5 ms·

Hmm, I thought that too. I assumed that all banks, cell phone operators, etc. that I use would have to ask me for consent to sell my data, track me. But that d

Hmm, I thought that too. I assumed that all banks, cell phone operators, etc. that I use would have to ask me for consent to sell my data, track me. But that did not happen, they just send a note with all those GDPR information what they do with my data and that they have a good news for me: I don't have to do anything, as all my "agreements" are still valid without any action from my side. They haven't given me an option to give consent for, say, calling me, but don't give consent for tracking and profiling. Looks like this is ok, unless Orange got GDPR wrongly and wants to risk fines but I don't believe that. One of the biggest Polish news portal (wp dot pl) has figure out the fantastic idea - they show a banner with a long, long text, that says at the end that if I close that banner, clicking on X button, I am automatically give them permission to track me and do virtually whatever they want with my data. If I don't agree for their terms and I don't close the banner (which is agreement as well) I am taken to "advanced settings" page that at the end gives me only one option - to agree for tracking and all the shady stuff they want to do with my data. It is impossible to enter their portal without agreeing for everything they want. WP dot PL is a big business owned by a big German media company, so I guess they figured out everything correctly, apparently the regulation has a lot of loopholes and anyone with smart lawyers can overcome GDPR easily.

Doxin 8y ago
The "agree by closing this popup" tactic is, as far as I can tell, not allowed under GDPR. Here's hoping all the companies that do that get slapped with a fine.
- Brotkrumen 8y ago
  This forever popup unless you accept should run afoul of the language in GDPR that forbids the degradation of a service if a user does not opt in.
- jbrooksuk 8y ago
  Likewise "by continuing to browse this website, you agree" implied consent is no longer allowed.
- zingmars 8y ago
  They won't be. They will be first be notified and then fined if they refuse to comply.
simias 8y ago
I would be curious to hear how this pattern could be considered to conform to the GDPR. From what I understand it has to be opt-in. I don't speak polish but I went on the website you're talking about using Google translate and indeed I can't see any way to refuse to give them my info. The "if you click X you agree" bit is probably the shadiest of them all.
- jocro 8y ago
  EDIT: Didn't realize you were referring specifically to the sneaky pop-up. Agree with you on that one. From a brief reading of it the other day, it seems data that is necessary to provide a contracted service (like, say, providing access to a cellular network) has a specific exemption to express consent. Check out items 1a & 1b in Article 6 of Chapter 2[1]: "1Processing shall be lawful only if and to the extent that at least one of the following applies: A: the data subject has given consent to the processing of his or her personal data for one or more specific purposes; B: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;" [1]https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
  - e12e 8y ago
    Re: your second point: cellular providers will "automatically" get to track you in real time for the purpose of cell tower hand-over etc. They do not automatically get to keep that data forever, or sell it to a third party. According to how I read the GDPR - I'm not a lawyer ; this is not legal advice, etc.
    - icebraining 8y ago
      Yes, it's specified in Recital 50: https://gdpr-info.eu/recitals/no-50/ https://gdpr-info.eu/recitals/no-50/
      - e12e 8y ago
        Yes... What? I'm not sure I understand what you're saying?
gchadwick 8y ago
> apparently the regulation has a lot of loopholes and anyone with smart lawyers can overcome GDPR easily I think time will tell on that one. It's hard to say how well currently attempted loopholes actually work until they've been tested in court. As for wp dot pl nothing stopping you from avoiding the site altogether. Yes it's frustrating they insist on tracking you and selling your data as their only business model but at least they have to tell you up-front about it now so you can avoid the site (and have them delete all data they hold on you) if you do not want them doing this. Edit: though from re-reading your post and the replies sounds like wp dot pl aren't doing things right and need to be more up-front about what you're agreeing to.
ColinWright 8y ago
I've had two companies do that to me. Today I've sent a request for all my data, and included a note that they appear not to be complying with the legislation. I add that I will check again in a week, and will consider reporting them to the appropriate authorities. I doubt it will have much effect, and I'm only doing this to companies I don't mind being cut off from, but it's a start, and I hope more people start to take seriously their legitimate rights.
krageon 8y ago
"I guess they figured out everything correctly" You guess wrong. The situation you described does not comply with the GDPR. Report them to the legislative agency that handles these things in your region - if they're a big target they will be high up on the list of companies being audited.
- deanCommie 8y ago
  Slate is doing this too - full page block of the site with only a single "Agree" button to click. No customization or opt out: Slate’s Use of Your Data By clicking “Agree,” you consent to Slate’s Terms of Service and Privacy Policy and the use of technologies such as cookies by Slate and our partners to deliver relevant advertising on our site, in emails and across the Internet, personalize content and perform site analytics. Please see our Privacy Policy for more information about our use of data, your rights, and how to withdraw consent. The terms of service is https://slate.com/terms https://slate.com/terms The privacy is https://slate.com/privacy https://slate.com/privacy Oh sure, there are some links like "Opt-out from data use". Which are just...mailto links to gdpr@slate.com
yulaow 8y ago
They MUST give you an option to retire consent at anytime, even after you gave it willingly (or not), this is an explicit requirement of the GDPR
lol-lol 8y ago
The only problem with this Polish news portal is that they will get warning and then got punished if they dont comply so this is not "fantastic idea". What they are doing is direct violation of GDPR and a really bad idea. There was a complaint filled this morning agains Google, Facebook, Whatsapp and Instagram doing something similar but to lesser extent. https://noyb.eu https://noyb.eu I just cant understand why is everyone trying to push all its intelectual power into trying to workaround GDPR instead of trying to comply, for most website it is trivial as they are in breach of GDPR just becoase they collect the data they dont need.
- TeMPOraL 8y ago
  > I just cant understand why is everyone trying to push all its intelectual power into trying to workaround GDPR Because they make lots of money on user-hostile practices, and they want to find a way to keep this profit source.
- Isinlor 8y ago
  GDPR doesn't require consent for data processing. Seems like they claim that they base the data processing on: 1. contract about delivering services between you and them 2. profiling is based on a legitimate interest of their administration 3. sending data to third parties based on consent The way they write it I would call "Polish legalese", so I'm quite confident it was written very carefully by a lawyer and they know it is sketchy. BTW I really recommend reading "Guidelines on Consent under [GDPR]" by Article 29 Working Pary, an EU body established by the previous directive. It's written in simple language with examples of what is valid consent. And how regulators think about it. http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=623051 http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_...
  - lol-lol 8y ago
    I am sorry but you are wrong. Legitimate interest is so wrongly understood. You can only use it if your business is not able to function without some PI and for nothing else. For example if you are having an online store, it is perfectly ok to require name and address as you cant deliver goods to the customer without it. The phone number is already fishy (if you already have another mean to communicate). Using 3rd party by default that is doing monitoring/tracking is a no go, you cant put it under the legitimate interest. And you cant force user to give you a consent by denying access as this is violating that it has to be given free. You will get a consent this way but it will be invalidated in case someone complains to ICO and then you have troubles. And I have talked to our ICO in person. And Google already got a complain. So did facebook and instagram and whatsapp. I think that persons that were saying that analytics is ok didnt read THIS: "Article 29 Working Party, Opinion 6/2014 on the notion of legitimate interest of the data controller under Article 7" page 25. (http://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf http://ec.europa.eu/justice/article-29/documentation/opinion...): "However this does not mean that controllers would be able to rely on article 7(f) to unduly monitor..." You can thank me later ;)

