4 ms·
Like everyone else, I've been bombarded with numerous "we've updated our privacy policy" emails over the past few weeks. I'm not sure updating privacy policies
by cs702 8y ago
Like everyone else, I've been bombarded with numerous "we've updated our privacy policy" emails over the past few weeks.
I'm not sure updating privacy policies with CYA language will suffice.
The evidence suggests European regulators really want companies to change their behavior.
- vidarh 8y agoWell, I've also gotten a ton of "please, please, please confirm that we can keep sending you the e-mails we're sure you really don't want to miss" from companies I don't remember ever dealing with, which I've gleefully ignored, so it seems quite a few companies are changing their behaviour in as much as they seem to be purging their mailing lists. Even if that's all that's achieved, it'd still be a big improvement/
- neuland 8y agoI've got a ton of those too and am skeptical what they accomplish. A lot of the mailing list ones I've seen are opt-in. But, I a lot of the services ones have been "Agree or GTFO", and I don't know how doing that before GDPR drops is going to matter. From what I understand, they can't say that they have consent if it was mandatory to continue using the service.
- stephengillie 8y agoI've gotten these emails from an MFA vendor. I haven't had the time to review and agree to the new privacy policy they've provided. I'm confused about why a business would be impacted by this law, if they are only storing the login data I'm paying for them to store for me. How does the GPDR impact employee auditing requirements? How do I delete your info from my system, and still prove that you only accessed systems to which you were authorized, while you worked for me?
- bulatb 8y agoIf the company is storing Personal Data (on people in the EU) or is present in the EU, GDPR applies. They might also be complying voluntarily for various reasons. Data Subjects' rights to their data aren't absolute. If you need it for legal/compliance reasons, or legitimately need to keep it for clearly defensible reasons like auditing, preventing fraud, etc., you aren't required to delete it. But if your only legal basis for processing the data was Subject consent, and they revoke their consent, you are required to delete it. Many companies are treating mailing lists this way and/or are confused and terrified in general, so everyone is getting emails. Some companies are also adding Data Processing Agreements to their terms of service that allow them to be Data Processors for customers. Maybe your MFA vendor is one of those.
- jdietrich 8y agoMost of those e-mails are either illegal or unnecessary. If you've already opted-in to receive marketing messages, then they don't need to ask for your consent again just because GDPR is coming. If you haven't already opted-in, then the Privacy and Electronic Communications Directive only allows unsolicited messages containing marketing information related to previous purchases you have made from that company.
- sideshowb 8y agoThe requirements for consent have changed, though. For example, pre-checked checkboxes are no longer considered consent, so strictly consent has to be re-obtained if the original form contained a pre-checked consent box. Consent is not supposed to be coupled to receipt of a service either.
- ramy_d 8y agothat doesn't make sense, it would make all corporate news letters illegal unless a purchase was made.
- the_watcher 8y agoUnless you've explicitly opted in (not failed to opt out), that is exactly what GDPR does
- michaelmrose 8y agoNot if the user affirmatively chose to receive the news letter.
- lmkg 8y agoUpdating privacy policies is necessary but not sufficient. GDPR has explicit requirements for what a privacy policy must contain, as part of the Right to Transparency. I'll also say that most of the privacy policy emails I've gotten are from companies that probably don't have to change much of what they're doing except for documenting things more. I.e. online services that I pay for, as opposed to websites that try to monetize me. It's the latter category that will have to adapt much more than the former.
- kodablah 8y ago> I'm not sure [...] will suffice I think if we're being honest, nobody's sure what will suffice. Even if we pretended the legislation spelled it out in non-vague terms, what suffices is more about enforcement than codified word. Couple that with the fact that it is in vague terms and it falls even more heavily on the enforcers to define the law. Until then we wait, often while being berated by others for our confusion.
- GuiA 8y agoIt’s been interesting to see the phrasing of those emails. I feel like there’s been 2 main categories: 1) GDPR is coming, we used it as an opportunity to rethink what data we collect and what we do with it, and re evaluate our practices 2) GDPR is coming, here’s a long and confusing email that doesn’t make much clear except we think that GDPR is a pain in our neck Emails of the first kind tend to be sent by smaller outfits, while the latter tend to be sent by large companies in positions of power.
- merinowool 8y agoI just move them to bin. I wonder how many of them is fishing, so that they redirect you to fake sign in page and steal your password.
- zrm 8y ago> I wonder how many of them is fishing, so that they redirect you to fake sign in page and steal your password. Or spammers trying to verify that your email address is active. Presumably the spammers can charge more for verified targets.
- djhworld 8y agoI usually ignore them too, however I found one recruitment agency send me a mail saying that no reply/action is 'assumed consent' for them to keep my data. So I'm having to impose an annoying level of extra scrutiny on these mailings to make sure no other company is throwing the no action == assumed consent excuse