4 ms·
> Obviously if a company acquires another company they will acquire the email contacts and accounts as well. And LinkedIn has the right to connect accounts they
by m12k 6y ago
> Obviously if a company acquires another company they will acquire the email contacts and accounts as well. And LinkedIn has the right to connect accounts they own across their web properties.
Let's assume this is true, and see where it can take us. Let's imagine every online company in the US takes turns buying another such company, consolidating the user accounts, then splitting off/re-selling the other company. Eventually anybody that had an account with any company would have an account with every company, and this would be perfectly legal despite no users ever having been asked if their personal information could be shared?
I think this is the rub: "And LinkedIn has the right to connect accounts they own across their web properties" I cannot speak to US law, but that is not true of the GDPR - collection of personally identifiable information requires consent, and that consent must be given for a specific purpose. Use of that information outside of the initial purpose that was consented to requires the user to re-consent to the additional uses. So no, a company is not allowed to just transfer my PII to a different business unit that provides a different service without my consent (and optionally then sell off that business unit like they did in the linked post).
- cm2012 6y agoEven GDPR does not require fresh consent for every new product and service. You have to have to update the privacy policy, inform users you're doing so, and let them opt out if they want (no objection rule). Which is exactly what LI is doing here. Keep in mind LI is NOT using this as a scheme like you describe to sell 500m emails.
- emn13 6y agoI don't believe there is such a no objection rule - or perhaps I'm looking at it from a different angle - can you be more specific? Products and services aren't the issue; it's how you use+process users' data. Many products and services don't materially affect that, so won't require additional consent (e.g. if you're a company that sends news-updates by email to users that opted in, I don't believe sending them other updates is a PII issue - course, it might be spam, and IANAL). Also, products and services you're explicitly contracted for are exempt anyhow (e.g. if the user is paying you to remind them to take their meds on time, you don't need additional GDPR consent to store and process their sensitive personal data to the extent necessary to fulfill that contract - though other laws almost certainly apply to medical data).
- luckylion 6y agoThis isn't "a service" though, it's a different company (which LinkedIn owns). That's a third party with regards to GDPR, because, as it now happens, you can sell that company. If it was a LinkedIn-asset, that could look different (e.g. you can access YouTube with your Google Account created for GMail). But that would create another problem: if it was an asset (and not a company), you'd need opt-in from every user to transfer their user data over to the buyer, because the buyer would be a third party. It's either a company or an asset, it can't be both at the same time.