6 ms·

I’m not sure I entirely follow the point of the complaints. The complainants seem to have a problem with the fact that they’re asked to either agree with the To

I’m not sure I entirely follow the point of the complaints. The complainants seem to have a problem with the fact that they’re asked to either agree with the ToS or not use the product/service. How’s that illegal/unfair? No business is obliged to allow all and sundry to use their product/service - regardless of whether they abide by the rules. GDPR doesn’t mandate that, does it? While I of course fully support the protection of consumer data/privacy, the companies also have a right to decide whether they want non-compliant users using their service. They’re not running something like public transport, which must, by rights, be available to all. Are these complaints in fact valid under GDPR?

zajd 8y ago
> No business is obliged to allow all and sundry to use their product/service - regardless of whether they abide by the rules. If they are operating in the EU? they do actually. You can't just put whatever you want in your ToS/EULA and throw your hands up.
- alfredallan1 8y ago
  GDPR has requirements about data protection, right to forget, pseudo-anonymity, etc. But as long as the ToS doesn’t violate the rest of GDPR (i.e. things like you allow us to store your passwords in plain text), are there any actual restrictions are imposed on ToS? Now, for the complainants complaints to be valid, there have to be things in the ToS that are against GDPR. As far as one can see, there isn’t. BigCos have been careful enough to not step on the toes of EU regulations. But what part of the GDPR gives the EU the right to force a company to offer its service to someone who doesn’t accept the “house-rules”? Sorry if I seem argumentative, I’m not, I’m just trying to wrap my own head around this thing.
- soneil 8y ago
  We should already be used to this. We're used to seeing the phrase "Your statutory rights remain unaffected". A site's ToS, a store's policies, etc do not override your rights available by law. If a shop says "no returns", what they actually mean is "changing your mind or deciding you don't like it isn't a valid reason". But you can still return something if it's faulty, isn't as described, or isn't fit for purpose - because they're your legal rights, phooey to the store's return policies. It's my understanding (which could be wrong, is constantly evolving, and desperately needs test cases) that being able opt out of unnecessary PII collection or processing is a legal right, and phooey to the ToS that claims otherwise.
  - dalbasal 8y ago
    In principle... In practice, I think that's yet to be determined. GDPR is new. These rights are new. "If it's faulty" is easy for lawyers to determine. "Fit for purpose" ...isn't that hard, and the lawyers have had time to practice. "Unnecessary PII collection or processing" ... the lawyers are currently 23 wikipedia links deep^ trying to identify the aristotelian truth of the matter, presumably in order to make necessary amendments to the aforementioned contract. Shops putting signs on walls is just not comparable to this, in practice. Normal people are signing dozens of pseudo-contracts they don't understand each day. That has been accelerating and gdpr has accelerated it further.
  - alfredallan1 8y ago
    >It's my understanding (which could be wrong, is constantly evolving, and desperately needs test cases) that being able opt out of unnecessary PII collection or processing is a legal right, and phooey to the ToS that claims otherwise. That’s actually a great point. Collecting PII is NOT illegal, as far as I can see. Nor can it be illegal. Same for personalized ads. Consider a real estate agent. To show you the right kinds of houses to buy and finally make the contract, they have to have enough PII about you. If they know nothing about you, they’ll end up showing 1-bedroom studios for a family of five and a three bedroom suite for a bachelor living alone. Similar arguments can be made for all kinds of service providers. Now onto the issue of FB, the only service they offer is “communication tools with built in personalized ads”. PII is necesary to provide that service.
    - soneil 8y ago
      well, I'm cagey with "unnecessary" because I honestly think it's going to take a good few cases in front of judges until we properly understand where that lays. Which will be fun. I'm also curious where other points will land in reality. eg, if I ask Apple to remove all data they have about me, will that also remove me from your address book? If I ask Google to remove all data they have about me, will that also remove any emails you've received from me? In this light, I'm happy to see the first complaints arrive against Google and Facebook, as they're exactly the examples we all have in mind, and we need to see how they'll play out in reality. (Albeit, I also trust the European legal systems won't commonly wield the maximum possible fines, but rather seek compliance. The scary big numbers, the source of so much FUD, should be reserved for wilful disregard after this step. "Walk softly but carry a big stick" style.
- dalbasal 8y ago
  True, but the custom isn't that we sign seven contracts at lunchtime, as we browse shops in a mall & buy a sandwich . That's new, for a regular person "seeing" gdpr. We'll see if this difference is legally superficial or material, as this all plays out. There was a lot of MOP interest in gdpr and it's friends (like the US Congress' FB stuff). Politicians got attention for their rhetoric, as they legislated. Journalists delivered coverage and opinion, including a lot of moralising too. Social media was abuzz.^ They never told the average MOP that gdpr would be a bunch of contracts she'd be signing. From the perspective of corporations.. the party complying & implementing gdpr... they've mostly interpreted it as "Rules About The Contract Our Customers Must Sign". Their lawyers assure them this is best. I think this was a piece of legislation that our legislative systems are particularly ill-equipped to deal with. ^Relatively to the standard interest in laws.
  - Tomte 8y ago
