consent, it can be revoked at any time (e.g. 5 minutes after the user received what they wanted), and you have to unconditionally remove the private information from your systems, even if you gave them a discount because they had "consented" at that moment. Also, the customer may give you consent to process their data as such (e.g. include in your service) but object to their use in targeted marketing. Article 21 (Right to object) "... (2) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. (3) Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." - so it should be expected that even if you have consensually obtained the data, then you cannot use it freely, you can use it only for particular purposes; and things like EULAs can't override that.
Buge 9y ago
So I have to consent to be shown ads? So every site has to by default block all their own ads?
- imustbeevil 9y ago
  No, they can show you ads that don't use your data. You'd have to allow them to use your data to give you better ads, but you'd just get worse ads in the meantime.
  - djrogers 9y ago
    Watch how you use those words - if one defines ‘better’ and ‘worse’ in the context of my privacy, then ads that don’t do creepy things are better.
    - BigJono 9y ago
      Is there anything inherently bad about a site using your data to serve you more relevant ads, as long as your data is not passed on to a 3rd party?
      - djrogers 9y ago
        Show me a site that gathers data about me directly, transparently, and without any creepy cross-site tracking, and I’ll consider your question. Unfortunately that’s not how anyone works.
      - e12e 9y ago
        I'd say that highly targeted ads are harmful, as it's more likely to undermine the viewer (eg: political ads tweaked based on current family situation/emergencies derived from data mining). Eg: target people who recently lost loved ones to an attack by one of our times typical "lone gunmen" by ads advertising increased surveillance as a way to mitigate "terrorist" attacks. Or substituting in first names of friends in paid content ("<person with same name as your friend> give the following reasons to vote x!/buy this"). Not to mention that if advertising works - then it undermines the idea of a free marked where purchases are made by informed independent agents (I think that's a fantasy anyway, but it seems to be a somewhat popular idea).
gdwatson 9y ago
I applaud regulations promoting user privacy, even if this seems heavy handed. But does anyone else wonder about the implications of applying that regulation to those who collect data on EU residents whether they operate in the EU or not? Has the US State Department stated a position on the matter?
- asdfgadsfgasfdg 9y ago
  It is a similar concept to export of physical goods into a country/trade block. Either comply with the local regulations on quality or your goods will not be allowed. The US State Department does not really get to have a stated position other than diplomatic.
  - Klathmon 9y ago
    Who will be responsible for the "blocking"? Will I as a developer or US business owner need to proactively disallow all users from outside the US (since I am not familiar with their laws) to avoid potential legal troubles, or will other countries block my site/service without me needing to do anything?
    - tscs37 9y ago
      It depends on whether or not you are operating under their jurisdiction or not. If you are, they can drag you to court. End of story. If you aren't then they will first rely on your cooperation and if that doesn't work, probably issue arrest orders which will make it a bit inconvenient to enter the EU for a while. And they'll probably tell ISPs to block you, yeah.
  - gdwatson 9y ago
    "It is a similar concept to export of physical goods into a country/trade block. Either comply with the local regulations on quality or your goods will not be allowed." That analogy is what I take issue with. It's clear that Facebook, selling ads to European buyers, is doing business there. But is every random web site with a few European users? Does putting up a web site suddenly mean you're doing business in every country in the world, subject to the jurisdiction of all of them simultaneously? "The US State Department does not really get to have a stated position other than diplomatic." Diplomacy is what it does, and its diplomatic position on trade issues is relevant.

an_account 9y ago

I assume that companies can deny services that cost them money if you don’t consent to services that create revenue. Is this true?

