4 ms·

I think an important point that the GDPR gets right is to recognize that you often need to give data to services in order for them to be useful, but you current

by m12k 9y ago

I think an important point that the GDPR gets right is to recognize that you often need to give data to services in order for them to be useful, but you currently have almost no recourse if you stop using it and don't want that data 'out there' any more. Even just the data limited data that services can 'reasonably' need will still paint a very detailed picture of you in aggregate. Forcing companies to allow users to recall consent and actually get their data deleted is the only way to prevent that picture from becoming very detailed over time.

evrydayhustling 9y ago
Yes, this, and a second part: GDPR recognizes that data moves between services, and people should have rights about their data that can be enforced on recipients after data is transferred. Currently, agreeing to transfer is a ratchet, where the secondhand party has basically no responsibility to you.
sgc 9y ago
Is there a way to flag yourself as a consumer who always requires personal data deleted when you cancel a service, or is it opt-in on a case by case basis only?
- Someone 9y ago
  That’s neither opt-in nor opt-out, but stronger. Companies only may have data they need for doing their business. If you cancel a service, accounting and similar laws may dictate a company has to keep your address and payment info for a couple of years, but that’s about it (this actually is covered by the implementation of the “data protection directive”, the precursor to the GDPR, which has been in effect since at least 1-1-1999. See https://en.m.wikipedia.org/wiki/Data_Protection_Directive#Legitimate_purpose https://en.m.wikipedia.org/wiki/Data_Protection_Directive#Le...) Student clubs (yes, the GDPR applies to them, too, even if they are 100% volunteer run) that want to keep address info of past members for communicating with alumni, for example, have to make that opt-in. “necessary for running the business” has some gray areas. For example, an athletics club will want to keep a list of club records, photos of past victories, etc. That’s something that is allowed as “necessary for being a sports club”. I don’t know whether there’s any case history on this)
- e12e 9y ago
  Essentially the GDPR does this. Barring some explicit opt-in to the contrary, or other laws that take precedence (such as book-keeping).

by m12k 9y ago

evrydayhustling 9y ago

Yes, this, and a second part: GDPR recognizes that data moves between services, and people should have rights about their data that can be enforced on recipients after data is transferred. Currently, agreeing to transfer is a ratchet, where the secondhand party has basically no responsibility to you.

sgc 9y ago

Is there a way to flag yourself as a consumer who always requires personal data deleted when you cancel a service, or is it opt-in on a case by case basis only?

Someone 9y ago
That’s neither opt-in nor opt-out, but stronger. Companies only may have data they need for doing their business. If you cancel a service, accounting and similar laws may dictate a company has to keep your address and payment info for a couple of years, but that’s about it (this actually is covered by the implementation of the “data protection directive”, the precursor to the GDPR, which has been in effect since at least 1-1-1999. See https://en.m.wikipedia.org/wiki/Data_Protection_Directive#Legitimate_purpose https://en.m.wikipedia.org/wiki/Data_Protection_Directive#Le...) Student clubs (yes, the GDPR applies to them, too, even if they are 100% volunteer run) that want to keep address info of past members for communicating with alumni, for example, have to make that opt-in. “necessary for running the business” has some gray areas. For example, an athletics club will want to keep a list of club records, photos of past victories, etc. That’s something that is allowed as “necessary for being a sports club”. I don’t know whether there’s any case history on this)
e12e 9y ago
Essentially the GDPR does this. Barring some explicit opt-in to the contrary, or other laws that take precedence (such as book-keeping).