    Fun fact: if you buy a bread at a German bakery, you‘re entering into not one, but three distinct contracts. It‘s just that we usually don‘t notice it because it‘s all concludent action, not a signature. Yes, it‘s strange, but it is the holy cow of German contract law.
    - soneil 8y ago
      I suspected this was the case, but had no idea of the search terms. It strikes me I do enter several contracts per day, offline, almost always simply implied by actions. And we have consumer protection acts to guard the edges of these implied contracts. I think what the web needs right now is to figure out what the implied contract is, and save the modals for those out of the ordinary.
      - alfredallan1 8y ago
        Pardon my apparent impertinence in putting it this way - but isn’t the implicit contract rather obvious? In the digital/information age, personal data is the new currency. You pay for online services with that currency. If your data (money) is more valuable to you than the value you’d derive from use of a certain service, then you don’t pay for it (and by rights, don’t get to use it). I think my money is too valuable for me to spend it on bottled water, so I drink tap water. I think my personal data is too valuable for what I’d get from using FB, so I dont use it (there’s 20+ very widely used apps to “stay in touch” and “communicate” with people). Eventually (even a couple decades maybe), it will become a question of getting the most bang for your buck (data). If two companies offer the same sort of service, but no. 1 needs all personal info all the time (like FB today), and no. 2 only wants your location twice a day, no. 2 will be cheaper and win out. When no. 2’s executives get greedy and ask for your location 4 times a day, Reddit will squeal.
detaro 8y ago
The problem is not with "accept ToS or leave", but that that ToS demand things for the company the complainants argue are not legal to blanket demand in ToS, but have to be optional.
- alfredallan1 8y ago
  The GDPR says no such thing, does it? My GDPR skills are limited by a reasonably good read of wiki and other articles, not the actual text. It states “Unless a data subject has provided explicit consent to data processing for one or more purposes, personal data may not be processed”. It has other requirements about the company being “responsible”, protecting by design, pseudo-anon, right to forget, etc. As far as I understood, it doesn’t mandate the exact nature of the ToS between the service provider and user, leaving that to be a free-will agreement between two parties.
  - DanBC 8y ago
    > It states “Unless a data subject has provided explicit consent to data processing for one or more purposes, personal data may not be processed”. It doesn't really say that. There are six lawful reasons to process data. User consent is only one of them. The one that's useful for most companies is "legitimate interest". https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ See, for example, advice from the UK regulator about potentially using legitimate interest for marketing (something that many people are saying needs explicit consent): https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
    - alfredallan1 8y ago
      >There are six lawful reasons to process data. User consent is only one of them. Yes indeed, there is a list of reasons. I pick the one based on consent, because it seems the most relevant for a company. Process the users’ data, but get their permission first. >The one that's useful for most companies is "legitimate interest”. I would have thought that one was a bit nebulous. No one has given a hard and fast definition of that term. And rather than risk a court’s interpretation or benefit of the doubt, I figured it might be safer to rely on the consent approach.
DanBC 8y ago
There are several lawful bases for processing personal data. Consent is one of them. The companies don't have to rely on consent. But if they do that consent must be freely given. This point in GDPR could be clearer, and I hope the national regulators provide better advice. Also, lots of complainants don't understand GDPR and so we will see a bunch of complaints based on incorrect understanding of GDPR. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
- alfredallan1 8y ago
  >Also, lots of complainants don't understand GDPR and so we will see a bunch of complaints based on incorrect understanding of GDPR. Indeed, probably lots of entitled people who believe Facebook (though I’m no fan, and haven’t used it in years) ought to behave as a charity or govt-funded entity. >https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ Thanks for that (I’ll be reading through the link more fully). >When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. So, the company needs to phrase/frame/present the “service” carefully enough - to take the example of FB again, the service they offer could be phrased as "a means to communicate with and see updates from your connections, together with ads that have been targeted based on your profile details”. Naturally a contract to execute such a service cannot be fulfilled without them processing personal data, and this is the only service they offer. Does this understanding seem correct?
craigsmansion 8y ago
> How’s that illegal/unfair? Because online privacy is now an inalienable right. Users can't sign it away permanently, and companies can't ask for it in return for something. > No business is obliged to allow all and sundry to use their product/service No, but they can't discriminate with regards to submission to online tracking. > the companies also have a right to decide whether they want non-compliant users using their service. In the EU there are no "non-compliant" users when it comes to agreeing to tracking; there are only non-compliant publishers. These publishers are free to shut down EU operations and block EU ip-addresses, and I wish they would instead of these now common "opt out of any of our 50+ 'partners' individually through this terrible interface" shenanigans, designed to make it cumbersome to exercise one's right not to be tracked online. > Are these complaints in fact valid under GDPR? I believe so, and if not, they should be.

