5 ms·

I think you are expecting too much. Folks are going to click consent buttons in order to use the websites they want to use and never think to go to privacy dash

I think you are expecting too much. Folks are going to click consent buttons in order to use the websites they want to use and never think to go to privacy dashboard and view/modify/delete their data.

PeterisP 9y ago
No, GDPR quite explicitly plans for that. First, there's no such thing as "click consent buttons in order to use the websites they want to use" - if clicking that button is needed to use the website, then it doesn't count as freely given consent. I.e. either the choices are "Agree and proceed" and "Disagree, but still proceed" or you might not have bothered with asking, since that click is not consent. If the data is not inherently needed to provide the service (i.e. a delivery address if you want something delivered), then users must have the option to refuse. Second, there can be no single "consent to do everything". You have to explain every single usecase separately with details and specifics, and get consent for each use case separately. This is a big issue. If a small company has something particular in mind, it's not a big deal. But if a megacorp has (had) a habit to use your data everywhere for everything, that's not going to work. As GDPR states, “A purpose that is vague or general, such as for instance ‘Improving users’ experience’, ‘marketing purposes’, or ‘future research’ will – without further detail – usually not meet the criteria of being ‘specific’”. If the list of use cases and their details doesn't fit on a single screen, users simply won't accept them. For an organization like Facebook, it'll be a major challenge to simply list the places and ways where they are already using my data - and they'll either have to give that full list to me and somehow convince me that I should agree (as the default option is to refuse with no consequence to me) or stop doing it. In essence, you have to bring them to the privacy dashboard first. And everything has to be opt-in (default off). If you have a random consent button like the classic "Agree" under terms and conditions - well, that doesn't count as informed consent, so if that was your system then you don't have consent from any of your users, and your use of their data was prohibited. Even if most users won't care, a few activists can force you to change the behavior for everyone or risk major fines - i.e. if I see that you're using my data without my consent, then it doesn't stop at you removing my data; the regulator can ask you to prove that you got informed, specific, freely given consent from all your other users. Third, previous consent doesn't imply future consent - if you want to use the data for something new, previously this was done by quietly amending the terms and conditions, and adding a new option to the privacy dashboard (often pre-selected). Under GDPR, every new use requires new consent. Fourth, a lot of the tracking has historically been done by third parties. I can see myself giving consent to use my data on some forum or blog that I frequent; however, the consent that I give them doesn't count as consent for all the ad networks running the ads on their site. The ad networks would have to ask permission separately (which they won't realistically get, ever) and they also can't count on getting the site owner to give them my data, since site owner needs my (separate! opt-in! specific instead of "may share with third parties"!) consent for that.
- ec109685 9y ago
  What if your website doesn’t work without cookies? “We are collecting this data in order to provide relevant stories and advertisements on this website and partner websites. Please click Yes to enable your personalized feed”.
  - PeterisP 9y ago
    Each purpose must be listed separately; the fact that user gave you the data and consent to use it for one purpose doesn't imply that you're allowed to use that data for another purpose. In your example: "This data is absolutely required for the service you requested" >> no consent needed, you're just informing the user; "Also, we'd like to use that data to personalize your feed" >> opt-in; "Also, we'd like to use that data to personalize your advertisements on partner websites" >> a separate, different opt-in. The user can enable the personalized feed while denying you consent to share that data with advertisers.
    - ec109685 9y ago
      And if they say no along the way, what prevents the company from blocking access? Also, how does law differentiate between something that has to be separate or AND'd?
      - PeterisP 9y ago
        If the company does block access when you decline, then this means that the regulator is exceedingly likely to consider that any "consent" the company got from those who agreed was not freely given, and so it does not have the right to use any user's data for this purpose; which would expose the company to substantial fines. The law intentionally doesn't set out explicit conditions to differentiate between what needs to be separate, and other conditions as well, to prevent gaming for workarounds. Instead, it lies out general principles and rights of the users, and gives a lot of leeway to the regulator(s) to evaluate if the usage of data was in accordance to the user's wishes. In essence, the question is quite simple - did the user want you to use that data for whatever you did? And, can you demonstrate to the regulator that they intentionally gave you informed consent by freely opting in to that use? If they genuinely wish you to have and use that data, then it's ok (and they're not going to complain) and if they did not actually want you to use that data but your process somehow managed them to click all the required boxes, then your process is wrong, since whatever it measures is not informed, freely given opt-in consent. E.g. if I'm the company, then it's my duty to show why I have the right to user other's private data. If the only justification I can provide is that they clicked on "We are collecting this data in order to provide relevant stories and advertisements on this website and partner websites. Please click Yes to enable your personalized feed", then that's a lousy justification - it demonstrates that users wanted me to enable their personalized feed (so I have permission to do that), but it doesn't really show that those who clicked 'Yes' wanted me to use their data for advertisements on partner websites, which is the criteria that matters. Any regulator will reasonably assume that it's likely that some of those users wanted the feed but did not want their data to be given to advertisers, in fact, they might have some evidence in forms of complaint from such users. Maybe some of them really wanted me to do just that (e.g. they freely wished to support my site in this way by donating access to their data), but that question did not give them the ability to clearly express this intent. If I had separated those things, I might have gotten consent from some users to share data with advertisers, but with the combined question I did not; so it'd be in my interests to separate those questions. All the consent-related articles of the law and comments to them pretty much amount to repeatedly stating that if the user doesn't wish you to use that data, then the only way out is not to use it (or use it under some of the non-consensual use exemptions) - the law doesn't provide any option to claim consent if the customer doesn't actually want you to do what you did with their data. For a crude comparison, the consent criteria seem to be comparable with those of sexual assault - no means no, a lack of answer is not consent, consent must be freely given and not coerced with some threats, consent can be withdrawn at any time, etc, etc; essentially it's only consent if they actually want to do that, no tricks or technicalities. The answer to "what prevents the company from blocking access if they say no along the way" is somewhat analogous to "what prevents your boss from firing you if you say no to requests of sexual favors" - they can do that, but the (implied) threat of it means that the act was not consensual and unacceptable even if you didn't say no.

