3 ms·

I believe the GDPR only forbids denying access to users' data if they don't opt-in (Art. 15), and that's why Facebook has the options to either - accept ToS an

by lainga 8y ago

I believe the GDPR only forbids denying access to users' data if they don't opt-in (Art. 15), and that's why Facebook has the options to either - accept ToS and use Facebook, or - deny ToS, download user data and delete account (under 'More options'). https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/

KozmoNau7 8y ago
No, because this ToS thing is not actually a GDPR-compliant opt-in. It's a routine ToS update, with a few tracking things tacked at the end of it. Companies have always been able to deny users access if they don't accept a ToS, but clicking "I Accept" to the ToS shown in the screenshots is not a GDPR opt-in, and I cannot stress that enough. It is just a ToS update, which does not cover GDPR-compliant opt-in to tracking. The tracking questions following it are also not GDPR-compliant. They will have to ask properly for opt-in when the 25th rolls around, or they will face fines for non-compliance. FB is trying to muddy the waters with this ToS update, probably to fool people into thinking "well, I already accepted a bunch of stuff a couple of weeks ago, I'll just accept this GDPR thing as well". It seems that you've bought in to their misinformation campaign. The GDPR stipulates that you cannot make access to your service contingent on opting in to tracking, unless you service cannot possibly function without tracking. Strava would be a good example, it cannot possibly work without tracking a user's GPS location. But FB works just fine with no tracking at all. The only thing that would be compromised is be FB's business model, and that's just tough luck, they'll have to come up with something better, a model that doesn't infringing on people's privacy. Source: I work for a telco/ISP and we are extremely aware of GDPR and the consequences, and we've been working diligently for ~2 years to make our entire business GDPR-compliant. Training courses and tests of our understanding of the rules are mandatory for everyone, from customer support to CEO.
- lainga 8y ago
  I originally was of your mindset as well (FB is in breach of compliance right now) but could not find any mention in the GDPR articles or recitals of "denial of access", "availability", etc. to back my views up. I would tend to agree with you if I could find a source for the stipulation in your 6th paragraph.
  - deleted 8y ago
    [deleted]
  - deleted 8y ago
    [deleted]
  - KozmoNau7 8y ago
    "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1. See Recital 42’s reference to “without detriment”, Recital 43’s discussion of “freely given” consent, and Article 7(2) prohibition of conditionality. See also the UK Information Commissioner’s Office’s draft guidance on consent, 31 March 2017, p. 21, which clearly prohibits so-called “tracking walls”."

by lainga 8y ago

KozmoNau7 8y ago

No, because this ToS thing is not actually a GDPR-compliant opt-in. It's a routine ToS update, with a few tracking things tacked at the end of it. Companies have always been able to deny users access if they don't accept a ToS, but clicking "I Accept" to the ToS shown in the screenshots is not a GDPR opt-in, and I cannot stress that enough. It is just a ToS update, which does not cover GDPR-compliant opt-in to tracking. The tracking questions following it are also not GDPR-compliant. They will have to ask properly for opt-in when the 25th rolls around, or they will face fines for non-compliance. FB is trying to muddy the waters with this ToS update, probably to fool people into thinking "well, I already accepted a bunch of stuff a couple of weeks ago, I'll just accept this GDPR thing as well". It seems that you've bought in to their misinformation campaign. The GDPR stipulates that you cannot make access to your service contingent on opting in to tracking, unless you service cannot possibly function without tracking. Strava would be a good example, it cannot possibly work without tracking a user's GPS location. But FB works just fine with no tracking at all. The only thing that would be compromised is be FB's business model, and that's just tough luck, they'll have to come up with something better, a model that doesn't infringing on people's privacy. Source: I work for a telco/ISP and we are extremely aware of GDPR and the consequences, and we've been working diligently for ~2 years to make our entire business GDPR-compliant. Training courses and tests of our understanding of the rules are mandatory for everyone, from customer support to CEO.

lainga 8y ago
I originally was of your mindset as well (FB is in breach of compliance right now) but could not find any mention in the GDPR articles or recitals of "denial of access", "availability", etc. to back my views up. I would tend to agree with you if I could find a source for the stipulation in your 6th paragraph.
- deleted 8y ago
  [deleted]
- deleted 8y ago
  [deleted]
- KozmoNau7 8y ago
  "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1. See Recital 42’s reference to “without detriment”, Recital 43’s discussion of “freely given” consent, and Article 7(2) prohibition of conditionality. See also the UK Information Commissioner’s Office’s draft guidance on consent, 31 March 2017, p. 21, which clearly prohibits so-called “tracking walls”."