zajd 8y ago

> No business is obliged to allow all and sundry to use their product/service - regardless of whether they abide by the rules. If they are operating in the EU? they do actually. You can't just put whatever you want in your ToS/EULA and throw your hands up.

alfredallan1 8y ago
GDPR has requirements about data protection, right to forget, pseudo-anonymity, etc. But as long as the ToS doesn’t violate the rest of GDPR (i.e. things like you allow us to store your passwords in plain text), are there any actual restrictions are imposed on ToS? Now, for the complainants complaints to be valid, there have to be things in the ToS that are against GDPR. As far as one can see, there isn’t. BigCos have been careful enough to not step on the toes of EU regulations. But what part of the GDPR gives the EU the right to force a company to offer its service to someone who doesn’t accept the “house-rules”? Sorry if I seem argumentative, I’m not, I’m just trying to wrap my own head around this thing.
soneil 8y ago
We should already be used to this. We're used to seeing the phrase "Your statutory rights remain unaffected". A site's ToS, a store's policies, etc do not override your rights available by law. If a shop says "no returns", what they actually mean is "changing your mind or deciding you don't like it isn't a valid reason". But you can still return something if it's faulty, isn't as described, or isn't fit for purpose - because they're your legal rights, phooey to the store's return policies. It's my understanding (which could be wrong, is constantly evolving, and desperately needs test cases) that being able opt out of unnecessary PII collection or processing is a legal right, and phooey to the ToS that claims otherwise.
- dalbasal 8y ago
  In principle... In practice, I think that's yet to be determined. GDPR is new. These rights are new. "If it's faulty" is easy for lawyers to determine. "Fit for purpose" ...isn't that hard, and the lawyers have had time to practice. "Unnecessary PII collection or processing" ... the lawyers are currently 23 wikipedia links deep^ trying to identify the aristotelian truth of the matter, presumably in order to make necessary amendments to the aforementioned contract. Shops putting signs on walls is just not comparable to this, in practice. Normal people are signing dozens of pseudo-contracts they don't understand each day. That has been accelerating and gdpr has accelerated it further.
- alfredallan1 8y ago
  >It's my understanding (which could be wrong, is constantly evolving, and desperately needs test cases) that being able opt out of unnecessary PII collection or processing is a legal right, and phooey to the ToS that claims otherwise. That’s actually a great point. Collecting PII is NOT illegal, as far as I can see. Nor can it be illegal. Same for personalized ads. Consider a real estate agent. To show you the right kinds of houses to buy and finally make the contract, they have to have enough PII about you. If they know nothing about you, they’ll end up showing 1-bedroom studios for a family of five and a three bedroom suite for a bachelor living alone. Similar arguments can be made for all kinds of service providers. Now onto the issue of FB, the only service they offer is “communication tools with built in personalized ads”. PII is necesary to provide that service.
  - soneil 8y ago
    well, I'm cagey with "unnecessary" because I honestly think it's going to take a good few cases in front of judges until we properly understand where that lays. Which will be fun. I'm also curious where other points will land in reality. eg, if I ask Apple to remove all data they have about me, will that also remove me from your address book? If I ask Google to remove all data they have about me, will that also remove any emails you've received from me? In this light, I'm happy to see the first complaints arrive against Google and Facebook, as they're exactly the examples we all have in mind, and we need to see how they'll play out in reality. (Albeit, I also trust the European legal systems won't commonly wield the maximum possible fines, but rather seek compliance. The scary big numbers, the source of so much FUD, should be reserved for wilful disregard after this step. "Walk softly but carry a big stick" style.
dalbasal 8y ago
True, but the custom isn't that we sign seven contracts at lunchtime, as we browse shops in a mall & buy a sandwich . That's new, for a regular person "seeing" gdpr. We'll see if this difference is legally superficial or material, as this all plays out. There was a lot of MOP interest in gdpr and it's friends (like the US Congress' FB stuff). Politicians got attention for their rhetoric, as they legislated. Journalists delivered coverage and opinion, including a lot of moralising too. Social media was abuzz.^ They never told the average MOP that gdpr would be a bunch of contracts she'd be signing. From the perspective of corporations.. the party complying & implementing gdpr... they've mostly interpreted it as "Rules About The Contract Our Customers Must Sign". Their lawyers assure them this is best. I think this was a piece of legislation that our legislative systems are particularly ill-equipped to deal with. ^Relatively to the standard interest in laws.
- Tomte 8y ago
  Fun fact: if you buy a bread at a German bakery, you‘re entering into not one, but three distinct contracts. It‘s just that we usually don‘t notice it because it‘s all concludent action, not a signature. Yes, it‘s strange, but it is the holy cow of German contract law.
  - soneil 8y ago
    I suspected this was the case, but had no idea of the search terms. It strikes me I do enter several contracts per day, offline, almost always simply implied by actions. And we have consumer protection acts to guard the edges of these implied contracts. I think what the web needs right now is to figure out what the implied contract is, and save the modals for those out of the ordinary.
    - alfredallan1 8y ago
      Pardon my apparent impertinence in putting it this way - but isn’t the implicit contract rather obvious? In the digital/information age, personal data is the new currency. You pay for online services with that currency. If your data (money) is more valuable to you than the value you’d derive from use of a certain service, then you don’t pay for it (and by rights, don’t get to use it). I think my money is too valuable for me to spend it on bottled water, so I drink tap water. I think my personal data is too valuable for what I’d get from using FB, so I dont use it (there’s 20+ very widely used apps to “stay in touch” and “communicate” with people). Eventually (even a couple decades maybe), it will become a question of getting the most bang for your buck (data). If two companies offer the same sort of service, but no. 1 needs all personal info all the time (like FB today), and no. 2 only wants your location twice a day, no. 2 will be cheaper and win out. When no. 2’s executives get greedy and ask for your location 4 times a day, Reddit will squeal.

