4 ms·

Actually the spirit of GDPR is also to make Terms of Service shorter by being clear and understandable. If you as a user is unable to understand what you are ag

Actually the spirit of GDPR is also to make Terms of Service shorter by being clear and understandable. If you as a user is unable to understand what you are agreeing to then it is a violation of GDPR.

mirko22 8y ago
> unable to understand What if he is not very smart? Or even better, what if he is very dumb? At which level should those be written then?
- contravariant 8y ago
  The literal text of the GDPR is as follows: >the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language
  - mirko22 8y ago
    Yes, and before that it says ` If the data subject's consent is given in the context of a written declaration which also concerns other matters,` which means i can use legalese but only if it does not concern other matters in the same document? :)
    - contravariant 8y ago
      You'd hope not, but I also thought the phrasing in that sentence was sloppy.
      - mirko22 8y ago
        that’s the whole issue with the regulation unfortunately :(
sontek 8y ago
Our policies got much longer with GDPR. We only collect information for legitimate reasons (i.e we need it for the service they are using), we ask for it, and we never target it / sell the data. It helps that our customers are paying customers and not using a free service. So our TOS used to be quite simple in plain english that all the data we request is only for the purpose of providing the service. Now we had to outline all the information we collection (even though they are the ones who provide it, so they know what we collect) and outline all our services we use where that data we collect ends up (AWS, Sentry, Loggly, etc... the services we need to run our system and support them). Most of our clients have no idea what any of the information we added is because its all technical details about how we are providing the service to them. GDPR required us to do a lot of work that ended up costing us time and money and literally nothing changed because we were already making sure we protected our users privacy. Hopefully some bad actors get hit but for now GDPR has left a bad impression on me.
pluma 8y ago
Theoretically yes. Practically you need to be rather verbose in certain cases (e.g. you need to specifically name which articles of the GDPR you're using to justify collection) while also being told to be concise. The general advice I've heard is to have a human-readable summary and then follow it up with the lawyer speak for compliance.

mirko22 8y ago

> unable to understand What if he is not very smart? Or even better, what if he is very dumb? At which level should those be written then?

contravariant 8y ago
The literal text of the GDPR is as follows: >the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language
- mirko22 8y ago
  Yes, and before that it says ` If the data subject's consent is given in the context of a written declaration which also concerns other matters,` which means i can use legalese but only if it does not concern other matters in the same document? :)
  - contravariant 8y ago
    You'd hope not, but I also thought the phrasing in that sentence was sloppy.
    - mirko22 8y ago
      that’s the whole issue with the regulation unfortunately :(

sontek 8y ago

Our policies got much longer with GDPR. We only collect information for legitimate reasons (i.e we need it for the service they are using), we ask for it, and we never target it / sell the data. It helps that our customers are paying customers and not using a free service. So our TOS used to be quite simple in plain english that all the data we request is only for the purpose of providing the service. Now we had to outline all the information we collection (even though they are the ones who provide it, so they know what we collect) and outline all our services we use where that data we collect ends up (AWS, Sentry, Loggly, etc... the services we need to run our system and support them). Most of our clients have no idea what any of the information we added is because its all technical details about how we are providing the service to them. GDPR required us to do a lot of work that ended up costing us time and money and literally nothing changed because we were already making sure we protected our users privacy. Hopefully some bad actors get hit but for now GDPR has left a bad impression on me.

pluma 8y ago

Theoretically yes. Practically you need to be rather verbose in certain cases (e.g. you need to specifically name which articles of the GDPR you're using to justify collection) while also being told to be concise. The general advice I've heard is to have a human-readable summary and then follow it up with the lawyer speak for compliance.