5 ms·

I still don't see why not. Maybe it's what GDPR says, but it's wrong and I can't see this being enforced. If data collection is the "payment" for using the "ser

I still don't see why not. Maybe it's what GDPR says, but it's wrong and I can't see this being enforced. If data collection is the "payment" for using the "service", you have two choices: you don't pay and don't use the service, or you pay up. This is like saying a business can't make usage of a service conditional to payment.

icebraining 8y ago
"In the EU, personal information cannot be conceived as a mere economic asset: according to the case law of the European Court of Human Rights, the processing of personal data requires protection to ensure a person's enjoyment of the right to respect for private life and freedom of expression and association". https://edps.europa.eu/sites/edp/files/publication/16-09-23_bigdata_opinion_en.pdf https://edps.europa.eu/sites/edp/files/publication/16-09-23_...
- adventured 8y ago
  Which is another way of saying that people in the EU do not have the right of ownership over their own lives or property, including their data - that the State owns it and dictates what may be done with it. Terrifying. It's funny though, to watch everyone talk about how people should own their data in these threads. And there's the EU proclaiming plainly that you in fact do not own your data and may not do with it as you wish.
  - VonGallifrey 8y ago
    How did you get that impression. When I read this I get a completely different meaning from it. The State does not own my live or property and they are also not dictating what I can do with it. They are dictating that no one else can do what they want with MY live, property or data without my explicit consent. The state can not give consent to my data: only I can.
    - icebraining 8y ago
      adventured is saying that the State removed your possibility of using your data as payment, since now you can't consent if it's a condition of use of the service. Or to put it another way: the problem with inalienable rights is that you can't alienate them :)
deleted 8y ago
[deleted]
valesco 8y ago
This is a uniquely American point of view on a European law though.
- repolfx 8y ago
  Businesses that make money off advertising are found all over the world, which is a bigger place than just America and the EU.
  - gpvos 8y ago
    You can have advertising without user tracking.
  - valesco 8y ago
    But considering everything as a means to make money is American. Everything, including what is considered as a human right in Europe, that is.
worble 8y ago
The point is that the user should be given the choice. In this scenario, your consent is automatically assumed as given despite not even being given the chance to say no. Maybe I don't want to use your site if you want to collect my data, and I would rather leave before you do so.
jkaplowitz 8y ago
I think they're intentionally putting severe restrictions on business models that are built around paying for a consumer service by analyzing and sharing consumers' personal data instead of taking money. You're viewing this as a bug in the law; Europe views this as a feature. There are certainly cases where one can make access to the service conditional on consent: for example, if the service is to analyze your resume/CV and give you feedback on improving it, or even job leads based on it, of course you'll need to consent to them collecting and processing the personal information on your resume. But you probably don't have to consent to them selling that data or using it to target you with ads going forward. They don't want that business model to be easily and broadly viable in Europe.
bryanrasmussen 8y ago
I believe you can still store non-personally identifying information, that is to say if you cannot store that User X is a male of 40 years of age and that user x read the article, you can still store that a male of 40 years of age read the article. Probably you don't know User X gender and age under those conditions though. But assume you have to store some personal information about User X and you do know gender as part of it. Or have code to derive gender at data saving time (This part is tricky by my reading, you have to be able to sort of sandbox the ways that you can get personally identifying info out so that you can show regulatory agencies that you're not pulling it out to do stuff you shouldn't. If you're pulling it out to enrich data before saving, but that data is still not personally identifying the user I think it is probably ok (I'm on shaky ground on this part) User X as a user of service with login has to allow you to keep their login information or service cannot function. User X says you cannot save my reading history, meaning it cannot be associated with them. But at the time of reading it you save reading activity (this example is of course contrived and silly) - userType: 'requestAnonymous', haslogin: true, age: deriveLikelyAge(User), gender: returnLikelyGender(User), articleId: current.articleId and so on and so forth. You still have quite a lot of valuable analytics, and you do have some other analytics about the user that has to be saved anyway - which is they have opted out of data collection schemes 1, and 3, but not 2,4,5.
Sharlin 8y ago
Not all contracts are legal, not in any jurisdiction. The EU has taken the viewpoint that privacy is such a fundamental thing that you cannot be expected to forfeit it without limitation as a ”payment” for a service.
bryanrasmussen 8y ago
If privacy is a right it might be that in some legal systems you are not allowed to give up your rights, at least not in perpetuity.

