6 ms·

I hope they checked this with their lawyers, otherwise they will be sued out of existence when EU GDPR directive comes into effect(only applies to EU citizens).

by dz0ny 9y ago

I hope they checked this with their lawyers, otherwise they will be sued out of existence when EU GDPR directive comes into effect(only applies to EU citizens). Just check the "Consent" section at https://gdprchecklist.io/ https://gdprchecklist.io/ Opt-out is not legal anymore... I'm not saying they are not allowed to collect, they can, just not by default. And because they are requesting "Location", they fall under GDPR even in lamest terms.

lloeki 9y ago
> We would like to add a checkbox to the installer, exact wording TBD, but along the lines of “Send diagnostics information to help improve Ubuntu”. This would be checked by default. This is about a choice presented as a checkbox that is checked by default during installation, not about a feature silently enabled by default you have to then opt out of.
- dz0ny 9y ago
  Opt-in by GDPR means that you have to specifically click on checkbox, button, url and say "I consent on collection of this data(list of things that will be collected) on behalf Canonical LTD."
  - ryanworl 9y ago
    Consent is just one way to legally process personal data. If their basis for processing it is something other than consent, an opt-out is them going above their responsibility.
    - rbf 9y ago
      True. However, it's hard to argue diagnostics data for Ubuntu would be performance of contract (art 6.1: b). It could be argued legitimate interest (arg 6.1: f), but then the right to object comes into play.
      - ryanworl 9y ago
        Yes, it definitely wouldn’t be performance of a contract! I have no insight into their reasoning here, I just wanted to bring this fact up given I see people talking about consent all the time when that is not the only basis allowed under the law.
- zimpenfish 9y ago
  I believe GDPR specifically disallows "checked by default" for consent.
- wjnc 9y ago
  The GPDR asks for a deliberate action to opt-in (“silence, pre-ticked boxes or inactivity” should not constitute consent). So they should make it a very prominent choice to opt-in. No more opt-out in Europe.
  - lloeki 9y ago
    > “silence, pre-ticked boxes or inactivity” should not constitute consent Could you give a reference for that? I found this with a couple of examples[0] but my understanding so far is that as long as it's a separate isolated step dedicated to that question with clearly worded language explaining the collection, followed by a very explicit "I agree" button or checkbox, then it's fine. The step itself (not the checkbox) constitutes wilful agreement, as it requires action for that dedicated step: it's definitely not "inactivity" nor "silent". Here I assume the button to move to the next step is not simply labeled "next step", nor is it actionable by simply pressing the enter or space key, possibly by mistake. [0]: https://dma.org.uk/article/gdpr-in-practice-tick-box-consent-forms https://dma.org.uk/article/gdpr-in-practice-tick-box-consent...
    - wjnc 9y ago
      It's right there in the regulation under (32) [0] I find your workflow reasonable, but it would fall short under 'free'. Negative and positive action are two different things and in this case the wording is quite clear ("clear affirmative act", "pre-ticked box [..] should not"). [0] http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=NL http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
- r3bl 9y ago
  That's still tracking by default. A safe bet in this case would be a "double opt-in" approach, in which they have a checkmark during the installer, and then send an interactive notification asking you to verify your decision after the installation. In such a case, tracking would need to be enabled only after the user has clicked "yes" on a notification. The idea here is that the user has to do something explicitly to enable tracking. Clicking "next" on an installer isn't an explicit user action.
mcintyre1994 9y ago
I'm unconvinced that what they're collecting is personal information. The closest would probably be location, but that's very coarse and is based on user selection not IP (which isn't stored). I might be wrong though, what data were you thinking could be problematic?
- dz0ny 9y ago
  I'm not a lawyer, but my understanding is that anything that identifies consumer or group of consumers falls under GDPR. General Data Protection Regulation, it's not only about personal information, but what data is collected by companies, who has access to it and why/how is it processed.
- LogicalBorg 9y ago
  I agree that they are not collecting personal information. They are collecting information about your computer system. According to the ICO definition of personal data, it means "any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier." (https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/ https://ico.org.uk/for-organisations/guide-to-the-general-da...). Nothing like that is being collected.
randomsearch 9y ago
Speaking with an expert on this recently, she is under the impression that individual opt-in boxes for every distinct type of data will be necessary. So a single box will be insufficient.
- randomsearch 9y ago
  Oh, and it is most definitely opt in. Ubuntu will not get away with that.
y0ghur7_xxx 9y ago
They don't collect any personal data. The GDPR defines "personal data" with "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" Nothing in the collected data is "relating to an identified or identifiable natural person", so the checkbox is not even necessary.
- Santosh83 9y ago
  What about crash reports that will be send automatically to Canonical? I hope they would take precautions to scrub personal information from the data before sending them.
- Aaargh20318 9y ago
  > Nothing in the collected data is "relating to an identified or identifiable natural person", so the checkbox is not even necessary. The data collected could be used to identify a single person. How many people have the exact same combination of CPU, amount of RAM, location, disk sizes,GPU vendor/model, disk layout and installed applications ? If the data is unique enough, it's PII.
  - setra 9y ago
    A unique random cookie is not PII automatically. It is only PII if it can be associated with something like a name (not limited to a name). Anonymous data with unique identities is not under the consent requirements of the GDPR.
  - y0ghur7_xxx 9y ago
    > The data collected could be used to identify a single person. > How many people have the exact same combination of CPU, amount of RAM, location, disk sizes,GPU vendor/model, disk layout and installed applications ? > If the data is unique enough, it's PII. You can not connect a unique combination of cpu, gpu, disk size, with me, y0ghur7_xxx, if you don't collect my ip address or my name in any other way, so no, it's not "personal data" as per GDPR.
setra 9y ago
The data collected is probably not fit to be classified as personal data. GDPR does not automatically forbid collection of anything involved with a user otherwise things like page popularity ranking would not be possible. There was a court ruling stating that IP addresses could be considered personal data because an ISP would have a log that associated the IP with a person. As long as the are only collecting things like "what packages are installed", "how powerful is the system", "when did it last update", and anonymize the last section of the IP they should be fine.