Doxin 8y ago

The "agree by closing this popup" tactic is, as far as I can tell, not allowed under GDPR. Here's hoping all the companies that do that get slapped with a fine.

Brotkrumen 8y ago
This forever popup unless you accept should run afoul of the language in GDPR that forbids the degradation of a service if a user does not opt in.
jbrooksuk 8y ago
Likewise "by continuing to browse this website, you agree" implied consent is no longer allowed.
zingmars 8y ago
They won't be. They will be first be notified and then fined if they refuse to comply.

simias 8y ago

I would be curious to hear how this pattern could be considered to conform to the GDPR. From what I understand it has to be opt-in. I don't speak polish but I went on the website you're talking about using Google translate and indeed I can't see any way to refuse to give them my info. The "if you click X you agree" bit is probably the shadiest of them all.

jocro 8y ago
EDIT: Didn't realize you were referring specifically to the sneaky pop-up. Agree with you on that one. From a brief reading of it the other day, it seems data that is necessary to provide a contracted service (like, say, providing access to a cellular network) has a specific exemption to express consent. Check out items 1a & 1b in Article 6 of Chapter 2[1]: "1Processing shall be lawful only if and to the extent that at least one of the following applies: A: the data subject has given consent to the processing of his or her personal data for one or more specific purposes; B: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;" [1]https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
- e12e 8y ago
  Re: your second point: cellular providers will "automatically" get to track you in real time for the purpose of cell tower hand-over etc. They do not automatically get to keep that data forever, or sell it to a third party. According to how I read the GDPR - I'm not a lawyer ; this is not legal advice, etc.
  - icebraining 8y ago
    Yes, it's specified in Recital 50: https://gdpr-info.eu/recitals/no-50/ https://gdpr-info.eu/recitals/no-50/
    - e12e 8y ago
      Yes... What? I'm not sure I understand what you're saying?