andkenneth 9y ago
No it's not true. That's exactly why this is so interesting and potentially devastating.
dannyw 9y ago
No, the EU doesn’t mess around. I don’t see any provisions in the GDPR allowing companies to do that. I guess companies can charge money for services that cost them money, and give you money if you enable certain services.
- Terribledactyl 9y ago
  GDPR doesn't need to reenumerate this. Selling service above cost is already allowed.
  - dannyw 9y ago
    I mean as, want to use Messenger? That's $20 a month. Want to let us monetise your messages for ads? We'll pay you $20 a month. Of course, I don't see Facebook actually doing this, but just food for thought.
PeterisP 9y ago
It appears not - it requires the consent to be freely given, as in, the customer actually wants you to process the data or the data is inherently necessary for the service e.g. a shipping address to ship goods. "'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;" Article 7.4 "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." Recital 43 "...Consent is presumed not to be freely given if [...] or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." Companies can deny services that cost them money unless you pay; but if you make "consent" as a condition for everyone then it's assumed that it's not freely given consent. You can deny service to everyone, but you can't require consent from everyone. That's not a new thing - that's exactly how the law works already regarding e.g. spam restrictions; you can have opt-in confirmation only if it's optional, if you make it mandatory to "opt-in" (e.g. deny registration unless the opt-in is checked) then it's not consent. Also, even if you have consent, it can be revoked at any time (e.g. 5 minutes after the user received what they wanted), and you have to unconditionally remove the private information from your systems, even if you gave them a discount because they had "consented" at that moment. Also, the customer may give you consent to process their data as such (e.g. include in your service) but object to their use in targeted marketing. Article 21 (Right to object) "... (2) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. (3) Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." - so it should be expected that even if you have consensually obtained the data, then you cannot use it freely, you can use it only for particular purposes; and things like EULAs can't override that.

Buge 9y ago

So I have to consent to be shown ads? So every site has to by default block all their own ads?

imustbeevil 9y ago
No, they can show you ads that don't use your data. You'd have to allow them to use your data to give you better ads, but you'd just get worse ads in the meantime.
- djrogers 9y ago
  Watch how you use those words - if one defines ‘better’ and ‘worse’ in the context of my privacy, then ads that don’t do creepy things are better.
  - BigJono 9y ago
    Is there anything inherently bad about a site using your data to serve you more relevant ads, as long as your data is not passed on to a 3rd party?
    - djrogers 9y ago
      Show me a site that gathers data about me directly, transparently, and without any creepy cross-site tracking, and I’ll consider your question. Unfortunately that’s not how anyone works.
    - e12e 9y ago
      I'd say that highly targeted ads are harmful, as it's more likely to undermine the viewer (eg: political ads tweaked based on current family situation/emergencies derived from data mining). Eg: target people who recently lost loved ones to an attack by one of our times typical "lone gunmen" by ads advertising increased surveillance as a way to mitigate "terrorist" attacks. Or substituting in first names of friends in paid content ("<person with same name as your friend> give the following reasons to vote x!/buy this"). Not to mention that if advertising works - then it undermines the idea of a free marked where purchases are made by informed independent agents (I think that's a fantasy anyway, but it seems to be a somewhat popular idea).

gdwatson 9y ago

I applaud regulations promoting user privacy, even if this seems heavy handed. But does anyone else wonder about the implications of applying that regulation to those who collect data on EU residents whether they operate in the EU or not? Has the US State Department stated a position on the matter?

asdfgadsfgasfdg 9y ago
It is a similar concept to export of physical goods into a country/trade block. Either comply with the local regulations on quality or your goods will not be allowed. The US State Department does not really get to have a stated position other than diplomatic.
- Klathmon 9y ago
  Who will be responsible for the "blocking"? Will I as a developer or US business owner need to proactively disallow all users from outside the US (since I am not familiar with their laws) to avoid potential legal troubles, or will other countries block my site/service without me needing to do anything?
  - tscs37 9y ago
    It depends on whether or not you are operating under their jurisdiction or not. If you are, they can drag you to court. End of story. If you aren't then they will first rely on your cooperation and if that doesn't work, probably issue arrest orders which will make it a bit inconvenient to enter the EU for a while. And they'll probably tell ISPs to block you, yeah.
- gdwatson 9y ago
  "It is a similar concept to export of physical goods into a country/trade block. Either comply with the local regulations on quality or your goods will not be allowed." That analogy is what I take issue with. It's clear that Facebook, selling ads to European buyers, is doing business there. But is every random web site with a few European users? Does putting up a web site suddenly mean you're doing business in every country in the world, subject to the jurisdiction of all of them simultaneously? "The US State Department does not really get to have a stated position other than diplomatic." Diplomacy is what it does, and its diplomatic position on trade issues is relevant.