4 ms·

Is it even possible for this to be GDPR-compliant without even a way to opt out? I’m not very well-read in the subject, but I thought stuff like this had to be

by mokus 7y ago

Is it even possible for this to be GDPR-compliant without even a way to opt out? I’m not very well-read in the subject, but I thought stuff like this had to be opt-in under GDPR?

0xcde4c3db 7y ago
As far as I know, GDPR only applies to data that somehow relates to a person. If telemetry e.g. only sent build number + backtrace for crashes and the IP address wasn't logged, it seems like that would be allowed under GDPR.
- dvdkhlng 7y ago
  How does it sent back data without revealing the source IP address? :)
  - 0xcde4c3db 7y ago
    I don't think GDPR attaches to every piece of data that one could hypothetically observe.
    - chopin 7y ago
      It attaches to date you actually observe. I am sure the IP address is part of that. Enough to make the thing GDPR relevant. If someone complains they're going to have a bad time.
simpss 7y ago
it's impossible to verify as we don't know what data is actually being sent. But there's a hint in the ToS and that doesn't sound very anonymized. ----------------------- From their privacy policy: https://www.ui.com/legal/privacypolicy/#c1 https://www.ui.com/legal/privacypolicy/#c1 The Usage Data that we collect may include information such as your device data, including your mobile devices, sensor data, device signals, device parameters, device identifiers that may uniquely identify your devices, including your mobile device, web request, Internet Protocol address, browser type, browser language, referring/exit pages and URLs, platform type, the date and time of your request, and one or more cookies that may uniquely identify your devices or browser. IN ADDITION, WE MAY AUTOMATICALLY COLLECT LOCATION INFORMATION (INCLUDING LATITUDE AND LONGITUDE), PERFORMANCE DATA, MOTION DATA, TEMPERATURE DATA, POWER USAGE DATA, AND ANY DATA OR SIGNALS COLLECTED BY THE DEVICES AS PART OF THE USAGE DATA. WE DO NOT COLLECT THE CONTENTS OF ANY COMMUNICATIONS THAT PASS THROUGH OUR DEVICES OR SERVICES. ----------------------- By this desription, it certainly isn't GDPR compliant. device identifiers/data etc.. is PII in GDPR context and requires a legal basis for processing.

by mokus 7y ago

Is it even possible for this to be GDPR-compliant without even a way to opt out? I’m not very well-read in the subject, but I thought stuff like this had to be opt-in under GDPR?

0xcde4c3db 7y ago

As far as I know, GDPR only applies to data that somehow relates to a person. If telemetry e.g. only sent build number + backtrace for crashes and the IP address wasn't logged, it seems like that would be allowed under GDPR.

dvdkhlng 7y ago
How does it sent back data without revealing the source IP address? :)
- 0xcde4c3db 7y ago
  I don't think GDPR attaches to every piece of data that one could hypothetically observe.
  - chopin 7y ago
    It attaches to date you actually observe. I am sure the IP address is part of that. Enough to make the thing GDPR relevant. If someone complains they're going to have a bad time.

simpss 7y ago

it's impossible to verify as we don't know what data is actually being sent. But there's a hint in the ToS and that doesn't sound very anonymized. ----------------------- From their privacy policy: https://www.ui.com/legal/privacypolicy/#c1 https://www.ui.com/legal/privacypolicy/#c1 The Usage Data that we collect may include information such as your device data, including your mobile devices, sensor data, device signals, device parameters, device identifiers that may uniquely identify your devices, including your mobile device, web request, Internet Protocol address, browser type, browser language, referring/exit pages and URLs, platform type, the date and time of your request, and one or more cookies that may uniquely identify your devices or browser. IN ADDITION, WE MAY AUTOMATICALLY COLLECT LOCATION INFORMATION (INCLUDING LATITUDE AND LONGITUDE), PERFORMANCE DATA, MOTION DATA, TEMPERATURE DATA, POWER USAGE DATA, AND ANY DATA OR SIGNALS COLLECTED BY THE DEVICES AS PART OF THE USAGE DATA. WE DO NOT COLLECT THE CONTENTS OF ANY COMMUNICATIONS THAT PASS THROUGH OUR DEVICES OR SERVICES. ----------------------- By this desription, it certainly isn't GDPR compliant. device identifiers/data etc.. is PII in GDPR context and requires a legal basis for processing.