3 ms·
They could be relying on the "public interest" part of their TOS, in which case they'd possibly argue that this processing was necessary as part of the provisio
by trampypizza 8y ago
They could be relying on the "public interest" part of their TOS, in which case they'd possibly argue that this processing was necessary as part of the provision of service, and therefore wouldn't require any further consent from the user.
For the record: I'm not suggesting that what they did was ok, just trying to think about it from a GDPR perspective. Anonymising account information is great and all, but how can you be sure you've obfuscated all PII from information saved to file storage, unless you audit all that information - which in and of itself seems ropey from a data protection point of view.
- blub 8y agoWhy do you belive that the work under discussion was performend in the interest of the public? It seems hardly necessary to share data with HBR so that Dropbox can offer file-sharing services... Based on my reading here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/public-task/ https://ico.org.uk/for-organisations/guide-to-the-general-da... this does not apply.
- trampypizza 8y agoSo it looks as though the article has been edited to say the anonymisation and aggregation was carried out before being transferred to a third party, which craps on our discussion a bit. However, to answer your question anyway - I don't believe you could justify the work as being in the public interest. I think it would be an extremely tenuous link and I think you'd be a fool to try and rely on something as flimsy as public interest if you're not a government body, or processing data on behalf of one. I suppose I was taking a stab at understanding what their thinking was to see if anyone else could provide me with something which I had not considered.