PeterisP 9y ago

No, GDPR quite explicitly plans for that. First, there's no such thing as "click consent buttons in order to use the websites they want to use" - if clicking that button is needed to use the website, then it doesn't count as freely given consent. I.e. either the choices are "Agree and proceed" and "Disagree, but still proceed" or you might not have bothered with asking, since that click is not consent. If the data is not inherently needed to provide the service (i.e. a delivery address if you want something delivered), then users must have the option to refuse. Second, there can be no single "consent to do everything". You have to explain every single usecase separately with details and specifics, and get consent for each use case separately. This is a big issue. If a small company has something particular in mind, it's not a big deal. But if a megacorp has (had) a habit to use your data everywhere for everything, that's not going to work. As GDPR states, “A purpose that is vague or general, such as for instance ‘Improving users’ experience’, ‘marketing purposes’, or ‘future research’ will – without further detail – usually not meet the criteria of being ‘specific’”. If the list of use cases and their details doesn't fit on a single screen, users simply won't accept them. For an organization like Facebook, it'll be a major challenge to simply list the places and ways where they are already using my data - and they'll either have to give that full list to me and somehow convince me that I should agree (as the default option is to refuse with no consequence to me) or stop doing it. In essence, you have to bring them to the privacy dashboard first. And everything has to be opt-in (default off). If you have a random consent button like the classic "Agree" under terms and conditions - well, that doesn't count as informed consent, so if that was your system then you don't have consent from any of your users, and your use of their data was prohibited. Even if most users won't care, a few activists can force you to change the behavior for everyone or risk major fines - i.e. if I see that you're using my data without my consent, then it doesn't stop at you removing my data; the regulator can ask you to prove that you got informed, specific, freely given consent from all your other users. Third, previous consent doesn't imply future consent - if you want to use the data for something new, previously this was done by quietly amending the terms and conditions, and adding a new option to the privacy dashboard (often pre-selected). Under GDPR, every new use requires new consent. Fourth, a lot of the tracking has historically been done by third parties. I can see myself giving consent to use my data on some forum or blog that I frequent; however, the consent that I give them doesn't count as consent for all the ad networks running the ads on their site. The ad networks would have to ask permission separately (which they won't realistically get, ever) and they also can't count on getting the site owner to give them my data, since site owner needs my (separate! opt-in! specific instead of "may share with third parties"!) consent for that.