by dz0ny 9y ago

lloeki 9y ago

> We would like to add a checkbox to the installer, exact wording TBD, but along the lines of “Send diagnostics information to help improve Ubuntu”. This would be checked by default. This is about a choice presented as a checkbox that is checked by default during installation, not about a feature silently enabled by default you have to then opt out of.

dz0ny 9y ago
Opt-in by GDPR means that you have to specifically click on checkbox, button, url and say "I consent on collection of this data(list of things that will be collected) on behalf Canonical LTD."
- ryanworl 9y ago
  Consent is just one way to legally process personal data. If their basis for processing it is something other than consent, an opt-out is them going above their responsibility.
  - rbf 9y ago
    True. However, it's hard to argue diagnostics data for Ubuntu would be performance of contract (art 6.1: b). It could be argued legitimate interest (arg 6.1: f), but then the right to object comes into play.
    - ryanworl 9y ago
      Yes, it definitely wouldn’t be performance of a contract! I have no insight into their reasoning here, I just wanted to bring this fact up given I see people talking about consent all the time when that is not the only basis allowed under the law.
zimpenfish 9y ago
I believe GDPR specifically disallows "checked by default" for consent.
wjnc 9y ago
The GPDR asks for a deliberate action to opt-in (“silence, pre-ticked boxes or inactivity” should not constitute consent). So they should make it a very prominent choice to opt-in. No more opt-out in Europe.
- lloeki 9y ago
  > “silence, pre-ticked boxes or inactivity” should not constitute consent Could you give a reference for that? I found this with a couple of examples[0] but my understanding so far is that as long as it's a separate isolated step dedicated to that question with clearly worded language explaining the collection, followed by a very explicit "I agree" button or checkbox, then it's fine. The step itself (not the checkbox) constitutes wilful agreement, as it requires action for that dedicated step: it's definitely not "inactivity" nor "silent". Here I assume the button to move to the next step is not simply labeled "next step", nor is it actionable by simply pressing the enter or space key, possibly by mistake. [0]: https://dma.org.uk/article/gdpr-in-practice-tick-box-consent-forms https://dma.org.uk/article/gdpr-in-practice-tick-box-consent...
  - wjnc 9y ago
    It's right there in the regulation under (32) [0] I find your workflow reasonable, but it would fall short under 'free'. Negative and positive action are two different things and in this case the wording is quite clear ("clear affirmative act", "pre-ticked box [..] should not"). [0] http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=NL http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
r3bl 9y ago
That's still tracking by default. A safe bet in this case would be a "double opt-in" approach, in which they have a checkmark during the installer, and then send an interactive notification asking you to verify your decision after the installation. In such a case, tracking would need to be enabled only after the user has clicked "yes" on a notification. The idea here is that the user has to do something explicitly to enable tracking. Clicking "next" on an installer isn't an explicit user action.

