4 ms·

> I’ve met their head of data science. They’re doing all that stuff and have been for many years. This sounds very much in violation of GDPR. Are they just bet

by pimmen 7y ago

> I’ve met their head of data science. They’re doing all that stuff and have been for many years. This sounds very much in violation of GDPR. Are they just betting on people being too embarrassed to take them to court?

jedberg 7y ago
Maybe they had to change their practices after GDPR. I met him before that was passed.
mateo411 7y ago
It's not a violation of GDPR. However, is somebody makes a GDPR request to retrieve all of their personal data, or to delete their personal data, then they must comply within 30 days. They have to organize their datasets to make these operations easy.
- jdlshore 7y ago
  There are six legal bases for processing personal data under the GDPR. Which do you think applies in this case? Additionally, sexual orientation is subject to special rules under the GDPR and cannot be processed at all without consent (and some edge cases). That could possibly apply as well.
  - mateo411 7y ago
    I think the site would require that the visitor give consent when they visit.
    - jdlshore 7y ago
      You're not allowed to require consent in exchange for access to content.
      - mateo411 7y ago
        Really? Where is this rule stated in the GDPR?
        jdlshore 7y ago
        Article 4 section 11 defines "consent" as something that must be freely given. [1] Article 7 section 4 further clarifies that consent is not freely given if provision of a service is conditional on consent. [2] Recital 43 is super clear: "Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." [3] The gdpr.eu website unpacks the legalese: "“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service." [4] [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ [2] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ [3] https://gdpr-info.eu/recitals/no-43/ https://gdpr-info.eu/recitals/no-43/ [4] https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/
ComputerGuru 7y ago
How long do you think GDPR has been around for? Why do you think it was passed?

by pimmen 7y ago

jedberg 7y ago

Maybe they had to change their practices after GDPR. I met him before that was passed.

mateo411 7y ago

It's not a violation of GDPR. However, is somebody makes a GDPR request to retrieve all of their personal data, or to delete their personal data, then they must comply within 30 days. They have to organize their datasets to make these operations easy.

jdlshore 7y ago
There are six legal bases for processing personal data under the GDPR. Which do you think applies in this case? Additionally, sexual orientation is subject to special rules under the GDPR and cannot be processed at all without consent (and some edge cases). That could possibly apply as well.
- mateo411 7y ago
  I think the site would require that the visitor give consent when they visit.
  - jdlshore 7y ago
    You're not allowed to require consent in exchange for access to content.
    - mateo411 7y ago
      Really? Where is this rule stated in the GDPR?
      - jdlshore 7y ago
        Article 4 section 11 defines "consent" as something that must be freely given. [1] Article 7 section 4 further clarifies that consent is not freely given if provision of a service is conditional on consent. [2] Recital 43 is super clear: "Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." [3] The gdpr.eu website unpacks the legalese: "“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service." [4] [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ [2] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ [3] https://gdpr-info.eu/recitals/no-43/ https://gdpr-info.eu/recitals/no-43/ [4] https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/

ComputerGuru 7y ago

How long do you think GDPR has been around for? Why do you think it was passed?