3 ms·

I forget where I saw it, but I thought this was a good test of whether it is legitimate interest. It went something like: "Would a 'reasonable' person be surpr

I forget where I saw it, but I thought this was a good test of whether it is legitimate interest. It went something like: "Would a 'reasonable' person be surprised if you told them about how you were using the data?"

JoeAltmaier 8y ago
That scale slides around every day. And 'being surprised' and 'being happy' are very different things also. I'd prefer to have hard limits. No collecting any info from my computer about me that aren't explicit in the interaction itself (asking for email is ok; scraping installed apps while doing that to gauge my interests is not)
- matthewmacleod 8y ago
  “Reasonable person” tests are pretty common and well-understood in general. One of the reasons that the GDPR in particular avoids being overly prescriptive about how to meet its requirements is to avoid situations where it becomes inapplicable or obsolete due to changes in technology or habits.
  - true_religion 8y ago
    In the US, a reasonable person test is meaningless without a body of precedent setting cases. If the language of a new law uses it with regards to a new technology, then no one can be sure what the courts will decide. It may be different in the EU, as the legal system is quite different.
- isostatic 8y ago
  And recording your IP address in the apache log?
- usrusr 8y ago
  It's a valid concern, but I don't think the line is as muddy as it seems at first glance: would I expect a Pyongyang hotel room to be bugged? No. But I also would not assume that it's not. With this construction you get two kinds of being surprised, with one taking all the variability derived from suspicions and the like while the other should remain quite stable. Just like most people were simultaneously surprised and not surprised at all by the Snowden revelations. Obviously one would have to explicitly exclude from the "reasonable" test the kind of surprise that was not triggered by Snowden, because otherwise all our greatest fears would become legal by definition.
dmurray 8y ago
That's part of the "balancing test", which is one of the three tests mentioned in the article. It's definitely not sufficient to show your data processing fits the legitimate interest basis.

JoeAltmaier 8y ago

That scale slides around every day. And 'being surprised' and 'being happy' are very different things also. I'd prefer to have hard limits. No collecting any info from my computer about me that aren't explicit in the interaction itself (asking for email is ok; scraping installed apps while doing that to gauge my interests is not)

matthewmacleod 8y ago
“Reasonable person” tests are pretty common and well-understood in general. One of the reasons that the GDPR in particular avoids being overly prescriptive about how to meet its requirements is to avoid situations where it becomes inapplicable or obsolete due to changes in technology or habits.
- true_religion 8y ago
  In the US, a reasonable person test is meaningless without a body of precedent setting cases. If the language of a new law uses it with regards to a new technology, then no one can be sure what the courts will decide. It may be different in the EU, as the legal system is quite different.
isostatic 8y ago
And recording your IP address in the apache log?
usrusr 8y ago
It's a valid concern, but I don't think the line is as muddy as it seems at first glance: would I expect a Pyongyang hotel room to be bugged? No. But I also would not assume that it's not. With this construction you get two kinds of being surprised, with one taking all the variability derived from suspicions and the like while the other should remain quite stable. Just like most people were simultaneously surprised and not surprised at all by the Snowden revelations. Obviously one would have to explicitly exclude from the "reasonable" test the kind of surprise that was not triggered by Snowden, because otherwise all our greatest fears would become legal by definition.

dmurray 8y ago

That's part of the "balancing test", which is one of the three tests mentioned in the article. It's definitely not sufficient to show your data processing fits the legitimate interest basis.