4 ms·

The GDPR "obviously" doesn't allow this, and as the blog says, this is a developer in London.

tssva 6y ago
It is not obvious the GDPR doesn't allow this. Transfer of data during sale of a business is allowed under the GDPR. Notification of a change in controller is required but there is no opt-in requirement. If the deal is structured so that it is a transfer of shares there is no need to even notify because the controller is considers to be the same.
- BlackFly 6y ago
  No, it seems pretty obvious. Each use case of processing of personal information must satisfy the GDPR necessary requirement or have a priori informed consent. During merger of Scribd into LinkenIn, they can argue that it is necessary to treat the databases as a single controller as a cost cutting measure. However, if they are going to treat Scribd as a separate severable entity, then it cannot be argued that it is necessary to process personal information into the Scribd databases which going forward will only process data in a manner not consented to. If Scribd is not able to distinguish at that point original users that have meaningfully consented to being processed by Scribd from LinkedIn users who have not meaningfully consented to being processed, then they have no meaningful consent at all and therefore no real lawful user data because not knowing if a user has meaningfully consented or not is equivalent to not having meaningful consent for that user. The most similar scenario is when GDPR took effect and many companies essentially had no meaningful consent for their userbase. During the grace period between GDPR taking effect and GDPR fines being enforceable, companies contacted their userbase to acquire consent and the diligent companies destroyed the user records of the users that did not contact them back since meaningful consent cannot be opt out. Of course, many companies were not diligent and held onto user records nevertheless and are waiting to see if they will have to pay the piper or not. This is easily distinct from change of a controller when the new controller will continue the business: consent to have data processed in a particular way was acquired. In this case the separated entity will process data in a manner which was not consented to. Unless Scribd is somehow going to try to convince recruiters to use their service to find users who are going to manicure CV like profiles, which is more or less what LinkedIn users consent to.
  - tssva 6y ago
    But at least at this point Scribd has announced that they intend to run Slideshare as a separate entity and the database will not be integrated with the Scribd database.
    - nottorp 6y ago
      But every Linkedin user was signed up to SlideShare automatically.
- luckylion 6y ago
  You'd need to get opt-in for sharing the data from LinkedIn with SlideShare though, because the contract between LinkedIn and the user does not extend to SlideShare as a different entity. In my understanding: either they violated GDPR by sharing data with SlideShare, or they violate it by selling SlideShare to Scribd.
yxhuvud 6y ago
Does GDPR still apply to London though, or is that yet another victim of Brexit? But yeah, the rest of EU is clearly off limit.
- isostatic 6y ago
  The GDPR was implemented in UK law by the Data Protection Act 2018 https://www.legislation.gov.uk/ukpga/2018/12/contents https://www.legislation.gov.uk/ukpga/2018/12/contents Which is still in force

It is not obvious the GDPR doesn't allow this. Transfer of data during sale of a business is allowed under the GDPR. Notification of a change in controller is required but there is no opt-in requirement. If the deal is structured so that it is a transfer of shares there is no need to even notify because the controller is considers to be the same.

BlackFly 6y ago
No, it seems pretty obvious. Each use case of processing of personal information must satisfy the GDPR necessary requirement or have a priori informed consent. During merger of Scribd into LinkenIn, they can argue that it is necessary to treat the databases as a single controller as a cost cutting measure. However, if they are going to treat Scribd as a separate severable entity, then it cannot be argued that it is necessary to process personal information into the Scribd databases which going forward will only process data in a manner not consented to. If Scribd is not able to distinguish at that point original users that have meaningfully consented to being processed by Scribd from LinkedIn users who have not meaningfully consented to being processed, then they have no meaningful consent at all and therefore no real lawful user data because not knowing if a user has meaningfully consented or not is equivalent to not having meaningful consent for that user. The most similar scenario is when GDPR took effect and many companies essentially had no meaningful consent for their userbase. During the grace period between GDPR taking effect and GDPR fines being enforceable, companies contacted their userbase to acquire consent and the diligent companies destroyed the user records of the users that did not contact them back since meaningful consent cannot be opt out. Of course, many companies were not diligent and held onto user records nevertheless and are waiting to see if they will have to pay the piper or not. This is easily distinct from change of a controller when the new controller will continue the business: consent to have data processed in a particular way was acquired. In this case the separated entity will process data in a manner which was not consented to. Unless Scribd is somehow going to try to convince recruiters to use their service to find users who are going to manicure CV like profiles, which is more or less what LinkedIn users consent to.
- tssva 6y ago
  But at least at this point Scribd has announced that they intend to run Slideshare as a separate entity and the database will not be integrated with the Scribd database.
  - nottorp 6y ago
    But every Linkedin user was signed up to SlideShare automatically.
luckylion 6y ago
You'd need to get opt-in for sharing the data from LinkedIn with SlideShare though, because the contract between LinkedIn and the user does not extend to SlideShare as a different entity. In my understanding: either they violated GDPR by sharing data with SlideShare, or they violate it by selling SlideShare to Scribd.

yxhuvud 6y ago

Does GDPR still apply to London though, or is that yet another victim of Brexit? But yeah, the rest of EU is clearly off limit.

isostatic 6y ago
The GDPR was implemented in UK law by the Data Protection Act 2018 https://www.legislation.gov.uk/ukpga/2018/12/contents https://www.legislation.gov.uk/ukpga/2018/12/contents Which is still in force