3 ms·

> I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough. I don't believe Deliveroo

> I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough. I don't believe Deliveroo is obligated to tell you who they send such information to. They are however obligated to tell you that they gather such information and, should they share it with a third party, ensure that said third party is GDPR compliant and sign a data processing agreement with them. Deliveroo doesn't mention Braze directly by name in their privacy policy (https://deliveroo.co.uk/privacy https://deliveroo.co.uk/privacy), but they do let you know that they disclose "information they collect" to, among others, "Marketing and advertising partners". They also mention in the same privacy policy that they "also collect technical information about your use of our services through a mobile device, for example, carrier, location data and performance data". Braze themselves does appear committed to GDPR. That isn't especially surprising, it's a huge selling point for marketing companies towards enterprise customers. https://www.braze.com/product/data-agility-management/regulations-and-compliance/gdpr/ https://www.braze.com/product/data-agility-management/regula... IANAL but I don't believe Deliveroo is in breach of GDPR. The best you can probably do is make a case that they do not have a reasonable justification to collect such highly-accurate location data for that particular use case, and should tone it down to, say, 5km instead of 1m accuracy. If you email dpo@deliveroo.com with such a request, there's a decent chance you could get the change done.

K0nserv 8y ago
Doesn't GDPR require explicit cosent[0] for collection of sensitive private information? This is what many website has implemented as popups with "I accept" or "Manage Settings" options. I don't remember going through such a flow with Deliveroo and if I did I would have disabled the "marketing" category for sure. 0: https://www.i-scoop.eu/gdpr/explicit-consent/ https://www.i-scoop.eu/gdpr/explicit-consent/
- deleted 8y ago
  [deleted]
- detaro 8y ago
  As the article you link notes: > As we wrote before consent is one of the six conditions for the lawfulness of processing personal data as stipulated in Article 6 of the GDPR text. > Again, there are other conditions for the lawfulness of processing personal data. If you're referring to the bit about "special categories of data" per Article 9, location is not such a category. That said, location data is sensitive, so there certainly are questions that can be asked about how and why they use this data. You can ask them for details.
- scrollaway 8y ago
  Hm, I tried to create an account to check the signup flow but it looks like you need to place an order to create an account (and I'm not that hungry) (also, that's a really fun and interesting way of massaging growth numbers…). To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary. What they might not have gotten, or at least not clearly, is your consent to send that data to a third party, explicitly and exclusively for marketing purposes. I don't know how this would play out. Realistically, GDPR and its enforcers err on the side of caution (you need good justification to gather the data and share it, including consent and a reason to gather it in the first place). So if you care about this and wish to see it corrected, as I said an email to their dpo@ will likely go a long way. In case it doesn't, your national enforcement agency may be interested. Extremely-accurate location data is pretty creepy, especially if they get it very often and doubly so if they store it for a long time. The #1 thing I would look at here is what they actually need it for. They may need it for security reasons (eg. anti-fraud measures) and happen to be storing it in Braze which is probably okay if Braze respects GDPR and Deliveroo signed a DPA with them (you'd be surprised the amount of companies storing security data in GA). But you wouldn't have a very hard time making a case that they're using this for marketing purposes and are gathering an unreasonable amount of accuracy. So now the question is, do you care about this enough to follow up on it? :)
  - K0nserv 8y ago
    > To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary. Per GDPR[0] consent must be specific. i.e. aquiring constent for a legitimate feature of an app and then also using the data for marketing purposes, what seems to be happening here, is not legal. Of course it could be the case that Deliveroo uses Braze for all their push notifications and thus consider it an essential part of their product. IANAL, but as I read the GDPR giving an app location access required for legitimate functionallity is not a carte blanche for the app to use location data for any purpose without obtaining consent for each specific usage. In any case, like you say it's extremely creepy and the level of accuracy is worrying. 0: https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/
Nursie 8y ago
Actually, under the GDPR, they must gain permission to process your information for any marketing purposes. This should be on an opt-in basis. Sounds like an issue to me.
- scrollaway 8y ago
  No, it's not that clear cut. This is the relevant text: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ Specifically, section 1 (b) and all of section 4. Deliveroo clearly needs location data; that they happen to be sending it to Braze is fine if they signed a DPA. So the question is, is the data sent to Braze exclusively for marketing? More critically: If it is collected regardless of consent, does processing still follow consent? (Collecting and processing of data are two different things) As I said there's probably a good case to be made that the data sent is too accurate. I'll note that I'm a bit cynical here since these are fairly minor issues compared to the much more egregious shit GDPR sets out to fix. There's definitely a potential cleanup there, but like, every single company has nasties like these hiding under the carpet. The regulation itself doesn't help these cases much unless people act on them and demand the cleanup.
  - Nursie 8y ago
    > No, it's not that clear cut. ... the question is, is the data sent to Braze exclusively for marketing? I'm not sure you're actually disagreeing with me. See - > Actually, under the GDPR, they must gain permission to process your information for any marketing purposes.
    - scrollaway 8y ago
      Sorry if I wasn't clear; I'm saying that the data sent to Braze is not necessarily used for marketing, or only for marketing. It's possible (and in my experience not unlikely) that they collect it for multiple purposes including critical ones, and restrict more specific processing based on an optin/optout somewhere else in the app. This is still compliant.
- deleted 8y ago
  [deleted]

