4 ms·

Nope thats actually true. You cant force say tracking, if its not absolutely needed, for the product to work. And i think thats why a lot of the popups have dar

Nope thats actually true. You cant force say tracking, if its not absolutely needed, for the product to work. And i think thats why a lot of the popups have dark patterns, to hide the fact, that you can no opt out to these things.

GordonS 8y ago
Hmm, seems you are right, I just found this PDF from the ICO: https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf https://ico.org.uk/media/about-the-ico/consultations/2013551... "Avoid making consent a precondition of a service" "consent requests must be separate from other terms and conditions. Consent should not be a precondition of signing up to a service unless necessary for that service" I assume Facebook et al will simply find a way to make everything 'necessary'.
- martin_bech 8y ago
  They have, and thats why they are going to be sued.. they made tracking a precondition for using the service.
- mjewtoo 8y ago
  For consent this is true, but there are other legal ways for you to collect the data. One is legitimate interest, this one is more abstract but requires a bit more work from you. I think a lot of the future court cases will be around trying what one can use legitimate interest for. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
  - GordonS 8y ago
    Legitimate interest is meant for when it's in the user's best interest... but I've no doubt that, given sufficient lawyers, Facebook et al could argue almost any data-hoovering is in their users best interest
- arcbyte 8y ago
  Part of that is because consent is only one of the 6 ways to claim compliance for data processing, and is not always the appropriate way to be compliant. In fact, most people who are using the word "consent" are wildly misinterpreting the GDPR, using "consent" as a catchall term, when in fact the GDPR takes a far narrower view. The legal basis that is probably FAR more important but isn't being talked about is the contractual basis, and there are two. When I say people are overusing "consent", I mean that entering into a contract requires ~consent~ in loose everyday conversation, but is actually not "consent" for the purposes of the GDPR - its a contract. Because of the difference between the loose meanings in everyday conversation and the (slightly) more precise definitions in the GDPR, you are seeing a LOT of articles push back on using the consent basis for compliance because what you are actually talking about, in GDPR terms, is a contractual basis, or a "legitimate use" basis attached to a contractual basis. Most online businesses view their Terms of Service as establishing a contract. Therefore, no "consent" required because you using their website is a contract, even though in loose conversation you would say that you ~consented~ to enter that contract. The document you posted is consistent in trying to hammer home the distinction. Read this excerpt: > The ‘consent’ is a condition of service If you require someone to agree to processing as a condition of service, consent is unlikely to be the most appropriate lawful basis for the processing. In some circumstances it won’t even count as valid consent. Instead, if you believe the processing is necessary for the service, the better lawful basis for processing is more likely to be that the “processing is necessary for the performance of a contract” under Article 6(1)(b). You are only likely to need to rely on consent if required to do so under another provision, such as for electronic marketing. It may be that the processing is a condition of service but is not actually necessary for that service. If so, consent is not just inappropriate as a lawful basis, but presumed to be invalid as it is not freely given. In these circumstances, you would usually need to consider ‘legitimate interests’ under Article 6(1)(f) as your lawful basis for processing instead.

GordonS 8y ago

Hmm, seems you are right, I just found this PDF from the ICO: https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf https://ico.org.uk/media/about-the-ico/consultations/2013551... "Avoid making consent a precondition of a service" "consent requests must be separate from other terms and conditions. Consent should not be a precondition of signing up to a service unless necessary for that service" I assume Facebook et al will simply find a way to make everything 'necessary'.

martin_bech 8y ago
They have, and thats why they are going to be sued.. they made tracking a precondition for using the service.
mjewtoo 8y ago
For consent this is true, but there are other legal ways for you to collect the data. One is legitimate interest, this one is more abstract but requires a bit more work from you. I think a lot of the future court cases will be around trying what one can use legitimate interest for. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- GordonS 8y ago
  Legitimate interest is meant for when it's in the user's best interest... but I've no doubt that, given sufficient lawyers, Facebook et al could argue almost any data-hoovering is in their users best interest
arcbyte 8y ago
Part of that is because consent is only one of the 6 ways to claim compliance for data processing, and is not always the appropriate way to be compliant. In fact, most people who are using the word "consent" are wildly misinterpreting the GDPR, using "consent" as a catchall term, when in fact the GDPR takes a far narrower view. The legal basis that is probably FAR more important but isn't being talked about is the contractual basis, and there are two. When I say people are overusing "consent", I mean that entering into a contract requires ~consent~ in loose everyday conversation, but is actually not "consent" for the purposes of the GDPR - its a contract. Because of the difference between the loose meanings in everyday conversation and the (slightly) more precise definitions in the GDPR, you are seeing a LOT of articles push back on using the consent basis for compliance because what you are actually talking about, in GDPR terms, is a contractual basis, or a "legitimate use" basis attached to a contractual basis. Most online businesses view their Terms of Service as establishing a contract. Therefore, no "consent" required because you using their website is a contract, even though in loose conversation you would say that you ~consented~ to enter that contract. The document you posted is consistent in trying to hammer home the distinction. Read this excerpt: > The ‘consent’ is a condition of service If you require someone to agree to processing as a condition of service, consent is unlikely to be the most appropriate lawful basis for the processing. In some circumstances it won’t even count as valid consent. Instead, if you believe the processing is necessary for the service, the better lawful basis for processing is more likely to be that the “processing is necessary for the performance of a contract” under Article 6(1)(b). You are only likely to need to rely on consent if required to do so under another provision, such as for electronic marketing. It may be that the processing is a condition of service but is not actually necessary for that service. If so, consent is not just inappropriate as a lawful basis, but presumed to be invalid as it is not freely given. In these circumstances, you would usually need to consider ‘legitimate interests’ under Article 6(1)(f) as your lawful basis for processing instead.