6 ms·

In which way is this a violation? It is not illegal for companies to process the data which you have signed away with a contract. It is allowed if [1] >they ha

In which way is this a violation? It is not illegal for companies to process the data which you have signed away with a contract. It is allowed if [1] >they have a contract with you – for example, a contract to supply goods or services (i.e. when you buy something online), or an employee contract You just have the right to request that your data is deleted but as long as you don't do that, why should your data not be processed? Additionally, it is allowed to process private data without a contract if it is necessary. Then, an excessive use of private data is illegal. But most services will have a contract and thus it is legal. Minor detail: services cannot be restricted if you don't agree to share your private data. But that doesn't touch sharing the data that was signed away with a contract. [1] https://europa.eu/youreurope/citizens/consumers/internet-telecoms/data-protection-online-privacy/index_en.htm https://europa.eu/youreurope/citizens/consumers/internet-tel...

grabeh 7y ago
The concept of processing necessary for the performance of a contract is interpreted extremely narrowly by data protection law. Rightly so, because otherwise it would give entities far too much latitude to stuff as many different processing activities as possible within that ground, even though certain processing activities aren't at all necessary to provide the service. With Grindr, they only need to process data to provide the service by making it available to you and to other users. What they definitely don't need to do in order to provide the core service is to share your data with third parties who can then use it for their own purposes. Any argument that the processing is necessary because it's an ad-funded service would not be acceptable under data protection law. On that basis, performance of a contract would not be a relevant ground. You're also looking at e-Privacy Directive considerations in the EU where either a cookie or similar is essential to provide the service, or you need consent. Similar for location data, you will generally need consent. So you not only have GDPR issues but also e-Privacy Directive issues where your processing grounds are actually incredibly limited anyway.
- toohotatopic 7y ago
  >or you need consent That was my point. People sign contracts where they consent to sharing. The advertising industry is not breaking the law because they don't use the data that is necessary for the performance but they use the data that is voluntarily shared.
  - anonymousab 7y ago
    And as mentioned above, the sharing aspect of those contacts is more or less void if the personal information sharing was implied to be required to use the service, and/or was not opt-in such that the option without opting in was not the prominent default.
anonymousab 7y ago
> Minor detail: services cannot be restricted if you don't agree to share your private data. But that doesn't touch sharing the data that was signed away with a contract. That's not minor, it's major. It invalidates any sort of "let us use your data in order to use the app" profiteering clickwrap nonsense, and any kind of "contract" derived from that would be void.
- toohotatopic 7y ago
  You don't have to exclude people, you just have to make it inconvenient to not click ok. The majority will accept the default value. It is the same with ad-blockers. Youtube would be bankrupt if people weren't lazy.
  - kuschku 7y ago
    Also wrong, the "not share" option has to be default, and displayed larger and clearly visible
    - toohotatopic 7y ago
      Can you give me a reference for that, please. I have only found [1]: >It states that you should integrate data protection from the designing stage of processing activities. Article 25 of GDPR lists the requirements for data protection by design and default. But that's the processing, not the agreement. And about consent [2]: >Freely given - the person must not be pressured into giving consent or suffer any detriment if they refuse. >Specific - the person must be asked to consent to individual types of data processing. >Informed - the person must be told what they're consenting to. >Unambiguous - language must be clear and simple. >Clear affirmative action - the person must expressly consent by doing or saying something. But freely given doesn't forbid using the default or does it? [1]https://www.cookielawinfo.com/gdpr-privacy-by-design-and-default/ https://www.cookielawinfo.com/gdpr-privacy-by-design-and-def... [2]https://www.privacypolicies.com/blog/gdpr-consent-examples/ https://www.privacypolicies.com/blog/gdpr-consent-examples/
      - 7y ago
tremon 7y ago
It is not illegal for companies to process the data which you have signed away with a contract. This isn't true. The actual GDPR text on consent states [1]: the data subject has given consent to the processing of his or her personal data for one or more specific purposes; -> So processing of data based on consent is limited to the purposes agreed to. or processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject -> So processing of data is necessary to fulfill a request made by the data subject. This is a far cry from "processing the data which you have signed away". The only blanket allowance for data processing is this item: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data Which again limits the processing allowed under GDPR: processing of data under this rule requires the legitimate business interest to be weighed against the subject's personal rights. [1] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
- toohotatopic 7y ago
  >So processing of data based on consent is limited to the purposes agreed to. Why does this exclude a broad clause, e.g. one that states that the data is used to show the most fitting advertisements. You can see that purpose on many webpages. Almost any current data processing will fall within that area. In conclusion, I still think that you can sign away the right to process your data.
  - alleyshack 7y ago
    From the article: > The extent of tracking makes it impossible for us to make informed choices about how our personal data is collected, shared and used, says Finn Myrstad, director of digital policy in the Norwegian Consumer Council. The Council's point is that the average consumer is not capable of meaningful consent due to the extent and obfuscation of the tracking involved. Much of contract law, afaik, requires a person to be capable of consent at the time of signing for a contract to be valid. The Council's argument, therefore, is that even if technically a consumer has "signed away" the right to process their data, the contract is not valid because the consumer is not able to, and/or cannot get the information required to, make an informed choice when signing.
stubish 7y ago
There are rights that you cannot sign away. For example you can't sell yourself into slavery in most countries. The signed contract is irrelevant because it is unenforceable in law, in much the same way as if it contained a clause putting you in indentured servitude for violations of the TOS. Its only purpose is to obscure people's rights.

