3 ms·

Since GDPR topic was brought up, let me give some more details; GitLab seem to be well aware of GDPR. This was initial response from GitLab to my request (let'

Since GDPR topic was brought up, let me give some more details; GitLab seem to be well aware of GDPR. This was initial response from GitLab to my request (let's call it Template1): > We understand that you want to completely remove your GitLab.com account. > Due to the complexity of servicing these requests, we're asking our users to > please email gdpr-request at gitlab.com. > Please ensure that you: > - send the email from the address associated with your GitLab.com account > - include the GitLab username you'd like removed I did send an email to that address repeating my request, but shortly after I received this response (let's call it Template2): > We have additional updates with regards to our TOS and Telemetry services > below: > We understand that the recent announcement regarding the update to our Terms of > Service, specifically in regards to Telemetry, can lead to questions you have > about how it impacts your usage of GitLab. > To answer those questions and gather feedback on this recent update, we have > created this Issue with additional clarification. As we firmly believe that > everyone can contribute, we want to assure you all feedback you provide via the > Issue is both welcome and appreciated. > Kindly advise if you would still want us to proceed with this request. I repeated my request, reaffirming that I want to remove and erase my account. In response, they sent "Template1" email again. Edit: to be fair, it's been less than 24 hours since the request, and the repeated template-response from GitLab may have been a hiccup on the support side. But the whole new TOS switch could be handled much better and without dark patterns, i.e. during login, two buttons: [Accept new TOS] [Decline and erase account] However, right now there's simply no option to handle account removal conveniently when I want to decline the new TOS.

tremon 7y ago
> [Accept new TOS] [Decline and erase account]* Actually, that's still a GDPR violation. A user cannot sign away their rights in the ToS. From https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ "Conditions for consent": If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. [..] When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. In other words, if Gitlab ties the consent for telemetry together with access to the service itself, the consent is considered not freely given and therefore not legally binding at all.
dkersten 7y ago
> In response, they sent "Template1" email again. At this point I would simply wait the 30 days or whatever they have to respond and if they don't, complain to your data protection commissioner. They could get hit with a big fat fine for it, so its in their interest to make sure they respond correctly and don't send you around in circles.

tremon 7y ago

> [Accept new TOS] [Decline and erase account]* Actually, that's still a GDPR violation. A user cannot sign away their rights in the ToS. From https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ "Conditions for consent": If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. [..] When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. In other words, if Gitlab ties the consent for telemetry together with access to the service itself, the consent is considered not freely given and therefore not legally binding at all.

dkersten 7y ago

> In response, they sent "Template1" email again. At this point I would simply wait the 30 days or whatever they have to respond and if they don't, complain to your data protection commissioner. They could get hit with a big fat fine for it, so its in their interest to make sure they respond correctly and don't send you around in circles.