16 ms·

And if they say no along the way, what prevents the company from blocking access? Also, how does law differentiate between something that has to be separate or

And if they say no along the way, what prevents the company from blocking access? Also, how does law differentiate between something that has to be separate or AND'd?

PeterisP 9y ago
If the company does block access when you decline, then this means that the regulator is exceedingly likely to consider that any "consent" the company got from those who agreed was not freely given, and so it does not have the right to use any user's data for this purpose; which would expose the company to substantial fines. The law intentionally doesn't set out explicit conditions to differentiate between what needs to be separate, and other conditions as well, to prevent gaming for workarounds. Instead, it lies out general principles and rights of the users, and gives a lot of leeway to the regulator(s) to evaluate if the usage of data was in accordance to the user's wishes. In essence, the question is quite simple - did the user want you to use that data for whatever you did? And, can you demonstrate to the regulator that they intentionally gave you informed consent by freely opting in to that use? If they genuinely wish you to have and use that data, then it's ok (and they're not going to complain) and if they did not actually want you to use that data but your process somehow managed them to click all the required boxes, then your process is wrong, since whatever it measures is not informed, freely given opt-in consent. E.g. if I'm the company, then it's my duty to show why I have the right to user other's private data. If the only justification I can provide is that they clicked on "We are collecting this data in order to provide relevant stories and advertisements on this website and partner websites. Please click Yes to enable your personalized feed", then that's a lousy justification - it demonstrates that users wanted me to enable their personalized feed (so I have permission to do that), but it doesn't really show that those who clicked 'Yes' wanted me to use their data for advertisements on partner websites, which is the criteria that matters. Any regulator will reasonably assume that it's likely that some of those users wanted the feed but did not want their data to be given to advertisers, in fact, they might have some evidence in forms of complaint from such users. Maybe some of them really wanted me to do just that (e.g. they freely wished to support my site in this way by donating access to their data), but that question did not give them the ability to clearly express this intent. If I had separated those things, I might have gotten consent from some users to share data with advertisers, but with the combined question I did not; so it'd be in my interests to separate those questions. All the consent-related articles of the law and comments to them pretty much amount to repeatedly stating that if the user doesn't wish you to use that data, then the only way out is not to use it (or use it under some of the non-consensual use exemptions) - the law doesn't provide any option to claim consent if the customer doesn't actually want you to do what you did with their data. For a crude comparison, the consent criteria seem to be comparable with those of sexual assault - no means no, a lack of answer is not consent, consent must be freely given and not coerced with some threats, consent can be withdrawn at any time, etc, etc; essentially it's only consent if they actually want to do that, no tricks or technicalities. The answer to "what prevents the company from blocking access if they say no along the way" is somewhat analogous to "what prevents your boss from firing you if you say no to requests of sexual favors" - they can do that, but the (implied) threat of it means that the act was not consensual and unacceptable even if you didn't say no.
- ec109685 9y ago
  I am not sure you intepretation is correct but I really appreciated your detailed answers and reasoning behind them.

And if they say no along the way, what prevents the company from blocking access? Also, how does law differentiate between something that has to be separate or AND'd?

PeterisP 9y ago

If the company does block access when you decline, then this means that the regulator is exceedingly likely to consider that any "consent" the company got from those who agreed was not freely given, and so it does not have the right to use any user's data for this purpose; which would expose the company to substantial fines. The law intentionally doesn't set out explicit conditions to differentiate between what needs to be separate, and other conditions as well, to prevent gaming for workarounds. Instead, it lies out general principles and rights of the users, and gives a lot of leeway to the regulator(s) to evaluate if the usage of data was in accordance to the user's wishes. In essence, the question is quite simple - did the user want you to use that data for whatever you did? And, can you demonstrate to the regulator that they intentionally gave you informed consent by freely opting in to that use? If they genuinely wish you to have and use that data, then it's ok (and they're not going to complain) and if they did not actually want you to use that data but your process somehow managed them to click all the required boxes, then your process is wrong, since whatever it measures is not informed, freely given opt-in consent. E.g. if I'm the company, then it's my duty to show why I have the right to user other's private data. If the only justification I can provide is that they clicked on "We are collecting this data in order to provide relevant stories and advertisements on this website and partner websites. Please click Yes to enable your personalized feed", then that's a lousy justification - it demonstrates that users wanted me to enable their personalized feed (so I have permission to do that), but it doesn't really show that those who clicked 'Yes' wanted me to use their data for advertisements on partner websites, which is the criteria that matters. Any regulator will reasonably assume that it's likely that some of those users wanted the feed but did not want their data to be given to advertisers, in fact, they might have some evidence in forms of complaint from such users. Maybe some of them really wanted me to do just that (e.g. they freely wished to support my site in this way by donating access to their data), but that question did not give them the ability to clearly express this intent. If I had separated those things, I might have gotten consent from some users to share data with advertisers, but with the combined question I did not; so it'd be in my interests to separate those questions. All the consent-related articles of the law and comments to them pretty much amount to repeatedly stating that if the user doesn't wish you to use that data, then the only way out is not to use it (or use it under some of the non-consensual use exemptions) - the law doesn't provide any option to claim consent if the customer doesn't actually want you to do what you did with their data. For a crude comparison, the consent criteria seem to be comparable with those of sexual assault - no means no, a lack of answer is not consent, consent must be freely given and not coerced with some threats, consent can be withdrawn at any time, etc, etc; essentially it's only consent if they actually want to do that, no tricks or technicalities. The answer to "what prevents the company from blocking access if they say no along the way" is somewhat analogous to "what prevents your boss from firing you if you say no to requests of sexual favors" - they can do that, but the (implied) threat of it means that the act was not consensual and unacceptable even if you didn't say no.

ec109685 9y ago
I am not sure you intepretation is correct but I really appreciated your detailed answers and reasoning behind them.