ec109685 9y ago
What if your website doesn’t work without cookies? “We are collecting this data in order to provide relevant stories and advertisements on this website and partner websites. Please click Yes to enable your personalized feed”.
- PeterisP 9y ago
  Each purpose must be listed separately; the fact that user gave you the data and consent to use it for one purpose doesn't imply that you're allowed to use that data for another purpose. In your example: "This data is absolutely required for the service you requested" >> no consent needed, you're just informing the user; "Also, we'd like to use that data to personalize your feed" >> opt-in; "Also, we'd like to use that data to personalize your advertisements on partner websites" >> a separate, different opt-in. The user can enable the personalized feed while denying you consent to share that data with advertisers.
  - ec109685 9y ago
    And if they say no along the way, what prevents the company from blocking access? Also, how does law differentiate between something that has to be separate or AND'd?
    - PeterisP 9y ago
      If the company does block access when you decline, then this means that the regulator is exceedingly likely to consider that any "consent" the company got from those who agreed was not freely given, and so it does not have the right to use any user's data for this purpose; which would expose the company to substantial fines. The law intentionally doesn't set out explicit conditions to differentiate between what needs to be separate, and other conditions as well, to prevent gaming for workarounds. Instead, it lies out general principles and rights of the users, and gives a lot of leeway to the regulator(s) to evaluate if the usage of data was in accordance to the user's wishes. In essence, the question is quite simple - did the user want you to use that data for whatever you did? And, can you demonstrate to the regulator that they intentionally gave you informed consent by freely opting in to that use? If they genuinely wish you to have and use that data, then it's ok (and they're not going to complain) and if they did not actually want you to use that data but your process somehow managed them to click all the required boxes, then your process is wrong, since whatever it measures is not informed, freely given opt-in consent. E.g. if I'm the company, then it's my duty to show why I have the right to user other's private data. If the only justification I can provide is that they clicked on "We are collecting this data in order to provide relevant stories and advertisements on this website and partner websites. Please click Yes to enable your personalized feed", then that's a lousy justification - it demonstrates that users wanted me to enable their personalized feed (so I have permission to do that), but it doesn't really show that those who clicked 'Yes' wanted me to use their data for advertisements on partner websites, which is the criteria that matters. Any regulator will reasonably assume that it's likely that some of those users wanted the feed but did not want their data to be given to advertisers, in fact, they might have some evidence in forms of complaint from such users. Maybe some of them really wanted me to do just that (e.g. they freely wished to support my site in this way by donating access to their data), but that question did not give them the ability to clearly express this intent. If I had separated those things, I might have gotten consent from some users to share data with advertisers, but with the combined question I did not; so it'd be in my interests to separate those questions. All the consent-related articles of the law and comments to them pretty much amount to repeatedly stating that if the user doesn't wish you to use that data, then the only way out is not to use it (or use it under some of the non-consensual use exemptions) - the law doesn't provide any option to claim consent if the customer doesn't actually want you to do what you did with their data. For a crude comparison, the consent criteria seem to be comparable with those of sexual assault - no means no, a lack of answer is not consent, consent must be freely given and not coerced with some threats, consent can be withdrawn at any time, etc, etc; essentially it's only consent if they actually want to do that, no tricks or technicalities. The answer to "what prevents the company from blocking access if they say no along the way" is somewhat analogous to "what prevents your boss from firing you if you say no to requests of sexual favors" - they can do that, but the (implied) threat of it means that the act was not consensual and unacceptable even if you didn't say no.