3 ms·

This is simply not true. Opt in is only one of many ways to be compliant with GDPR covered data. Legitimate interest is the obvious way to not require opt-in a

This is simply not true. Opt in is only one of many ways to be compliant with GDPR covered data. Legitimate interest is the obvious way to not require opt-in and while I’m sure the regulators are getting tired of seeing ad networks claim that exception a router company claiming it for crash support seems like something that will likely be deemed in bounds. Especially if that company has made a good faith effort to show its not repurposing that data.

simpss 7y ago
that would only be valid if crash support is requested and provided. As far as I know ubiquiti is pretty hands-off in terms of support, so the case isn't too valid.
8fingerlouie 7y ago
>This is simply not true. Opt in is only one of many ways to be compliant with GDPR covered data. And yet, Article 32 (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679of https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... the GDPR states: Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. It is of course also possible that UBNT is fully GDPR compliant if they can guarantee that the don't send PII. The problem is we don't know.
- kasey_junk 7y ago
  You are misunderstanding. You only need to collect consent via opt in if consent is your basis of collection. There are several other basis as well including ‘legitimate interest’. You can see all of the basis in article 6(1). If you use a different basis you don’t need to collect consent at all whether opt in or otherwise. Hardware data from crashes used just for cause analysis and properly stored/secured is a fairly straightforward ‘legitimate interest’ argument.

simpss 7y ago

that would only be valid if crash support is requested and provided. As far as I know ubiquiti is pretty hands-off in terms of support, so the case isn't too valid.

8fingerlouie 7y ago

>This is simply not true. Opt in is only one of many ways to be compliant with GDPR covered data. And yet, Article 32 (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679of https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... the GDPR states: Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. It is of course also possible that UBNT is fully GDPR compliant if they can guarantee that the don't send PII. The problem is we don't know.

kasey_junk 7y ago
You are misunderstanding. You only need to collect consent via opt in if consent is your basis of collection. There are several other basis as well including ‘legitimate interest’. You can see all of the basis in article 6(1). If you use a different basis you don’t need to collect consent at all whether opt in or otherwise. Hardware data from crashes used just for cause analysis and properly stored/secured is a fairly straightforward ‘legitimate interest’ argument.