4 ms·

Wonder how much of a secondary consultancy market this is going to create. I can just see "GDPR consultant charging $450/hour with a minimum 2 weeks worth of wo

by rdtsc 9y ago

Wonder how much of a secondary consultancy market this is going to create. I can just see "GDPR consultant charging $450/hour with a minimum 2 weeks worth of work" job listings. It would be interesting what companies do about it. Will any of them pull out of the EU market. Or maybe make users sign away their rights on their next login "If you use this service, you give us permission to use your data in this and that way which may or may not be GDPR compliant, if you refuse we'll delete your profile and you'll have to find an another service to solve your problem". As a consumer, I like what GDPR is doing. As a developer having to implement compliance for it, it is a huge pain.

matthewheath 9y ago
> Or maybe make users sign away their rights on their next login The GDPR explicitly disallows this. You're not allowed to make access to your service conditional on consent because it's considered to be "not true consent".
- wtfstatists 9y ago
  Expanding on this, official guideline on consent [1] gives 2 relevant examples. TLDR: you cannot offer no, degraded or higher-priced service if consent is not given. I would say this is effectively banning targeted ads as revenue stream. IMO this goes too far. [Example 1] A mobile app for photo editing asks its users to have their GPS localisation activated for the use of its services. The app also tells its users it will use the collected data for behavioural advertising purposes. Neither geo-localisation or online behavioural advertising are necessary for the provision of the photo editing service and go beyond the delivery of the core service provided. Since users cannot use the app without consenting to these purposes, the consent cannot be considered as being freely given. [Example 6] A bank asks customers for consent to use their payment details for marketing purposes. This processing activity is not necessary for the performance of the contract with the customer and the delivery of ordinary bank account services. If the customer’s refusal to consent to this processing purpose would lead to the denial of banking services, closure of the bank account, or an increase of the fee, consent cannot be freely given or revoked. [1] http://ec.europa.eu/newsroom/just/document.cfm?doc_id=48849 http://ec.europa.eu/newsroom/just/document.cfm?doc_id=48849
  - TeMPOraL 9y ago
    And IMO this is exactly right, and I'm actually surprised people tolerated the current state of things for so long. The examples you quoted are clear-cut cases of abusing the user. Marketing is cancer on society, and it infected everything deeply. I welcome anything that changes the incentives so that it's less rather than more profitable to try and suck in every piece of data you can get your hands on.
    - foobiekr 9y ago
      I agree with the spirit of this but can’t help but believe that the Googles and Facebooks if the world will just ignore the intent and get away with it. Their profit margins basically require them to do so.
      - TeMPOraL 9y ago
        They'll try, for sure. We'll see how this pans out pretty soon now.
- Sylos 9y ago
  And to calm the people needing to implement the GDPR in companies: This does not apply, if you actually need the data to provide the service. For example, in an online shop, you obviously need to process the address of your customer in order to ship them whatever they bought. You also need to store their name and such, because law requires that when doing financial transactions. So, if the user does not want to provide you these, you do not need to make the impossible possible. The exact law text is in article 7, section 4. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
kodablah 9y ago
More interestingly, I wonder how many sites, even with the best of intentions, just stop selling to EU customers instead of guarantee compliance. I know if I was in a startup with very limited funding and customer reach was not my problem, I'd just as soon not sell on the continent. Once I can absorb the risk or I need more customers that'd change of course, but while you have your head down working and maybe you have a limited beta or something, it's clear what citizens carry more baggage with their usership.
- TeMPOraL 9y ago
  Many, probably, and it's completely understandable. But I don't think it's going to be that big of a problem for European consumers. For each site like that, I expect EU-based competitors to pop up and fill the space with services that follow GDPR.
  - Sylos 9y ago
    Yeah, even if it's not as many as before, I do think the privacy is more important.

by rdtsc 9y ago

matthewheath 9y ago

> Or maybe make users sign away their rights on their next login The GDPR explicitly disallows this. You're not allowed to make access to your service conditional on consent because it's considered to be "not true consent".

wtfstatists 9y ago
Expanding on this, official guideline on consent [1] gives 2 relevant examples. TLDR: you cannot offer no, degraded or higher-priced service if consent is not given. I would say this is effectively banning targeted ads as revenue stream. IMO this goes too far. [Example 1] A mobile app for photo editing asks its users to have their GPS localisation activated for the use of its services. The app also tells its users it will use the collected data for behavioural advertising purposes. Neither geo-localisation or online behavioural advertising are necessary for the provision of the photo editing service and go beyond the delivery of the core service provided. Since users cannot use the app without consenting to these purposes, the consent cannot be considered as being freely given. [Example 6] A bank asks customers for consent to use their payment details for marketing purposes. This processing activity is not necessary for the performance of the contract with the customer and the delivery of ordinary bank account services. If the customer’s refusal to consent to this processing purpose would lead to the denial of banking services, closure of the bank account, or an increase of the fee, consent cannot be freely given or revoked. [1] http://ec.europa.eu/newsroom/just/document.cfm?doc_id=48849 http://ec.europa.eu/newsroom/just/document.cfm?doc_id=48849
- TeMPOraL 9y ago
  And IMO this is exactly right, and I'm actually surprised people tolerated the current state of things for so long. The examples you quoted are clear-cut cases of abusing the user. Marketing is cancer on society, and it infected everything deeply. I welcome anything that changes the incentives so that it's less rather than more profitable to try and suck in every piece of data you can get your hands on.
  - foobiekr 9y ago
    I agree with the spirit of this but can’t help but believe that the Googles and Facebooks if the world will just ignore the intent and get away with it. Their profit margins basically require them to do so.
    - TeMPOraL 9y ago
      They'll try, for sure. We'll see how this pans out pretty soon now.
Sylos 9y ago
And to calm the people needing to implement the GDPR in companies: This does not apply, if you actually need the data to provide the service. For example, in an online shop, you obviously need to process the address of your customer in order to ship them whatever they bought. You also need to store their name and such, because law requires that when doing financial transactions. So, if the user does not want to provide you these, you do not need to make the impossible possible. The exact law text is in article 7, section 4. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/

kodablah 9y ago

More interestingly, I wonder how many sites, even with the best of intentions, just stop selling to EU customers instead of guarantee compliance. I know if I was in a startup with very limited funding and customer reach was not my problem, I'd just as soon not sell on the continent. Once I can absorb the risk or I need more customers that'd change of course, but while you have your head down working and maybe you have a limited beta or something, it's clear what citizens carry more baggage with their usership.

TeMPOraL 9y ago
Many, probably, and it's completely understandable. But I don't think it's going to be that big of a problem for European consumers. For each site like that, I expect EU-based competitors to pop up and fill the space with services that follow GDPR.
- Sylos 9y ago
  Yeah, even if it's not as many as before, I do think the privacy is more important.