4 ms·

Requiring consent as a pre-condition of a service is frowned upon under GDPR. If you have a legitimate requirement (which is fairly rigidly defined under GDPR)

Requiring consent as a pre-condition of a service is frowned upon under GDPR. If you have a legitimate requirement (which is fairly rigidly defined under GDPR) or legal obligations for that data then you don’t need user consent, but if you don’t then you need to offer the service regardless of the user consent or not.

yread 8y ago
I think that's where the wiggle room (or court battleground?) of GDPR will be. Lots of companies do that: Quora, Pinterest,...
- tobltobs 8y ago
  There will be years of battles in court how to interpret the GDPR, but not for this. > (Article 4 ) ‘consent’ of the data subject means any freely given, ... > Recital 42: Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. > Article 7: 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
- woolvalley 8y ago
  I think quora and co is more about having an account and not about any sort of data consent per say.
  - ColonelPhantom 8y ago
    Making an account is generally seen as a form of giving consent, especially as you need to agree to the terms and conditions when doing so.
    - zerostar07 8y ago
      you can make an account and still not consent, e.g. to be tracked because they can't prove that 'being tracked is necessary for reading quora'. the two are orthogonal
    - taysic 8y ago
      You have to be very explicit and clear about what you data you are handing over in GDPR and how it will be used. Making an account usually does not have that information. Additionally, you need to give a person an option to not hand over that data and still use your app/site 'without detriment' unless that data was essential to your tool.
Cthulhu_ 8y ago
Techcrunch isn't an European company though, and IIRC they have no obligation to serve European customers so a "wall" is probably allowed. Even if it was european, I don't think the GDPR makes websites obligated to be accessible for everyone.
- icebraining 8y ago
  They are not European, but they have European "partners" (read: advertisers and ad-networks) siphoning off data from their EU users. They are not just a site that happens to be available to the EU.
dragonwriter 8y ago
> Requiring consent as a pre-condition of a service is frowned upon under GDPR. No, it's not. Requiring extraneous consent as a precondition of service, that is, requiring consent for some processing as a precondition of provision of a service that does not depend on that processing is an indication that consent is coerced rather than freely given, and hence not effective consent, under the GDPR. But what that means on concrete terms with complex interdependent services (and whether it is a de facto ban on such services, because instead extremely granular services and granular consent is required) remains to be clarified, probably through practical enforcement. If one views, for instance, what Facebook was offering pre-GDPR as a service, then “consent for what the service entails or no service” is not extraneous consent. If you view it as a cluster of distinct services, that becomes different. Whether the monetisation model of “free” services is essential or not is another question, and it's quite possible that GDPR will result in a lot fewer free-of-charge services available in the EU.
- icebraining 8y ago
  Requiring extraneous consent as a precondition of service, that is, requiring consent for some processing as a precondition of provision of a service that does not depend on that processing is an indication that consent is coerced rather than freely given, and hence not effective consent, under the GDPR. But if the service does depend on that processing, then you don't need to ask for consent at all, so why would you? In practice, the statement is true.
  - IshKebab 8y ago
    You still need to ask for consent.
    - icebraining 8y ago
      "If the processing is necessary for a contract with the individual, processing is lawful on this basis and you do not need to get separate consent." https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/contract/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

yread 8y ago

I think that's where the wiggle room (or court battleground?) of GDPR will be. Lots of companies do that: Quora, Pinterest,...

tobltobs 8y ago
There will be years of battles in court how to interpret the GDPR, but not for this. > (Article 4 ) ‘consent’ of the data subject means any freely given, ... > Recital 42: Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. > Article 7: 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
woolvalley 8y ago
I think quora and co is more about having an account and not about any sort of data consent per say.
- ColonelPhantom 8y ago
  Making an account is generally seen as a form of giving consent, especially as you need to agree to the terms and conditions when doing so.
  - zerostar07 8y ago
    you can make an account and still not consent, e.g. to be tracked because they can't prove that 'being tracked is necessary for reading quora'. the two are orthogonal
  - taysic 8y ago
    You have to be very explicit and clear about what you data you are handing over in GDPR and how it will be used. Making an account usually does not have that information. Additionally, you need to give a person an option to not hand over that data and still use your app/site 'without detriment' unless that data was essential to your tool.

Cthulhu_ 8y ago

Techcrunch isn't an European company though, and IIRC they have no obligation to serve European customers so a "wall" is probably allowed. Even if it was european, I don't think the GDPR makes websites obligated to be accessible for everyone.

icebraining 8y ago
They are not European, but they have European "partners" (read: advertisers and ad-networks) siphoning off data from their EU users. They are not just a site that happens to be available to the EU.

dragonwriter 8y ago

> Requiring consent as a pre-condition of a service is frowned upon under GDPR. No, it's not. Requiring extraneous consent as a precondition of service, that is, requiring consent for some processing as a precondition of provision of a service that does not depend on that processing is an indication that consent is coerced rather than freely given, and hence not effective consent, under the GDPR. But what that means on concrete terms with complex interdependent services (and whether it is a de facto ban on such services, because instead extremely granular services and granular consent is required) remains to be clarified, probably through practical enforcement. If one views, for instance, what Facebook was offering pre-GDPR as a service, then “consent for what the service entails or no service” is not extraneous consent. If you view it as a cluster of distinct services, that becomes different. Whether the monetisation model of “free” services is essential or not is another question, and it's quite possible that GDPR will result in a lot fewer free-of-charge services available in the EU.

icebraining 8y ago
Requiring extraneous consent as a precondition of service, that is, requiring consent for some processing as a precondition of provision of a service that does not depend on that processing is an indication that consent is coerced rather than freely given, and hence not effective consent, under the GDPR. But if the service does depend on that processing, then you don't need to ask for consent at all, so why would you? In practice, the statement is true.
- IshKebab 8y ago
  You still need to ask for consent.
  - icebraining 8y ago
    "If the processing is necessary for a contract with the individual, processing is lawful on this basis and you do not need to get separate consent." https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/contract/ https://ico.org.uk/for-organisations/guide-to-the-general-da...