4 ms·

Why don't you put a privacy policy explaining this in your blog? As long as you ensure 'lawfulness, fairness and transparency', you can easily be "GDPR-complian

by adulau 8y ago

Why don't you put a privacy policy explaining this in your blog? As long as you ensure 'lawfulness, fairness and transparency', you can easily be "GDPR-compliant". Keep a record of your processing activities (e.g. MailChimp is data processor and your are the data controller) and a quick note about the risk associated.

tibu 8y ago
It isn't enough anymore to put this into a PP. If the subscribers did not gave consent for this it cannot be tracked (at least I think).
- adulau 8y ago
  If a data-subject subscribes to a mailing-list by giving your email and you have a "request for consent shall be presented in a manner which is clearly distinguishable from the other matters" which can be clearly describe in your privacy policy, you are totally inline with the article 7 for the condition of consents.
- DanBC 8y ago
  Consent is only one reason for data handling. There are others. Consent doesn't always need to be given. https://twitter.com/bainesy1969/status/995370110587154433 https://twitter.com/bainesy1969/status/995370110587154433
  - stingraycharles 8y ago
    Only if it is strictly necessary in order to conduct business, and no longer than that. E.g. using cookies for managing a session’s shopping cart. Obviously tracking emails for marketing purposes is not allowed.
    - adulau 8y ago
      Tracking emails for marketing purposes can be seen as a legitimate interest. As long, it's describe to the data-subject and they give their consent, it's allowed. Recital 48 is giving some explanation: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
      - stingraycharles 8y ago
        I really think the answer to this question at the moment depends upon the person asking. All I read in recital 48 is that PII might be shared within a group of companies that fall under the same holding. IANAL, but I spent the past 2 years as CTO of an EU-based analytics company becoming compliant with GDPR, and consider myself quite informed on the topic. I would tread more carefully than what you are suggesting.
hispanic 8y ago
I appreciate the thought, but I don’t see how that complies with either the spirit or the wording of the GDPR. One of the goals of the GDPR is for data controllers to obtain explicit consent that is rather granular in nature - aligned with the purposes for each data collection. In the case of me providing a form allowing people to subscribe to my blog, the ostensible (and stated) purpose of me collecting their email address is so I can send them emails notifying them when I post a new article. But, if I’m also using their email addresses to track their interaction with my emails, that’s a distinct and separate purpose to which they never consented. More info: https://www.gdpreu.org/compliance/email-tracking/ https://www.gdpreu.org/compliance/email-tracking/ Embedding implied consent to such tracking in a separate document (privacy policy) does not seem to be very transparent. What am I misunderstanding?
- adulau 8y ago
  I think it's more easy. When they subscribe to your blog, you should include the aspect that the data processor (handling the email) do some additional tracking in order to pursue a specific service. Regarding the consent (article 7 of the GDPR), provide a clear description why you do tracking and the objective. The transparency aspect is very important. PS: It's usually better to have a look at the GDPR on the official website of EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
  - deleted 8y ago
    [deleted]
  - hadrien01 8y ago
    You would still need to ask specifically for opt-in for that tracking, because it is not essential to the "service" (the newsletter).
    - hispanic 8y ago
      And yet, amongst all of the privacy policy update emails I've received of late, I haven't been explicitly asked to consent to email tracking.

by adulau 8y ago

tibu 8y ago

It isn't enough anymore to put this into a PP. If the subscribers did not gave consent for this it cannot be tracked (at least I think).

adulau 8y ago
If a data-subject subscribes to a mailing-list by giving your email and you have a "request for consent shall be presented in a manner which is clearly distinguishable from the other matters" which can be clearly describe in your privacy policy, you are totally inline with the article 7 for the condition of consents.
DanBC 8y ago
Consent is only one reason for data handling. There are others. Consent doesn't always need to be given. https://twitter.com/bainesy1969/status/995370110587154433 https://twitter.com/bainesy1969/status/995370110587154433
- stingraycharles 8y ago
  Only if it is strictly necessary in order to conduct business, and no longer than that. E.g. using cookies for managing a session’s shopping cart. Obviously tracking emails for marketing purposes is not allowed.
  - adulau 8y ago
    Tracking emails for marketing purposes can be seen as a legitimate interest. As long, it's describe to the data-subject and they give their consent, it's allowed. Recital 48 is giving some explanation: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
    - stingraycharles 8y ago
      I really think the answer to this question at the moment depends upon the person asking. All I read in recital 48 is that PII might be shared within a group of companies that fall under the same holding. IANAL, but I spent the past 2 years as CTO of an EU-based analytics company becoming compliant with GDPR, and consider myself quite informed on the topic. I would tread more carefully than what you are suggesting.

hispanic 8y ago

I appreciate the thought, but I don’t see how that complies with either the spirit or the wording of the GDPR. One of the goals of the GDPR is for data controllers to obtain explicit consent that is rather granular in nature - aligned with the purposes for each data collection. In the case of me providing a form allowing people to subscribe to my blog, the ostensible (and stated) purpose of me collecting their email address is so I can send them emails notifying them when I post a new article. But, if I’m also using their email addresses to track their interaction with my emails, that’s a distinct and separate purpose to which they never consented. More info: https://www.gdpreu.org/compliance/email-tracking/ https://www.gdpreu.org/compliance/email-tracking/ Embedding implied consent to such tracking in a separate document (privacy policy) does not seem to be very transparent. What am I misunderstanding?

adulau 8y ago
I think it's more easy. When they subscribe to your blog, you should include the aspect that the data processor (handling the email) do some additional tracking in order to pursue a specific service. Regarding the consent (article 7 of the GDPR), provide a clear description why you do tracking and the objective. The transparency aspect is very important. PS: It's usually better to have a look at the GDPR on the official website of EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
- deleted 8y ago
  [deleted]
- hadrien01 8y ago
  You would still need to ask specifically for opt-in for that tracking, because it is not essential to the "service" (the newsletter).
  - hispanic 8y ago
    And yet, amongst all of the privacy policy update emails I've received of late, I haven't been explicitly asked to consent to email tracking.