gchadwick 8y ago

> apparently the regulation has a lot of loopholes and anyone with smart lawyers can overcome GDPR easily I think time will tell on that one. It's hard to say how well currently attempted loopholes actually work until they've been tested in court. As for wp dot pl nothing stopping you from avoiding the site altogether. Yes it's frustrating they insist on tracking you and selling your data as their only business model but at least they have to tell you up-front about it now so you can avoid the site (and have them delete all data they hold on you) if you do not want them doing this. Edit: though from re-reading your post and the replies sounds like wp dot pl aren't doing things right and need to be more up-front about what you're agreeing to.

ColinWright 8y ago

I've had two companies do that to me. Today I've sent a request for all my data, and included a note that they appear not to be complying with the legislation. I add that I will check again in a week, and will consider reporting them to the appropriate authorities. I doubt it will have much effect, and I'm only doing this to companies I don't mind being cut off from, but it's a start, and I hope more people start to take seriously their legitimate rights.

krageon 8y ago

"I guess they figured out everything correctly" You guess wrong. The situation you described does not comply with the GDPR. Report them to the legislative agency that handles these things in your region - if they're a big target they will be high up on the list of companies being audited.

deanCommie 8y ago
Slate is doing this too - full page block of the site with only a single "Agree" button to click. No customization or opt out: Slate’s Use of Your Data By clicking “Agree,” you consent to Slate’s Terms of Service and Privacy Policy and the use of technologies such as cookies by Slate and our partners to deliver relevant advertising on our site, in emails and across the Internet, personalize content and perform site analytics. Please see our Privacy Policy for more information about our use of data, your rights, and how to withdraw consent. The terms of service is https://slate.com/terms https://slate.com/terms The privacy is https://slate.com/privacy https://slate.com/privacy Oh sure, there are some links like "Opt-out from data use". Which are just...mailto links to gdpr@slate.com

yulaow 8y ago

They MUST give you an option to retire consent at anytime, even after you gave it willingly (or not), this is an explicit requirement of the GDPR

lol-lol 8y ago

The only problem with this Polish news portal is that they will get warning and then got punished if they dont comply so this is not "fantastic idea". What they are doing is direct violation of GDPR and a really bad idea. There was a complaint filled this morning agains Google, Facebook, Whatsapp and Instagram doing something similar but to lesser extent. https://noyb.eu https://noyb.eu I just cant understand why is everyone trying to push all its intelectual power into trying to workaround GDPR instead of trying to comply, for most website it is trivial as they are in breach of GDPR just becoase they collect the data they dont need.

TeMPOraL 8y ago
> I just cant understand why is everyone trying to push all its intelectual power into trying to workaround GDPR Because they make lots of money on user-hostile practices, and they want to find a way to keep this profit source.
Isinlor 8y ago
GDPR doesn't require consent for data processing. Seems like they claim that they base the data processing on: 1. contract about delivering services between you and them 2. profiling is based on a legitimate interest of their administration 3. sending data to third parties based on consent The way they write it I would call "Polish legalese", so I'm quite confident it was written very carefully by a lawyer and they know it is sketchy. BTW I really recommend reading "Guidelines on Consent under [GDPR]" by Article 29 Working Pary, an EU body established by the previous directive. It's written in simple language with examples of what is valid consent. And how regulators think about it. http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=623051 http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_...
- lol-lol 8y ago
  I am sorry but you are wrong. Legitimate interest is so wrongly understood. You can only use it if your business is not able to function without some PI and for nothing else. For example if you are having an online store, it is perfectly ok to require name and address as you cant deliver goods to the customer without it. The phone number is already fishy (if you already have another mean to communicate). Using 3rd party by default that is doing monitoring/tracking is a no go, you cant put it under the legitimate interest. And you cant force user to give you a consent by denying access as this is violating that it has to be given free. You will get a consent this way but it will be invalidated in case someone complains to ICO and then you have troubles. And I have talked to our ICO in person. And Google already got a complain. So did facebook and instagram and whatsapp. I think that persons that were saying that analytics is ok didnt read THIS: "Article 29 Working Party, Opinion 6/2014 on the notion of legitimate interest of the data controller under Article 7" page 25. (http://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf http://ec.europa.eu/justice/article-29/documentation/opinion...): "However this does not mean that controllers would be able to rely on article 7(f) to unduly monitor..." You can thank me later ;)