mcintyre1994 9y ago

I'm unconvinced that what they're collecting is personal information. The closest would probably be location, but that's very coarse and is based on user selection not IP (which isn't stored). I might be wrong though, what data were you thinking could be problematic?

dz0ny 9y ago
I'm not a lawyer, but my understanding is that anything that identifies consumer or group of consumers falls under GDPR. General Data Protection Regulation, it's not only about personal information, but what data is collected by companies, who has access to it and why/how is it processed.
LogicalBorg 9y ago
I agree that they are not collecting personal information. They are collecting information about your computer system. According to the ICO definition of personal data, it means "any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier." (https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/ https://ico.org.uk/for-organisations/guide-to-the-general-da...). Nothing like that is being collected.

randomsearch 9y ago

Speaking with an expert on this recently, she is under the impression that individual opt-in boxes for every distinct type of data will be necessary. So a single box will be insufficient.

randomsearch 9y ago
Oh, and it is most definitely opt in. Ubuntu will not get away with that.

y0ghur7_xxx 9y ago

They don't collect any personal data. The GDPR defines "personal data" with "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" Nothing in the collected data is "relating to an identified or identifiable natural person", so the checkbox is not even necessary.

Santosh83 9y ago
What about crash reports that will be send automatically to Canonical? I hope they would take precautions to scrub personal information from the data before sending them.
Aaargh20318 9y ago
> Nothing in the collected data is "relating to an identified or identifiable natural person", so the checkbox is not even necessary. The data collected could be used to identify a single person. How many people have the exact same combination of CPU, amount of RAM, location, disk sizes,GPU vendor/model, disk layout and installed applications ? If the data is unique enough, it's PII.
- setra 9y ago
  A unique random cookie is not PII automatically. It is only PII if it can be associated with something like a name (not limited to a name). Anonymous data with unique identities is not under the consent requirements of the GDPR.
- y0ghur7_xxx 9y ago
  > The data collected could be used to identify a single person. > How many people have the exact same combination of CPU, amount of RAM, location, disk sizes,GPU vendor/model, disk layout and installed applications ? > If the data is unique enough, it's PII. You can not connect a unique combination of cpu, gpu, disk size, with me, y0ghur7_xxx, if you don't collect my ip address or my name in any other way, so no, it's not "personal data" as per GDPR.

setra 9y ago

The data collected is probably not fit to be classified as personal data. GDPR does not automatically forbid collection of anything involved with a user otherwise things like page popularity ranking would not be possible. There was a court ruling stating that IP addresses could be considered personal data because an ISP would have a log that associated the IP with a person. As long as the are only collecting things like "what packages are installed", "how powerful is the system", "when did it last update", and anonymize the last section of the IP they should be fine.