3 ms·

I posted this as a reply to a comment, but I will repeat it here, If they transmit crash logs, and those contain partial memory contents (core dumps), chances

I posted this as a reply to a comment, but I will repeat it here, If they transmit crash logs, and those contain partial memory contents (core dumps), chances are actual content from network packets are transmitted to UBNT as well, and those contents may contain PII (IP addresses, MAC addresses, usernames, passwords, real names, addresses, credit card information, etc.), meaning they’re most certainly violating the GDPR by making it opt out. The GDPR doesn’t care how you came by the PII, it only dictates how you should behave when you handle it. Edit: I should clarify before somebody trips over their pitchfork and sets the house on fire, the GDPR cares a lot about how you come into possession of PII, and also if you should have that information in the first place, and also cares about how long you hold on to it. When it comes to protection of those data though, it doesn’t care if it was collected through telemetry, emailed to you (yes, also the spam folder), or it’s an old archive of core dumps on an old server somewhere. The same rules apply to how those data are handled.

kasey_junk 7y ago
This is simply not true. Opt in is only one of many ways to be compliant with GDPR covered data. Legitimate interest is the obvious way to not require opt-in and while I’m sure the regulators are getting tired of seeing ad networks claim that exception a router company claiming it for crash support seems like something that will likely be deemed in bounds. Especially if that company has made a good faith effort to show its not repurposing that data.
- simpss 7y ago
  that would only be valid if crash support is requested and provided. As far as I know ubiquiti is pretty hands-off in terms of support, so the case isn't too valid.
- 8fingerlouie 7y ago
  >This is simply not true. Opt in is only one of many ways to be compliant with GDPR covered data. And yet, Article 32 (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679of https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... the GDPR states: Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. It is of course also possible that UBNT is fully GDPR compliant if they can guarantee that the don't send PII. The problem is we don't know.
  - kasey_junk 7y ago
    You are misunderstanding. You only need to collect consent via opt in if consent is your basis of collection. There are several other basis as well including ‘legitimate interest’. You can see all of the basis in article 6(1). If you use a different basis you don’t need to collect consent at all whether opt in or otherwise. Hardware data from crashes used just for cause analysis and properly stored/secured is a fairly straightforward ‘legitimate interest’ argument.

kasey_junk 7y ago

This is simply not true. Opt in is only one of many ways to be compliant with GDPR covered data. Legitimate interest is the obvious way to not require opt-in and while I’m sure the regulators are getting tired of seeing ad networks claim that exception a router company claiming it for crash support seems like something that will likely be deemed in bounds. Especially if that company has made a good faith effort to show its not repurposing that data.

simpss 7y ago
that would only be valid if crash support is requested and provided. As far as I know ubiquiti is pretty hands-off in terms of support, so the case isn't too valid.
8fingerlouie 7y ago
>This is simply not true. Opt in is only one of many ways to be compliant with GDPR covered data. And yet, Article 32 (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679of https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... the GDPR states: Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. It is of course also possible that UBNT is fully GDPR compliant if they can guarantee that the don't send PII. The problem is we don't know.
- kasey_junk 7y ago
  You are misunderstanding. You only need to collect consent via opt in if consent is your basis of collection. There are several other basis as well including ‘legitimate interest’. You can see all of the basis in article 6(1). If you use a different basis you don’t need to collect consent at all whether opt in or otherwise. Hardware data from crashes used just for cause analysis and properly stored/secured is a fairly straightforward ‘legitimate interest’ argument.