grabeh 7y ago

The concept of processing necessary for the performance of a contract is interpreted extremely narrowly by data protection law. Rightly so, because otherwise it would give entities far too much latitude to stuff as many different processing activities as possible within that ground, even though certain processing activities aren't at all necessary to provide the service. With Grindr, they only need to process data to provide the service by making it available to you and to other users. What they definitely don't need to do in order to provide the core service is to share your data with third parties who can then use it for their own purposes. Any argument that the processing is necessary because it's an ad-funded service would not be acceptable under data protection law. On that basis, performance of a contract would not be a relevant ground. You're also looking at e-Privacy Directive considerations in the EU where either a cookie or similar is essential to provide the service, or you need consent. Similar for location data, you will generally need consent. So you not only have GDPR issues but also e-Privacy Directive issues where your processing grounds are actually incredibly limited anyway.

toohotatopic 7y ago
>or you need consent That was my point. People sign contracts where they consent to sharing. The advertising industry is not breaking the law because they don't use the data that is necessary for the performance but they use the data that is voluntarily shared.
- anonymousab 7y ago
  And as mentioned above, the sharing aspect of those contacts is more or less void if the personal information sharing was implied to be required to use the service, and/or was not opt-in such that the option without opting in was not the prominent default.

anonymousab 7y ago

> Minor detail: services cannot be restricted if you don't agree to share your private data. But that doesn't touch sharing the data that was signed away with a contract. That's not minor, it's major. It invalidates any sort of "let us use your data in order to use the app" profiteering clickwrap nonsense, and any kind of "contract" derived from that would be void.

toohotatopic 7y ago
You don't have to exclude people, you just have to make it inconvenient to not click ok. The majority will accept the default value. It is the same with ad-blockers. Youtube would be bankrupt if people weren't lazy.
- kuschku 7y ago
  Also wrong, the "not share" option has to be default, and displayed larger and clearly visible
  - toohotatopic 7y ago
    Can you give me a reference for that, please. I have only found [1]: >It states that you should integrate data protection from the designing stage of processing activities. Article 25 of GDPR lists the requirements for data protection by design and default. But that's the processing, not the agreement. And about consent [2]: >Freely given - the person must not be pressured into giving consent or suffer any detriment if they refuse. >Specific - the person must be asked to consent to individual types of data processing. >Informed - the person must be told what they're consenting to. >Unambiguous - language must be clear and simple. >Clear affirmative action - the person must expressly consent by doing or saying something. But freely given doesn't forbid using the default or does it? [1]https://www.cookielawinfo.com/gdpr-privacy-by-design-and-default/ https://www.cookielawinfo.com/gdpr-privacy-by-design-and-def... [2]https://www.privacypolicies.com/blog/gdpr-consent-examples/ https://www.privacypolicies.com/blog/gdpr-consent-examples/
    - 7y ago

tremon 7y ago

It is not illegal for companies to process the data which you have signed away with a contract. This isn't true. The actual GDPR text on consent states [1]: the data subject has given consent to the processing of his or her personal data for one or more specific purposes; -> So processing of data based on consent is limited to the purposes agreed to. or processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject -> So processing of data is necessary to fulfill a request made by the data subject. This is a far cry from "processing the data which you have signed away". The only blanket allowance for data processing is this item: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data Which again limits the processing allowed under GDPR: processing of data under this rule requires the legitimate business interest to be weighed against the subject's personal rights. [1] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

toohotatopic 7y ago
>So processing of data based on consent is limited to the purposes agreed to. Why does this exclude a broad clause, e.g. one that states that the data is used to show the most fitting advertisements. You can see that purpose on many webpages. Almost any current data processing will fall within that area. In conclusion, I still think that you can sign away the right to process your data.
- alleyshack 7y ago
  From the article: > The extent of tracking makes it impossible for us to make informed choices about how our personal data is collected, shared and used, says Finn Myrstad, director of digital policy in the Norwegian Consumer Council. The Council's point is that the average consumer is not capable of meaningful consent due to the extent and obfuscation of the tracking involved. Much of contract law, afaik, requires a person to be capable of consent at the time of signing for a contract to be valid. The Council's argument, therefore, is that even if technically a consumer has "signed away" the right to process their data, the contract is not valid because the consumer is not able to, and/or cannot get the information required to, make an informed choice when signing.

stubish 7y ago

There are rights that you cannot sign away. For example you can't sell yourself into slavery in most countries. The signed contract is irrelevant because it is unenforceable in law, in much the same way as if it contained a clause putting you in indentured servitude for violations of the TOS. Its only purpose is to obscure people's rights.