2 ms·

But, "lets stuff everything under legitimate interest" is totally valid if it is actually legitimate interest. Opt-in consents under GDPR is probably your wors

But, "lets stuff everything under legitimate interest" is totally valid if it is actually legitimate interest. Opt-in consents under GDPR is probably your worst strategy. The lawful basis you want to be under is contract basis: you gather the information you need for the contract. You hold it until the contract is up and then you delete the information. That's the best for everyone. Legitimate interest is the next best for everyone. You collect the data for contract purposes and you retain it beyond the contract period, or you use it for something other than the contract, but it's for a legitimate reason. You must tell the user that you are using the data for the legitimate reason and what that legitimate reason is!!! It's a very good way to use data. If the user objects, then they can object and you can't use the data (you have 1 month to respond). After that (and ignoring lawful basis, etc) you have consent. Consent is an awful reason to collect and retain data. You don't need it for the contract. You have no legitimate reason to have the data or to use it. You just want it. So you ask the user if it's OK. No company should choose consent. It's horrible, even for the business. As I've written before, if the user opts out, there doesn't seem to be a way to opt them back in if they change their mind. So if there is any way for you to turn consent into contract basis, you really, definitely should! If there is some reason that the user would like to consent, they you shouldn't be using consent. You should offer them a service. It's super frustrating to me that people harp on about consent, because that it really going against the grain for GDPR.

stiray 7y ago
You got the legitimate interest wrong. I wont bother explaining, as I am sick of downvoting (would love to discuss recitals), here is presentation from Tim Walters, check the legitinate interest (or the whole, you might be surprised): https://www.youtube.com/watch?v=-stjktAu-7k https://www.youtube.com/watch?v=-stjktAu-7k Bottom line, "the grain" of GDPR is user interest. Not "user expirience", not bussines interest. Users interest. And it is HARD to decide instead of him, I would rather pop up consent dialog with opt-in than showel everything under legitimate interest. As it is so easy to make it wrong: sure, you are sending a packet to the customer, you need (legitimate interes) address, phone number comes handy (requiring it is fishy), forcing it to protect login on a social network? I wouldnt do it. For me, as a security aware person, you would crawl trying to prove I am in danger with 15 letter random generated passwords generated for each and every site. Unlike for John Doe. So, it becomes optional, while forcing it, in my case, violates GDPR. It was just one example. But anyway, check Tim Walters.
- mikekchar 7y ago
  I don't think we are at odds with what you are saying. I'm 45 minutes through Tim Walters' video and there is absolutely nothing new for me so far. I suspect I'll get to the end and there will still be nothing new for me because I'm starting in the same place he is. As for your example, I totally agree! Forcing you to log in to a social network to send a package is crazy. I order cheese making supplies on the internet because I have no other way to buy them. Not a single supplier of cheese making supplies even offers to make me log into a social network. You're making the statement that all sites are blatantly disregarding the GDPR and I think it's because you just don't pay attention to the sites that aren't. I'll give you an example (which is is cheese making again). I wanted to check the shipping costs for cheesemaking.com. I don't like the fact that they make me fill out all of their order forms before they tell me the shipping cost, but they do. They have a newsletter which they use to do their marketing, but for now I've not signed up for it. When I didn't complete the process, they sent me an email. They asked if something went wrong and said they will hold my order for 48 hours. After that, they will delete all of my information. And these guys aren't even in the EU (and neither am I, although I work on contract for a company that is). This kind of behaviour is exactly what I expect and I think it is completely in line with the directives. The only thing they were missing is telling me under which lawful basis they were operating in each case. Is it contract basis? Keep in mind that as far as I can tell, "contract basis" does not actually require a contract to be in place (i.e. you don't have to have consideration), so I think there is an argument for saying that since I contacted them and started to initiate a purchase, following up on why I didn't finish (for a limited time period) is within the directive. Even if it weren't, it is almost definitely within legitimate interest. To really qualify for that, they would have to offer to let be object, but since they will delete my data after 48 hours I think they are following the spirit of the directive (because you only have to respond within 1 month). I don't know. I think the reason you keep getting down voted is because you seem to be focussed on something that is different than what everyone else is talking about. It's absolutely true that there are a lot of companies who don't give a flying monkey's about GDPR. But it is untrue that there isn't anyone. The rest is details and as Tim Walters is at pain to explain the GDPR specifically is not prescriptive because they want you to follow the principles not a check list of rules.

stiray 7y ago

You got the legitimate interest wrong. I wont bother explaining, as I am sick of downvoting (would love to discuss recitals), here is presentation from Tim Walters, check the legitinate interest (or the whole, you might be surprised): https://www.youtube.com/watch?v=-stjktAu-7k https://www.youtube.com/watch?v=-stjktAu-7k Bottom line, "the grain" of GDPR is user interest. Not "user expirience", not bussines interest. Users interest. And it is HARD to decide instead of him, I would rather pop up consent dialog with opt-in than showel everything under legitimate interest. As it is so easy to make it wrong: sure, you are sending a packet to the customer, you need (legitimate interes) address, phone number comes handy (requiring it is fishy), forcing it to protect login on a social network? I wouldnt do it. For me, as a security aware person, you would crawl trying to prove I am in danger with 15 letter random generated passwords generated for each and every site. Unlike for John Doe. So, it becomes optional, while forcing it, in my case, violates GDPR. It was just one example. But anyway, check Tim Walters.

mikekchar 7y ago
I don't think we are at odds with what you are saying. I'm 45 minutes through Tim Walters' video and there is absolutely nothing new for me so far. I suspect I'll get to the end and there will still be nothing new for me because I'm starting in the same place he is. As for your example, I totally agree! Forcing you to log in to a social network to send a package is crazy. I order cheese making supplies on the internet because I have no other way to buy them. Not a single supplier of cheese making supplies even offers to make me log into a social network. You're making the statement that all sites are blatantly disregarding the GDPR and I think it's because you just don't pay attention to the sites that aren't. I'll give you an example (which is is cheese making again). I wanted to check the shipping costs for cheesemaking.com. I don't like the fact that they make me fill out all of their order forms before they tell me the shipping cost, but they do. They have a newsletter which they use to do their marketing, but for now I've not signed up for it. When I didn't complete the process, they sent me an email. They asked if something went wrong and said they will hold my order for 48 hours. After that, they will delete all of my information. And these guys aren't even in the EU (and neither am I, although I work on contract for a company that is). This kind of behaviour is exactly what I expect and I think it is completely in line with the directives. The only thing they were missing is telling me under which lawful basis they were operating in each case. Is it contract basis? Keep in mind that as far as I can tell, "contract basis" does not actually require a contract to be in place (i.e. you don't have to have consideration), so I think there is an argument for saying that since I contacted them and started to initiate a purchase, following up on why I didn't finish (for a limited time period) is within the directive. Even if it weren't, it is almost definitely within legitimate interest. To really qualify for that, they would have to offer to let be object, but since they will delete my data after 48 hours I think they are following the spirit of the directive (because you only have to respond within 1 month). I don't know. I think the reason you keep getting down voted is because you seem to be focussed on something that is different than what everyone else is talking about. It's absolutely true that there are a lot of companies who don't give a flying monkey's about GDPR. But it is untrue that there isn't anyone. The rest is details and as Tim Walters is at pain to explain the GDPR specifically is not prescriptive because they want you to follow the principles not a check list of rules.