3 ms·

It's not a violation of GDPR. However, is somebody makes a GDPR request to retrieve all of their personal data, or to delete their personal data, then they must

It's not a violation of GDPR. However, is somebody makes a GDPR request to retrieve all of their personal data, or to delete their personal data, then they must comply within 30 days. They have to organize their datasets to make these operations easy.

jdlshore 7y ago
There are six legal bases for processing personal data under the GDPR. Which do you think applies in this case? Additionally, sexual orientation is subject to special rules under the GDPR and cannot be processed at all without consent (and some edge cases). That could possibly apply as well.
- mateo411 7y ago
  I think the site would require that the visitor give consent when they visit.
  - jdlshore 7y ago
    You're not allowed to require consent in exchange for access to content.
    - mateo411 7y ago
      Really? Where is this rule stated in the GDPR?
      - jdlshore 7y ago
        Article 4 section 11 defines "consent" as something that must be freely given. [1] Article 7 section 4 further clarifies that consent is not freely given if provision of a service is conditional on consent. [2] Recital 43 is super clear: "Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." [3] The gdpr.eu website unpacks the legalese: "“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service." [4] [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ [2] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ [3] https://gdpr-info.eu/recitals/no-43/ https://gdpr-info.eu/recitals/no-43/ [4] https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/

jdlshore 7y ago

There are six legal bases for processing personal data under the GDPR. Which do you think applies in this case? Additionally, sexual orientation is subject to special rules under the GDPR and cannot be processed at all without consent (and some edge cases). That could possibly apply as well.

mateo411 7y ago
I think the site would require that the visitor give consent when they visit.
- jdlshore 7y ago
  You're not allowed to require consent in exchange for access to content.
  - mateo411 7y ago
    Really? Where is this rule stated in the GDPR?
    - jdlshore 7y ago
      Article 4 section 11 defines "consent" as something that must be freely given. [1] Article 7 section 4 further clarifies that consent is not freely given if provision of a service is conditional on consent. [2] Recital 43 is super clear: "Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." [3] The gdpr.eu website unpacks the legalese: "“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service." [4] [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ [2] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ [3] https://gdpr-info.eu/recitals/no-43/ https://gdpr-info.eu/recitals/no-43/ [4] https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/