detaro 8y ago

The problem is not with "accept ToS or leave", but that that ToS demand things for the company the complainants argue are not legal to blanket demand in ToS, but have to be optional.

alfredallan1 8y ago
The GDPR says no such thing, does it? My GDPR skills are limited by a reasonably good read of wiki and other articles, not the actual text. It states “Unless a data subject has provided explicit consent to data processing for one or more purposes, personal data may not be processed”. It has other requirements about the company being “responsible”, protecting by design, pseudo-anon, right to forget, etc. As far as I understood, it doesn’t mandate the exact nature of the ToS between the service provider and user, leaving that to be a free-will agreement between two parties.
- DanBC 8y ago
  > It states “Unless a data subject has provided explicit consent to data processing for one or more purposes, personal data may not be processed”. It doesn't really say that. There are six lawful reasons to process data. User consent is only one of them. The one that's useful for most companies is "legitimate interest". https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ See, for example, advice from the UK regulator about potentially using legitimate interest for marketing (something that many people are saying needs explicit consent): https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
  - alfredallan1 8y ago
    >There are six lawful reasons to process data. User consent is only one of them. Yes indeed, there is a list of reasons. I pick the one based on consent, because it seems the most relevant for a company. Process the users’ data, but get their permission first. >The one that's useful for most companies is "legitimate interest”. I would have thought that one was a bit nebulous. No one has given a hard and fast definition of that term. And rather than risk a court’s interpretation or benefit of the doubt, I figured it might be safer to rely on the consent approach.

DanBC 8y ago

There are several lawful bases for processing personal data. Consent is one of them. The companies don't have to rely on consent. But if they do that consent must be freely given. This point in GDPR could be clearer, and I hope the national regulators provide better advice. Also, lots of complainants don't understand GDPR and so we will see a bunch of complaints based on incorrect understanding of GDPR. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

alfredallan1 8y ago
>Also, lots of complainants don't understand GDPR and so we will see a bunch of complaints based on incorrect understanding of GDPR. Indeed, probably lots of entitled people who believe Facebook (though I’m no fan, and haven’t used it in years) ought to behave as a charity or govt-funded entity. >https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ Thanks for that (I’ll be reading through the link more fully). >When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. So, the company needs to phrase/frame/present the “service” carefully enough - to take the example of FB again, the service they offer could be phrased as "a means to communicate with and see updates from your connections, together with ads that have been targeted based on your profile details”. Naturally a contract to execute such a service cannot be fulfilled without them processing personal data, and this is the only service they offer. Does this understanding seem correct?

craigsmansion 8y ago

> How’s that illegal/unfair? Because online privacy is now an inalienable right. Users can't sign it away permanently, and companies can't ask for it in return for something. > No business is obliged to allow all and sundry to use their product/service No, but they can't discriminate with regards to submission to online tracking. > the companies also have a right to decide whether they want non-compliant users using their service. In the EU there are no "non-compliant" users when it comes to agreeing to tracking; there are only non-compliant publishers. These publishers are free to shut down EU operations and block EU ip-addresses, and I wish they would instead of these now common "opt out of any of our 50+ 'partners' individually through this terrible interface" shenanigans, designed to make it cumbersome to exercise one's right not to be tracked online. > Are these complaints in fact valid under GDPR? I believe so, and if not, they should be.