icebraining 8y ago

"In the EU, personal information cannot be conceived as a mere economic asset: according to the case law of the European Court of Human Rights, the processing of personal data requires protection to ensure a person's enjoyment of the right to respect for private life and freedom of expression and association". https://edps.europa.eu/sites/edp/files/publication/16-09-23_bigdata_opinion_en.pdf https://edps.europa.eu/sites/edp/files/publication/16-09-23_...

adventured 8y ago
Which is another way of saying that people in the EU do not have the right of ownership over their own lives or property, including their data - that the State owns it and dictates what may be done with it. Terrifying. It's funny though, to watch everyone talk about how people should own their data in these threads. And there's the EU proclaiming plainly that you in fact do not own your data and may not do with it as you wish.
- VonGallifrey 8y ago
  How did you get that impression. When I read this I get a completely different meaning from it. The State does not own my live or property and they are also not dictating what I can do with it. They are dictating that no one else can do what they want with MY live, property or data without my explicit consent. The state can not give consent to my data: only I can.
  - icebraining 8y ago
    adventured is saying that the State removed your possibility of using your data as payment, since now you can't consent if it's a condition of use of the service. Or to put it another way: the problem with inalienable rights is that you can't alienate them :)

deleted 8y ago

[deleted]

valesco 8y ago

This is a uniquely American point of view on a European law though.

repolfx 8y ago
Businesses that make money off advertising are found all over the world, which is a bigger place than just America and the EU.
- gpvos 8y ago
  You can have advertising without user tracking.
- valesco 8y ago
  But considering everything as a means to make money is American. Everything, including what is considered as a human right in Europe, that is.

worble 8y ago

The point is that the user should be given the choice. In this scenario, your consent is automatically assumed as given despite not even being given the chance to say no. Maybe I don't want to use your site if you want to collect my data, and I would rather leave before you do so.

jkaplowitz 8y ago

I think they're intentionally putting severe restrictions on business models that are built around paying for a consumer service by analyzing and sharing consumers' personal data instead of taking money. You're viewing this as a bug in the law; Europe views this as a feature. There are certainly cases where one can make access to the service conditional on consent: for example, if the service is to analyze your resume/CV and give you feedback on improving it, or even job leads based on it, of course you'll need to consent to them collecting and processing the personal information on your resume. But you probably don't have to consent to them selling that data or using it to target you with ads going forward. They don't want that business model to be easily and broadly viable in Europe.

bryanrasmussen 8y ago

I believe you can still store non-personally identifying information, that is to say if you cannot store that User X is a male of 40 years of age and that user x read the article, you can still store that a male of 40 years of age read the article. Probably you don't know User X gender and age under those conditions though. But assume you have to store some personal information about User X and you do know gender as part of it. Or have code to derive gender at data saving time (This part is tricky by my reading, you have to be able to sort of sandbox the ways that you can get personally identifying info out so that you can show regulatory agencies that you're not pulling it out to do stuff you shouldn't. If you're pulling it out to enrich data before saving, but that data is still not personally identifying the user I think it is probably ok (I'm on shaky ground on this part) User X as a user of service with login has to allow you to keep their login information or service cannot function. User X says you cannot save my reading history, meaning it cannot be associated with them. But at the time of reading it you save reading activity (this example is of course contrived and silly) - userType: 'requestAnonymous', haslogin: true, age: deriveLikelyAge(User), gender: returnLikelyGender(User), articleId: current.articleId and so on and so forth. You still have quite a lot of valuable analytics, and you do have some other analytics about the user that has to be saved anyway - which is they have opted out of data collection schemes 1, and 3, but not 2,4,5.

Sharlin 8y ago

Not all contracts are legal, not in any jurisdiction. The EU has taken the viewpoint that privacy is such a fundamental thing that you cannot be expected to forfeit it without limitation as a ”payment” for a service.

bryanrasmussen 8y ago

If privacy is a right it might be that in some legal systems you are not allowed to give up your rights, at least not in perpetuity.