4 ms·

And what happens when anything of that changes in scope? You gonna resend the consent form to each and every past user? Of corse not. What will happen instead

And what happens when anything of that changes in scope? You gonna resend the consent form to each and every past user? Of corse not. What will happen instead is that behind a consent box a lengthy disclaimer will ask consent for every piece of information and blanket every length of scope, triggering a cascade across providers and contractors.

_o_ 9y ago
No it will not. For consent it is explicitly forbiden to use legal / technical speech and you can't cascade it. Allowing you to use my data has nothing to do with you giving my data to google. The more 3rd party "providers" the more fishy will your site look. And you can bet the user wont give consent for 100 tick boxes - you can't pretick them, it needs to be opt-in. And this is the reason: https://www.paypal.com/ie/webapps/mpp/ua/third-parties-list https://www.paypal.com/ie/webapps/mpp/ua/third-parties-list This might help: https://pagefair.com/blog/2018/granular-gdpr-consent/ https://pagefair.com/blog/2018/granular-gdpr-consent/
- sobani 9y ago
  A quick scan through that list doesn't raise any red flags for me. Of course they need to share data with payment providers (like a bank), or else they won't be able to get or deposit your money. Of course they need to share data with auditing firms, or else they won't be able to do business in certain countries. Of course they need to provide customer service. Of course they need to check for fraud. etc. What do you expect Paypal to do in those cases?
  - PeterisP 9y ago
    Many of the things listed above (legal requirements, etc) don't actually require consent, so they have different criteria - in essence, Paypal just needs to clearly inform the user what they're doing. Consent is just one of six criteria that may allow you to use private data; the actually necessary (as opposed to merely desirable/profitable) use cases of the data fall under one of the other criteria and don't require obtaining consent. Consent is mostly relevant to all the marketing and customer analysis activities, which aren't essential to the service, so can be refused, and would be severely curtailed as users stop consenting to these uses of their data.
  - _o_ 9y ago
    Check it a little bit better, grep for "market". Google? Facebook (i dont have FB account, never had!)? I can hardly wait to NOT tick those and demand view of shared data. They are already profiting from the service they provide but they still give (Sell! I bet they can use a different terminology but essentially this is it) the users data to other companies. Those are the companies that brought GDPR on all of us, and those are the parties that should be punished with 4% global revenue, multiple times. I bet everyone will be shocked what the companies are doing with our data, from our banks, credit card companies, insurance companies,... i think that everyone (or most) will stop complaining about GDPR and want it for their country too. Just an example, what gets delivered just for Facebook: "Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with PayPal users (without indicating account relationship), IP Address, Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata via Facebook SDK in mobile apps." Encrypted e-mail address? Why encrypted, not hashed? IP? Why the FB needs my IP on connecting to paypal? And the list goes on and on. If GDPR will stop this the whole world will benefit.
PeterisP 9y ago
Can you elaborate about what exactly do you mean by "anything of that changes in scope"? If you have the same use case of private data but have technical changes (i.e. a different subcontractor handling the processing) then you do not need a new consent. If you have a new use case, then yes, you get to use only the data of those users who agree to it. Which will not be all users anyway, as consent must be freely given, i.e. with an opportunity to refuse consent but keep the service. The expected result of "a consent box a lengthy disclaimer will ask consent for every piece of information and blanket every length of scope" would be the TL;DR reaction - since all of that must be opt-in, the user would just click "Continue", keeping the default settings that don't give you any consent.
- LoSboccacc 9y ago
  That’s even weirder, how can people use service without consent when 95% usernames or verification mechanism are email addreses?
- pbowyer 9y ago
  > If you have the same use case of private data but have technical changes (i.e. a different subcontractor handling the processing) then you do not need a new consent. That is not how some are reading it. It's not how I've understood Article 28(2) either, though getting new consent each time is nuts (e.g. I change from Mailgun to Postmark and have to ask all SaaS customers for consent). Some discussions: https://seqlegal.com/blog/article-28-gdpr-problems-processors https://seqlegal.com/blog/article-28-gdpr-problems-processor... https://seqlegal.com/blog/gdpr-sub-processors-and-authorisations https://seqlegal.com/blog/gdpr-sub-processors-and-authorisat...
  - funkymike 9y ago
    > That is not how some are reading it. It's not how I've understood Article 28(2) either, though getting new consent each time is nuts (e.g. I change from Mailgun to Postmark and have to ask all SaaS customers for consent). This makes sense from the user's perspective. Maybe they trust Mailgun but do not trust Postmark. If they have explicitly agreed to you sharing their personal data with one company you shouldn't be able to start sending that customer's personal data to another company without their consent. If you sign up for my service and I ask for consent to send specific data to SecuriCo for "user analytics and tracking" I shouldn't be able to change that to sending the data to the NSA without telling you. The whole point is that the user should be in control of what businesses are doing with their personal information.

