5 ms·

The GDPR says no such thing, does it? My GDPR skills are limited by a reasonably good read of wiki and other articles, not the actual text. It states “Unless a

The GDPR says no such thing, does it? My GDPR skills are limited by a reasonably good read of wiki and other articles, not the actual text. It states “Unless a data subject has provided explicit consent to data processing for one or more purposes, personal data may not be processed”. It has other requirements about the company being “responsible”, protecting by design, pseudo-anon, right to forget, etc. As far as I understood, it doesn’t mandate the exact nature of the ToS between the service provider and user, leaving that to be a free-will agreement between two parties.

DanBC 8y ago
> It states “Unless a data subject has provided explicit consent to data processing for one or more purposes, personal data may not be processed”. It doesn't really say that. There are six lawful reasons to process data. User consent is only one of them. The one that's useful for most companies is "legitimate interest". https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ See, for example, advice from the UK regulator about potentially using legitimate interest for marketing (something that many people are saying needs explicit consent): https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- alfredallan1 8y ago
  >There are six lawful reasons to process data. User consent is only one of them. Yes indeed, there is a list of reasons. I pick the one based on consent, because it seems the most relevant for a company. Process the users’ data, but get their permission first. >The one that's useful for most companies is "legitimate interest”. I would have thought that one was a bit nebulous. No one has given a hard and fast definition of that term. And rather than risk a court’s interpretation or benefit of the doubt, I figured it might be safer to rely on the consent approach.
  - Tomte 8y ago
    Consent is something you can easily get, but if a person declines to consent, you may not shut him out. But if you can argue with legitimate interest (which is more burdensome), the person cannot decline and still use the service. Choose: either easy basis and accepting that you might not get your way, or difficult basis and getting your way.
    - alfredallan1 8y ago
      If the service I offer is “communication tools with in built personal ads”, or “latest news reports with personal ads on the side” it is not possible to offer those services without access to personal info.
      - Tomte 8y ago
        And if the service you offer is „communication tool with the ability to sell weapons online“, then the authorities are out of luck, because you have cleverly phrased your mission statement? That‘s not how it works.
        alfredallan1 8y ago
        Oh no. The trouble with “chat app with weapons sales feature” is that it is illegal to buy or sell weapons (online or offline) without specific licenses. Now If I made a “communication tool” exclusively for registered gun dealers and people with valid (and verified) hunting licenses, it would in fact be perfectly legal. Similarly, if the tool were for use by government agencies and defense contractors or registered weapons manufacturers, it would also be legit. In the context of “chat tool with personalized ads on the side” - there is nothing specifically illegal about “personalized ads”. Is there? (As long as there is user consent of course). So what’s the specific legal hurdle? Which paragraph of the GDPR prevents this?
deleted 8y ago
[deleted]
detaro 8y ago
Consent is only one basis for processing, and comes with high requirements. Consent is required to be "freely given", which isn't the case if it is required. E.g. Article 7: > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. Or in Recital 43: > Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. Thus, where they do give "consent" as the basis on which they process data as part of Terms of Service the user has to accept, that's highly critical if they do not query for that consent independently, and in a way the user clearly can deny. You can't require consent in something the user has to accept to use your service. (You can find the full complaint against Facebook here: https://noyb.eu/wp-content/uploads/2018/05/complaint-facebook.pdf https://noyb.eu/wp-content/uploads/2018/05/complaint-faceboo...)
- alfredallan1 8y ago
  >Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. Yes, indeed. That just leaves the matter to specifying the exact nature of the contract. So the service being provisioned can be “access to the tools to connect with one’s friends and such tools have personalized ads built into them”. Does my approach misinterpret things? I don’t think anything is specified about what kinds of contracts can or cannot be offered. And in a reasonably free market, it cannot. And of course, it should not - hardly any of the biggest internet companies could make money without ads. Now if FB or Google, or another company were to be regulated as a utility company, then yes, the nature of their contracts can also be regulated. They could go a step further, and simply ban “all personalized ads” - I’m not sure how feasible that is, but that would give the EU the right to regulate the kinds of ads shown by FB and ergo, the kind of data collected. But personalized ads is a immensely vague term that could even catch tv and radio ads (targeting based on demographics, and time of day the show is being broadcast, etc.) in the dragnet.

