4 ms·

Interesting that WaPo's free option seems to be in violation of GDPR. It has no option to reject personalized ads and third party trackers - you can simply acc

Interesting that WaPo's free option seems to be in violation of GDPR. It has no option to reject personalized ads and third party trackers - you can simply accept and view the site, or go away: http://prntscr.com/joqj3d http://prntscr.com/joqj3d That seems to be in direct conflict with GDPR provisions that force web publishers to give people the option to reject personalized ads while still giving them the services they were trying to access. I'm sure that when regulators come calling, they'll claim "legitimate interest," but if this model is acceptable under GDPR, then almost nothing has actually changed under it.

dogma1138 8y ago
That is only if you use consent as your lawful basis. The reason why nearly everyone is using consent currently is because the other straightforward one which is: (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) Is so vaguely defined as far as benchmarks go and no one is up for taking the risk of being at the mercy of the judgment of 28 different regulators and court systems.
- amarkov 8y ago
  I don't think it's necessarily the case that everyone's using consent currently. They just think (probably correctly) that regulators will be more favorable to a company that always makes disclosures and asks for permission up front.
  - dogma1138 8y ago
    The disclosure part is unrelated to the basis, you need to tell the user what you collect for what purpose and what is the lawful basis for it. Consent is no more lawful than interest however it’s less open to interpretation despite its likely not the most appropriate basis for many cases. Consent doesn’t enables you to do more or less all the lawful bases by definition are equal in their scope.
- krageon 8y ago
  If it makes you anxious whether or not you are compliant, you're probably not. As a rule of thumb this goes pretty well with a lot of legislation.
  - dogma1138 8y ago
    That’s not how the real world works at all virtually all proper regulation has set of benchmarks and a defined compliance validation process.
drivingmenuts 8y ago
> That seems to be in direct conflict with GDPR provisions that force web publishers to give people the option to reject personalized ads while still giving them the services they were trying to access. Which part of the GDPR requires a site to give access to someone who doesn't agree to their terms?
- krageon 8y ago
  On the off chance that you're not just trolling, this is one of the main points of the GDPR. If this is news to you, I invite you to read up on the subject.
  - dogma1138 8y ago
    I think you should follow your own advice because what you said is completely untrue.
  - drivingmenuts 8y ago
    Not an EU citizen or a lawyer (NEUCoLa) so, yeah, nothing leaped out at me (https://eur-lex.europa.eu/eli/reg/2016/679/oj https://eur-lex.europa.eu/eli/reg/2016/679/oj) as requiring a site to give access to someone, regardless.

dogma1138 8y ago

That is only if you use consent as your lawful basis. The reason why nearly everyone is using consent currently is because the other straightforward one which is: (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) Is so vaguely defined as far as benchmarks go and no one is up for taking the risk of being at the mercy of the judgment of 28 different regulators and court systems.

amarkov 8y ago
I don't think it's necessarily the case that everyone's using consent currently. They just think (probably correctly) that regulators will be more favorable to a company that always makes disclosures and asks for permission up front.
- dogma1138 8y ago
  The disclosure part is unrelated to the basis, you need to tell the user what you collect for what purpose and what is the lawful basis for it. Consent is no more lawful than interest however it’s less open to interpretation despite its likely not the most appropriate basis for many cases. Consent doesn’t enables you to do more or less all the lawful bases by definition are equal in their scope.
krageon 8y ago
If it makes you anxious whether or not you are compliant, you're probably not. As a rule of thumb this goes pretty well with a lot of legislation.
- dogma1138 8y ago
  That’s not how the real world works at all virtually all proper regulation has set of benchmarks and a defined compliance validation process.

drivingmenuts 8y ago

> That seems to be in direct conflict with GDPR provisions that force web publishers to give people the option to reject personalized ads while still giving them the services they were trying to access. Which part of the GDPR requires a site to give access to someone who doesn't agree to their terms?

krageon 8y ago
On the off chance that you're not just trolling, this is one of the main points of the GDPR. If this is news to you, I invite you to read up on the subject.
- dogma1138 8y ago
  I think you should follow your own advice because what you said is completely untrue.
- drivingmenuts 8y ago
  Not an EU citizen or a lawyer (NEUCoLa) so, yeah, nothing leaped out at me (https://eur-lex.europa.eu/eli/reg/2016/679/oj https://eur-lex.europa.eu/eli/reg/2016/679/oj) as requiring a site to give access to someone, regardless.