_o_ 9y ago

No it will not. For consent it is explicitly forbiden to use legal / technical speech and you can't cascade it. Allowing you to use my data has nothing to do with you giving my data to google. The more 3rd party "providers" the more fishy will your site look. And you can bet the user wont give consent for 100 tick boxes - you can't pretick them, it needs to be opt-in. And this is the reason: https://www.paypal.com/ie/webapps/mpp/ua/third-parties-list https://www.paypal.com/ie/webapps/mpp/ua/third-parties-list This might help: https://pagefair.com/blog/2018/granular-gdpr-consent/ https://pagefair.com/blog/2018/granular-gdpr-consent/

sobani 9y ago
A quick scan through that list doesn't raise any red flags for me. Of course they need to share data with payment providers (like a bank), or else they won't be able to get or deposit your money. Of course they need to share data with auditing firms, or else they won't be able to do business in certain countries. Of course they need to provide customer service. Of course they need to check for fraud. etc. What do you expect Paypal to do in those cases?
- PeterisP 9y ago
  Many of the things listed above (legal requirements, etc) don't actually require consent, so they have different criteria - in essence, Paypal just needs to clearly inform the user what they're doing. Consent is just one of six criteria that may allow you to use private data; the actually necessary (as opposed to merely desirable/profitable) use cases of the data fall under one of the other criteria and don't require obtaining consent. Consent is mostly relevant to all the marketing and customer analysis activities, which aren't essential to the service, so can be refused, and would be severely curtailed as users stop consenting to these uses of their data.
- _o_ 9y ago
  Check it a little bit better, grep for "market". Google? Facebook (i dont have FB account, never had!)? I can hardly wait to NOT tick those and demand view of shared data. They are already profiting from the service they provide but they still give (Sell! I bet they can use a different terminology but essentially this is it) the users data to other companies. Those are the companies that brought GDPR on all of us, and those are the parties that should be punished with 4% global revenue, multiple times. I bet everyone will be shocked what the companies are doing with our data, from our banks, credit card companies, insurance companies,... i think that everyone (or most) will stop complaining about GDPR and want it for their country too. Just an example, what gets delivered just for Facebook: "Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with PayPal users (without indicating account relationship), IP Address, Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata via Facebook SDK in mobile apps." Encrypted e-mail address? Why encrypted, not hashed? IP? Why the FB needs my IP on connecting to paypal? And the list goes on and on. If GDPR will stop this the whole world will benefit.

PeterisP 9y ago

Can you elaborate about what exactly do you mean by "anything of that changes in scope"? If you have the same use case of private data but have technical changes (i.e. a different subcontractor handling the processing) then you do not need a new consent. If you have a new use case, then yes, you get to use only the data of those users who agree to it. Which will not be all users anyway, as consent must be freely given, i.e. with an opportunity to refuse consent but keep the service. The expected result of "a consent box a lengthy disclaimer will ask consent for every piece of information and blanket every length of scope" would be the TL;DR reaction - since all of that must be opt-in, the user would just click "Continue", keeping the default settings that don't give you any consent.

LoSboccacc 9y ago
That’s even weirder, how can people use service without consent when 95% usernames or verification mechanism are email addreses?
pbowyer 9y ago
> If you have the same use case of private data but have technical changes (i.e. a different subcontractor handling the processing) then you do not need a new consent. That is not how some are reading it. It's not how I've understood Article 28(2) either, though getting new consent each time is nuts (e.g. I change from Mailgun to Postmark and have to ask all SaaS customers for consent). Some discussions: https://seqlegal.com/blog/article-28-gdpr-problems-processors https://seqlegal.com/blog/article-28-gdpr-problems-processor... https://seqlegal.com/blog/gdpr-sub-processors-and-authorisations https://seqlegal.com/blog/gdpr-sub-processors-and-authorisat...
- funkymike 9y ago
  > That is not how some are reading it. It's not how I've understood Article 28(2) either, though getting new consent each time is nuts (e.g. I change from Mailgun to Postmark and have to ask all SaaS customers for consent). This makes sense from the user's perspective. Maybe they trust Mailgun but do not trust Postmark. If they have explicitly agreed to you sharing their personal data with one company you shouldn't be able to start sending that customer's personal data to another company without their consent. If you sign up for my service and I ask for consent to send specific data to SecuriCo for "user analytics and tracking" I shouldn't be able to change that to sending the data to the NSA without telling you. The whole point is that the user should be in control of what businesses are doing with their personal information.