3 ms·
No, it's not that clear cut. This is the relevant text: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ Specifically, section 1 (b) and all
by scrollaway 8y ago
No, it's not that clear cut. This is the relevant text:
https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
Specifically, section 1 (b) and all of section 4. Deliveroo clearly needs location data; that they happen to be sending it to Braze is fine if they signed a DPA. So the question is, is the data sent to Braze exclusively for marketing? More critically: If it is collected regardless of consent, does processing still follow consent? (Collecting and processing of data are two different things)
As I said there's probably a good case to be made that the data sent is too accurate.
I'll note that I'm a bit cynical here since these are fairly minor issues compared to the much more egregious shit GDPR sets out to fix. There's definitely a potential cleanup there, but like, every single company has nasties like these hiding under the carpet. The regulation itself doesn't help these cases much unless people act on them and demand the cleanup.
- Nursie 8y ago> No, it's not that clear cut. ... the question is, is the data sent to Braze exclusively for marketing? I'm not sure you're actually disagreeing with me. See - > Actually, under the GDPR, they must gain permission to process your information for any marketing purposes.
- scrollaway 8y agoSorry if I wasn't clear; I'm saying that the data sent to Braze is not necessarily used for marketing, or only for marketing. It's possible (and in my experience not unlikely) that they collect it for multiple purposes including critical ones, and restrict more specific processing based on an optin/optout somewhere else in the app. This is still compliant.