3 ms·

I don't know where this misconception comes from. Consent is totally different from contract - and both are part of reasons under the GDPR to use private data.

I don't know where this misconception comes from. Consent is totally different from contract - and both are part of reasons under the GDPR to use private data. True, consent requires necessity, but contract is wide open. When you click accept you aren't consenting, you are (theoretically) forming a contract, not consenting.

yorwba 8y ago
> you are (theoretically) forming a contract, not consenting. How is forming a contract different from consenting? Do you mean to imply that a contract can be formed without consenting to the contract terms? The GDPR does allow processing if "[it] is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract" ( https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ ), but if you want to argue that tracking is necessary to fulfill the contractual obligation to display personalized ads, then first you'd need to get consent for that contract. How to get that consent is outlined in https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ , which says e.g.: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." So is the contract with TechCrunch about reading articles or about looking at ads? And is the reading of articles conditional on the ads?
- arcbyte 8y ago
  GDPR doesn't change contract law - they're orthogonal. It is true that in the everyday meaning of the word "consent", you would "consent" to a contract, but that is not at all how it is being used in the GDPR - the consent is to the one-sided, without consideration use of your private information. It has nothing to do with consenting to anything else, whether the formation of a contract or the shaving of your dog. While I applaud you going to the source, your reference: "How to get that consent is outlined in https://gdpr-info.eu/art-7-gdpr/" https://gdpr-info.eu/art-7-gdpr/" does not mean what you think it means. It is simply a specific callout to emphasize the "freely given" aspect of consent (and NOT contracts) and remind enforcers that refusing to perform or taking some out from performing a contract should be considered undue pressure to get consent and therefore not "freely given". For instance, an extreme example would be if, after you ordered and paid for a pizza, and after I agreed to make and deliver you that pizza, I subsequently threaten to breach that pizza delivery contract if you don't "consent" to give me a complete list of movies you've watched this week. ALthough we do have a contract, we're not forming a new movie-history contract because I'm not offering anything for it or agreeing to do anything. I'm just using that pre-existing contractual relationship between us to threaten you into something that you may not want to do. They're completely separate concepts. Note the phrase "inter alia" which means "among other things", which is a signal from the authors that this is not the only consideration on "freely giving" consent. It has nothing to do with consenting to form a contract. Note also the word "performance" as it relates to a contract, which is completely distinct from "formation" of a contract. Furthermore, you've (theoretically) been forming contracts with these websites every time you visit them and accept their ToS and privacy policies and whatever else you click "OK" on - just go read them. They restrict you from many things that you could possibly do (reverse engineering, automated scraping, etc) in consideration for serving you up the content. GDPR is just another line item to add into that list for you to accept in the (theoretical) contract. Lastly, I keep saying "theoretical" because at least in the US, I'm not aware of a direct case on the topic of whether website ToS are actually enforceable. There's a click-wrap case that is close, but other than that....
deleted 8y ago
[deleted]

yorwba 8y ago

> you are (theoretically) forming a contract, not consenting. How is forming a contract different from consenting? Do you mean to imply that a contract can be formed without consenting to the contract terms? The GDPR does allow processing if "[it] is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract" ( https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ ), but if you want to argue that tracking is necessary to fulfill the contractual obligation to display personalized ads, then first you'd need to get consent for that contract. How to get that consent is outlined in https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ , which says e.g.: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." So is the contract with TechCrunch about reading articles or about looking at ads? And is the reading of articles conditional on the ads?

arcbyte 8y ago
GDPR doesn't change contract law - they're orthogonal. It is true that in the everyday meaning of the word "consent", you would "consent" to a contract, but that is not at all how it is being used in the GDPR - the consent is to the one-sided, without consideration use of your private information. It has nothing to do with consenting to anything else, whether the formation of a contract or the shaving of your dog. While I applaud you going to the source, your reference: "How to get that consent is outlined in https://gdpr-info.eu/art-7-gdpr/" https://gdpr-info.eu/art-7-gdpr/" does not mean what you think it means. It is simply a specific callout to emphasize the "freely given" aspect of consent (and NOT contracts) and remind enforcers that refusing to perform or taking some out from performing a contract should be considered undue pressure to get consent and therefore not "freely given". For instance, an extreme example would be if, after you ordered and paid for a pizza, and after I agreed to make and deliver you that pizza, I subsequently threaten to breach that pizza delivery contract if you don't "consent" to give me a complete list of movies you've watched this week. ALthough we do have a contract, we're not forming a new movie-history contract because I'm not offering anything for it or agreeing to do anything. I'm just using that pre-existing contractual relationship between us to threaten you into something that you may not want to do. They're completely separate concepts. Note the phrase "inter alia" which means "among other things", which is a signal from the authors that this is not the only consideration on "freely giving" consent. It has nothing to do with consenting to form a contract. Note also the word "performance" as it relates to a contract, which is completely distinct from "formation" of a contract. Furthermore, you've (theoretically) been forming contracts with these websites every time you visit them and accept their ToS and privacy policies and whatever else you click "OK" on - just go read them. They restrict you from many things that you could possibly do (reverse engineering, automated scraping, etc) in consideration for serving you up the content. GDPR is just another line item to add into that list for you to accept in the (theoretical) contract. Lastly, I keep saying "theoretical" because at least in the US, I'm not aware of a direct case on the topic of whether website ToS are actually enforceable. There's a click-wrap case that is close, but other than that....

deleted 8y ago

[deleted]