5 ms·

I'm wondering whether GDPR is going to make this worse. It used to be that the GWR train Wifi would automatically log me in. But now that has changed, and it t

I'm wondering whether GDPR is going to make this worse. It used to be that the GWR train Wifi would automatically log me in. But now that has changed, and it takes me to a pre-populated log-in screen, which requires me to untick the "Add me to the mailing list" button, and tick the "T&Cs" and "Privacy statement" buttons. I suspect that this is a GDPR hoop to show they have consent for every bit of data they use. But all I have to do is forget to untick the "Add me to your mailing list" button once...

dwighttk 9y ago
most certainly. In the way you imagine and in ways we can't even imagine now. (Things may get better in some ways, but they will get worse in others)
lmkg 9y ago
But GDPR also means you have the right to revoke consent that was previously given.
- IMTDb 9y ago
  Ain't nobody got time for that. Like the article says, there might be a way, somewhere deeply hidden in the website to revoke the consent, but do you really want to spend half an hour for that (if the button really, exists, and if it actually does anything)
  - lmkg 9y ago
    If the link is buried, that is a violation of the GDPR. Contact details for the controller and the Data Protection Officer must be given at the point where data is collected: https://gdpr-info.eu/art-13-gdpr/ https://gdpr-info.eu/art-13-gdpr/. There's also something else about an affirmative duty to facilitate exercise of rights, but that's less clear-cut. A non-functional link is also a GDPR violation. That said, I agree in general: it's a burden on me to make these websites respect my rights, and that's kinda bullshit. I either have to go through the hoops the site sets up, or I have to go through the bureaucratic hoops of the organization that judges the hoopiness of the website's hoops. But if I do care enough, there is now a stick to wield, which is an improvement.
    - Silhouette 9y ago
      Not all organisations are required to have a DPO under the GDPR.
  - icebraining 9y ago
    As anvandare pointed out in another comment, "It shall be as easy to withdraw as to give consent."
rdiddly 9y ago
GWR is to blame for that. They're seizing the opportunity presented by having one more interaction (among many) with you, to saddle that interaction with this ratchet pattern. There's nothing special about GDPR that leads inexorably to that.
Someone 9y ago
The GDPR doesn’t allow default-checked opt-in checkboxes. They aren’t “clear affirmative actions”. Article 4.11: ”'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”
- Silhouette 9y ago
  So now we have to go back to every site/service/app including unchecked but mandatory tick boxes about agreeing to their terms and privacy policy in the checkout process, thus both annoying just about everyone and potentially reducing conversion rates while making no practical difference to anything whatsoever? I guess we can file that with the "cookie" law and the consumer protection rules that say if you want to download any digital content you just bought immediately instead of waiting 14 days first then <insert scary legalese about losing a right to cancel under some law you never heard of here>. I think they're under "well intentioned but utterly lacking in practical understanding".
  - icebraining 9y ago
    Those tick boxes can only be mandatory if the data is actually needed to provide the service - the user can't be forced to allow his data to be used for marketing purposes, for example. Also, if it's obvious for what purpose the data will be used (e.g. filling in your address for delivering a package), you don't need a tick box. So there should be little need for mandatory boxes.
    - Silhouette 9y ago
      As ever with the GDPR, things are going to get subjective and you take your chances until the picture is clearer. A strict interpretation appears to be that, for example, a business that uses a customer's email address as an account ID on its web site and sends only essential messages to that email address doesn't need consent, because the legal basis for the processing is performance of a contract, but if the email address is also used for other form of communication (even if the message is genuinely relevant and something the customer would almost certainly want to receive) then that may require active consent. That could lead to a lot of places adding those checkboxes back in just to make sure they're covered, even if they aren't strictly necessary.

dwighttk 9y ago

most certainly. In the way you imagine and in ways we can't even imagine now. (Things may get better in some ways, but they will get worse in others)

lmkg 9y ago

But GDPR also means you have the right to revoke consent that was previously given.

IMTDb 9y ago
Ain't nobody got time for that. Like the article says, there might be a way, somewhere deeply hidden in the website to revoke the consent, but do you really want to spend half an hour for that (if the button really, exists, and if it actually does anything)
- lmkg 9y ago
  If the link is buried, that is a violation of the GDPR. Contact details for the controller and the Data Protection Officer must be given at the point where data is collected: https://gdpr-info.eu/art-13-gdpr/ https://gdpr-info.eu/art-13-gdpr/. There's also something else about an affirmative duty to facilitate exercise of rights, but that's less clear-cut. A non-functional link is also a GDPR violation. That said, I agree in general: it's a burden on me to make these websites respect my rights, and that's kinda bullshit. I either have to go through the hoops the site sets up, or I have to go through the bureaucratic hoops of the organization that judges the hoopiness of the website's hoops. But if I do care enough, there is now a stick to wield, which is an improvement.
  - Silhouette 9y ago
    Not all organisations are required to have a DPO under the GDPR.
- icebraining 9y ago
  As anvandare pointed out in another comment, "It shall be as easy to withdraw as to give consent."

rdiddly 9y ago

GWR is to blame for that. They're seizing the opportunity presented by having one more interaction (among many) with you, to saddle that interaction with this ratchet pattern. There's nothing special about GDPR that leads inexorably to that.

Someone 9y ago

The GDPR doesn’t allow default-checked opt-in checkboxes. They aren’t “clear affirmative actions”. Article 4.11: ”'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”

Silhouette 9y ago
So now we have to go back to every site/service/app including unchecked but mandatory tick boxes about agreeing to their terms and privacy policy in the checkout process, thus both annoying just about everyone and potentially reducing conversion rates while making no practical difference to anything whatsoever? I guess we can file that with the "cookie" law and the consumer protection rules that say if you want to download any digital content you just bought immediately instead of waiting 14 days first then <insert scary legalese about losing a right to cancel under some law you never heard of here>. I think they're under "well intentioned but utterly lacking in practical understanding".
- icebraining 9y ago
  Those tick boxes can only be mandatory if the data is actually needed to provide the service - the user can't be forced to allow his data to be used for marketing purposes, for example. Also, if it's obvious for what purpose the data will be used (e.g. filling in your address for delivering a package), you don't need a tick box. So there should be little need for mandatory boxes.
  - Silhouette 9y ago
    As ever with the GDPR, things are going to get subjective and you take your chances until the picture is clearer. A strict interpretation appears to be that, for example, a business that uses a customer's email address as an account ID on its web site and sends only essential messages to that email address doesn't need consent, because the legal basis for the processing is performance of a contract, but if the email address is also used for other form of communication (even if the message is genuinely relevant and something the customer would almost certainly want to receive) then that may require active consent. That could lead to a lot of places adding those checkboxes back in just to make sure they're covered, even if they aren't strictly necessary.