DanBC 8y ago

> It states “Unless a data subject has provided explicit consent to data processing for one or more purposes, personal data may not be processed”. It doesn't really say that. There are six lawful reasons to process data. User consent is only one of them. The one that's useful for most companies is "legitimate interest". https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ See, for example, advice from the UK regulator about potentially using legitimate interest for marketing (something that many people are saying needs explicit consent): https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

alfredallan1 8y ago
>There are six lawful reasons to process data. User consent is only one of them. Yes indeed, there is a list of reasons. I pick the one based on consent, because it seems the most relevant for a company. Process the users’ data, but get their permission first. >The one that's useful for most companies is "legitimate interest”. I would have thought that one was a bit nebulous. No one has given a hard and fast definition of that term. And rather than risk a court’s interpretation or benefit of the doubt, I figured it might be safer to rely on the consent approach.
- Tomte 8y ago
  Consent is something you can easily get, but if a person declines to consent, you may not shut him out. But if you can argue with legitimate interest (which is more burdensome), the person cannot decline and still use the service. Choose: either easy basis and accepting that you might not get your way, or difficult basis and getting your way.
  - alfredallan1 8y ago
    If the service I offer is “communication tools with in built personal ads”, or “latest news reports with personal ads on the side” it is not possible to offer those services without access to personal info.
    - Tomte 8y ago
      And if the service you offer is „communication tool with the ability to sell weapons online“, then the authorities are out of luck, because you have cleverly phrased your mission statement? That‘s not how it works.
      - alfredallan1 8y ago
        Oh no. The trouble with “chat app with weapons sales feature” is that it is illegal to buy or sell weapons (online or offline) without specific licenses. Now If I made a “communication tool” exclusively for registered gun dealers and people with valid (and verified) hunting licenses, it would in fact be perfectly legal. Similarly, if the tool were for use by government agencies and defense contractors or registered weapons manufacturers, it would also be legit. In the context of “chat tool with personalized ads on the side” - there is nothing specifically illegal about “personalized ads”. Is there? (As long as there is user consent of course). So what’s the specific legal hurdle? Which paragraph of the GDPR prevents this?

deleted 8y ago

[deleted]

detaro 8y ago

Consent is only one basis for processing, and comes with high requirements. Consent is required to be "freely given", which isn't the case if it is required. E.g. Article 7: > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. Or in Recital 43: > Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. Thus, where they do give "consent" as the basis on which they process data as part of Terms of Service the user has to accept, that's highly critical if they do not query for that consent independently, and in a way the user clearly can deny. You can't require consent in something the user has to accept to use your service. (You can find the full complaint against Facebook here: https://noyb.eu/wp-content/uploads/2018/05/complaint-facebook.pdf https://noyb.eu/wp-content/uploads/2018/05/complaint-faceboo...)

alfredallan1 8y ago
>Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. Yes, indeed. That just leaves the matter to specifying the exact nature of the contract. So the service being provisioned can be “access to the tools to connect with one’s friends and such tools have personalized ads built into them”. Does my approach misinterpret things? I don’t think anything is specified about what kinds of contracts can or cannot be offered. And in a reasonably free market, it cannot. And of course, it should not - hardly any of the biggest internet companies could make money without ads. Now if FB or Google, or another company were to be regulated as a utility company, then yes, the nature of their contracts can also be regulated. They could go a step further, and simply ban “all personalized ads” - I’m not sure how feasible that is, but that would give the EU the right to regulate the kinds of ads shown by FB and ergo, the kind of data collected. But personalized ads is a immensely vague term that could even catch tv and radio ads (targeting based on demographics, and time of day the show is being broadcast, etc.) in the dragnet.