5 ms·

> I am still searching for one site that I could give an example for GDPR and they are all blatantly violating it. I think the reason you can't find one is lik

> I am still searching for one site that I could give an example for GDPR and they are all blatantly violating it. I think the reason you can't find one is likely because you are disqualifying all the ones that aren't violating it. There a lots of websites that don't violate GDPR: they don't record any information. Perhaps we can quibble about server logs and whether or not IP addresses are PII, but let's stick to at least the broad strokes here since you are saying all sites blatantly violate GDPR. I think what you are probably trying to say is that amongst the websites that are trying to harvest your data, (virtually) all of them do so in a way that violates GDPR. This is not surprising to me, because at its heart GDPR is trying to encourage companies not to harvest personal information. I don't think we will ever get around that. The question is not whether or not many (most? virtually all?) companies will try to get around GDPR (they will). The question is whether or not GDPR will have an positive influence on the use of private data. I can say in the company I do work for, it has completely transformed how we deal with PII. We now actually have gatekeepers that tell marketing what they can and can't have access to. If there are problems, then people actually get chewed out and we put real, emergency resources into fixing them. I mean it is absolutely night and day. For us there is always this fight between people and departments that would like unrestricted access to information and people who are protecting it. Without GDPR, there was no defense! There was no argument you could make -- "It's wrong!" "By whose definition? The lawyers are fine with it" Now we can legitimately say, "You can't legally do that". Not only that, but I've even had marketing managers being very concerned that we might be handling data incorrectly. I've never, ever seen that before in my 30 year career. Yeah, there are lots of problems and I don't see them going away ever, but man GDPR is really helping in a lot of areas.

stiray 7y ago
Ok, I wasnt talking about protecting the data part. >The question is not whether or not many (most? virtually all?) companies will try to get around GDPR (they will) They arent getting around, they are violating it, based on GDPR beeing doe as a concept, you cant workaround it. The question is, when it will be enforced. I dont have anything against tracking, targeted ads etc. but if GDPR is followed, which means opt-in consents, no "lets stuff everthing under legitimate interest" and so on. Under GDPR conditions I am even prepared to turn off ad blockers. And I wont even start talking about mobile applications.
- mikekchar 7y ago
  But, "lets stuff everything under legitimate interest" is totally valid if it is actually legitimate interest. Opt-in consents under GDPR is probably your worst strategy. The lawful basis you want to be under is contract basis: you gather the information you need for the contract. You hold it until the contract is up and then you delete the information. That's the best for everyone. Legitimate interest is the next best for everyone. You collect the data for contract purposes and you retain it beyond the contract period, or you use it for something other than the contract, but it's for a legitimate reason. You must tell the user that you are using the data for the legitimate reason and what that legitimate reason is!!! It's a very good way to use data. If the user objects, then they can object and you can't use the data (you have 1 month to respond). After that (and ignoring lawful basis, etc) you have consent. Consent is an awful reason to collect and retain data. You don't need it for the contract. You have no legitimate reason to have the data or to use it. You just want it. So you ask the user if it's OK. No company should choose consent. It's horrible, even for the business. As I've written before, if the user opts out, there doesn't seem to be a way to opt them back in if they change their mind. So if there is any way for you to turn consent into contract basis, you really, definitely should! If there is some reason that the user would like to consent, they you shouldn't be using consent. You should offer them a service. It's super frustrating to me that people harp on about consent, because that it really going against the grain for GDPR.
  - stiray 7y ago
    You got the legitimate interest wrong. I wont bother explaining, as I am sick of downvoting (would love to discuss recitals), here is presentation from Tim Walters, check the legitinate interest (or the whole, you might be surprised): https://www.youtube.com/watch?v=-stjktAu-7k https://www.youtube.com/watch?v=-stjktAu-7k Bottom line, "the grain" of GDPR is user interest. Not "user expirience", not bussines interest. Users interest. And it is HARD to decide instead of him, I would rather pop up consent dialog with opt-in than showel everything under legitimate interest. As it is so easy to make it wrong: sure, you are sending a packet to the customer, you need (legitimate interes) address, phone number comes handy (requiring it is fishy), forcing it to protect login on a social network? I wouldnt do it. For me, as a security aware person, you would crawl trying to prove I am in danger with 15 letter random generated passwords generated for each and every site. Unlike for John Doe. So, it becomes optional, while forcing it, in my case, violates GDPR. It was just one example. But anyway, check Tim Walters.

stiray 7y ago

Ok, I wasnt talking about protecting the data part. >The question is not whether or not many (most? virtually all?) companies will try to get around GDPR (they will) They arent getting around, they are violating it, based on GDPR beeing doe as a concept, you cant workaround it. The question is, when it will be enforced. I dont have anything against tracking, targeted ads etc. but if GDPR is followed, which means opt-in consents, no "lets stuff everthing under legitimate interest" and so on. Under GDPR conditions I am even prepared to turn off ad blockers. And I wont even start talking about mobile applications.

mikekchar 7y ago
But, "lets stuff everything under legitimate interest" is totally valid if it is actually legitimate interest. Opt-in consents under GDPR is probably your worst strategy. The lawful basis you want to be under is contract basis: you gather the information you need for the contract. You hold it until the contract is up and then you delete the information. That's the best for everyone. Legitimate interest is the next best for everyone. You collect the data for contract purposes and you retain it beyond the contract period, or you use it for something other than the contract, but it's for a legitimate reason. You must tell the user that you are using the data for the legitimate reason and what that legitimate reason is!!! It's a very good way to use data. If the user objects, then they can object and you can't use the data (you have 1 month to respond). After that (and ignoring lawful basis, etc) you have consent. Consent is an awful reason to collect and retain data. You don't need it for the contract. You have no legitimate reason to have the data or to use it. You just want it. So you ask the user if it's OK. No company should choose consent. It's horrible, even for the business. As I've written before, if the user opts out, there doesn't seem to be a way to opt them back in if they change their mind. So if there is any way for you to turn consent into contract basis, you really, definitely should! If there is some reason that the user would like to consent, they you shouldn't be using consent. You should offer them a service. It's super frustrating to me that people harp on about consent, because that it really going against the grain for GDPR.
- stiray 7y ago
  You got the legitimate interest wrong. I wont bother explaining, as I am sick of downvoting (would love to discuss recitals), here is presentation from Tim Walters, check the legitinate interest (or the whole, you might be surprised): https://www.youtube.com/watch?v=-stjktAu-7k https://www.youtube.com/watch?v=-stjktAu-7k Bottom line, "the grain" of GDPR is user interest. Not "user expirience", not bussines interest. Users interest. And it is HARD to decide instead of him, I would rather pop up consent dialog with opt-in than showel everything under legitimate interest. As it is so easy to make it wrong: sure, you are sending a packet to the customer, you need (legitimate interes) address, phone number comes handy (requiring it is fishy), forcing it to protect login on a social network? I wouldnt do it. For me, as a security aware person, you would crawl trying to prove I am in danger with 15 letter random generated passwords generated for each and every site. Unlike for John Doe. So, it becomes optional, while forcing it, in my case, violates GDPR. It was just one example. But anyway, check Tim Walters.