K0nserv 8y ago

Doesn't GDPR require explicit cosent[0] for collection of sensitive private information? This is what many website has implemented as popups with "I accept" or "Manage Settings" options. I don't remember going through such a flow with Deliveroo and if I did I would have disabled the "marketing" category for sure. 0: https://www.i-scoop.eu/gdpr/explicit-consent/ https://www.i-scoop.eu/gdpr/explicit-consent/

deleted 8y ago
[deleted]
detaro 8y ago
As the article you link notes: > As we wrote before consent is one of the six conditions for the lawfulness of processing personal data as stipulated in Article 6 of the GDPR text. > Again, there are other conditions for the lawfulness of processing personal data. If you're referring to the bit about "special categories of data" per Article 9, location is not such a category. That said, location data is sensitive, so there certainly are questions that can be asked about how and why they use this data. You can ask them for details.
scrollaway 8y ago
Hm, I tried to create an account to check the signup flow but it looks like you need to place an order to create an account (and I'm not that hungry) (also, that's a really fun and interesting way of massaging growth numbers…). To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary. What they might not have gotten, or at least not clearly, is your consent to send that data to a third party, explicitly and exclusively for marketing purposes. I don't know how this would play out. Realistically, GDPR and its enforcers err on the side of caution (you need good justification to gather the data and share it, including consent and a reason to gather it in the first place). So if you care about this and wish to see it corrected, as I said an email to their dpo@ will likely go a long way. In case it doesn't, your national enforcement agency may be interested. Extremely-accurate location data is pretty creepy, especially if they get it very often and doubly so if they store it for a long time. The #1 thing I would look at here is what they actually need it for. They may need it for security reasons (eg. anti-fraud measures) and happen to be storing it in Braze which is probably okay if Braze respects GDPR and Deliveroo signed a DPA with them (you'd be surprised the amount of companies storing security data in GA). But you wouldn't have a very hard time making a case that they're using this for marketing purposes and are gathering an unreasonable amount of accuracy. So now the question is, do you care about this enough to follow up on it? :)
- K0nserv 8y ago
  > To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary. Per GDPR[0] consent must be specific. i.e. aquiring constent for a legitimate feature of an app and then also using the data for marketing purposes, what seems to be happening here, is not legal. Of course it could be the case that Deliveroo uses Braze for all their push notifications and thus consider it an essential part of their product. IANAL, but as I read the GDPR giving an app location access required for legitimate functionallity is not a carte blanche for the app to use location data for any purpose without obtaining consent for each specific usage. In any case, like you say it's extremely creepy and the level of accuracy is worrying. 0: https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/

Nursie 8y ago

Actually, under the GDPR, they must gain permission to process your information for any marketing purposes. This should be on an opt-in basis. Sounds like an issue to me.

scrollaway 8y ago
No, it's not that clear cut. This is the relevant text: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ Specifically, section 1 (b) and all of section 4. Deliveroo clearly needs location data; that they happen to be sending it to Braze is fine if they signed a DPA. So the question is, is the data sent to Braze exclusively for marketing? More critically: If it is collected regardless of consent, does processing still follow consent? (Collecting and processing of data are two different things) As I said there's probably a good case to be made that the data sent is too accurate. I'll note that I'm a bit cynical here since these are fairly minor issues compared to the much more egregious shit GDPR sets out to fix. There's definitely a potential cleanup there, but like, every single company has nasties like these hiding under the carpet. The regulation itself doesn't help these cases much unless people act on them and demand the cleanup.
- Nursie 8y ago
  > No, it's not that clear cut. ... the question is, is the data sent to Braze exclusively for marketing? I'm not sure you're actually disagreeing with me. See - > Actually, under the GDPR, they must gain permission to process your information for any marketing purposes.
  - scrollaway 8y ago
    Sorry if I wasn't clear; I'm saying that the data sent to Braze is not necessarily used for marketing, or only for marketing. It's possible (and in my experience not unlikely) that they collect it for multiple purposes including critical ones, and restrict more specific processing based on an optin/optout somewhere else in the app. This is still compliant.
deleted 8y ago
[deleted]