3 ms·

Many grocery stores offer memberships where they offer customers discounts in exchange for the customers using an ID to help the store track their purchases. S

Many grocery stores offer memberships where they offer customers discounts in exchange for the customers using an ID to help the store track their purchases. Such arrangements appear to be voluntary and desirable for both consumers and stores. Would such an arrangement fly under the GDPR? It would seem that if consent has to be freely given, and not conditioned on something like a cheaper price, then the GDPR would not allow the grocery stores to give discounts only to people who agreed to the membership and tracking.

PeterisP 8y ago
Yes, there are a bunch of problems with that business model now. 1. GDPR prohibits "bundling" of consent. Usage of your private data for, say, physically making a membership card should have separate consent than using that same data for tracking you; the fact that you want membership (and consent to it) cannot imply that you must also want tracking. 2. GDPR requests that you must be able to withdraw consent without detriment. That ties in directly to cheaper price. 3. In general, GDPR declares that permission to use your data is not something that can be "traded away" in a contract, that privacy is a core right and thus you can't enter into a voluntary contract saying, for example "I give Bob $5, Bob allows me to use his data" - or, more exactly, you may sign the contract, but the clause that gives permission to use data would automatically be null and void, and Bob could revoke consent without detriment anyway. Exactly as it is with binding arbitration and many other clauses in consumer contracts; in EU there are many aspects that can't really be given away in voluntary contracts - as far as I understand, common law has a bit different approach and tradition regarding contracts in this aspect than civil law in core EU countries, EU law doesn't shy away from regulating what a contract may include (or what can be binding if included) even if both parties agree to it.
- ddlatham 8y ago
  That seems unfortunate for businesses like those grocery stores, and for their consumers.
  - PeterisP 8y ago
    IMHO we'll be seeing a switch to pseudonymous/anonymous purchase tracking instead of all these 'loyalty cards'; it's a bit more tricky and a bit less useful, but it can be powerful anyway and get most of the analysis results you'd want.

PeterisP 8y ago

Yes, there are a bunch of problems with that business model now. 1. GDPR prohibits "bundling" of consent. Usage of your private data for, say, physically making a membership card should have separate consent than using that same data for tracking you; the fact that you want membership (and consent to it) cannot imply that you must also want tracking. 2. GDPR requests that you must be able to withdraw consent without detriment. That ties in directly to cheaper price. 3. In general, GDPR declares that permission to use your data is not something that can be "traded away" in a contract, that privacy is a core right and thus you can't enter into a voluntary contract saying, for example "I give Bob $5, Bob allows me to use his data" - or, more exactly, you may sign the contract, but the clause that gives permission to use data would automatically be null and void, and Bob could revoke consent without detriment anyway. Exactly as it is with binding arbitration and many other clauses in consumer contracts; in EU there are many aspects that can't really be given away in voluntary contracts - as far as I understand, common law has a bit different approach and tradition regarding contracts in this aspect than civil law in core EU countries, EU law doesn't shy away from regulating what a contract may include (or what can be binding if included) even if both parties agree to it.

ddlatham 8y ago
That seems unfortunate for businesses like those grocery stores, and for their consumers.
- PeterisP 8y ago
  IMHO we'll be seeing a switch to pseudonymous/anonymous purchase tracking instead of all these 'loyalty cards'; it's a bit more tricky and a bit less useful, but it can be powerful anyway and get most of the analysis results you'd want.