4 ms·

If they need the e-mail address for legal reasons then you can not withdraw consent, as consent was not the legal basis for storing this data in the first place

If they need the e-mail address for legal reasons then you can not withdraw consent, as consent was not the legal basis for storing this data in the first place. They also correctly inform you about changes in the terms of service, as this likely affects the data they store on you (e.g. they might have another legal basis for storing it).

donohoe 6y ago
Just want to emphasize how correct this is. Legally, despite but you nay want, they can still store info like thus for narrow reasons. This is Beardsley and normal.
- cxr 6y ago
  Even if true, neither you nor the person you're responding to see a distinction between: 1. retaining information because of a legal requirement and acting on their legal obligations as is necessary from time to time 2. retaining the information as above while saying that there's no such thing?
- hyperdimension 6y ago
  I'm usually decent at mental-typo-correction and typically won't point it out, but is 'Beardsley' supposed to be 'ordinary?'
luckylion 6y ago
How would a change to the terms of service change the legal basis? When the contract has been terminated, changes to TOS no longer apply to you, as you don't have a contract. The only way I see that to matter is if their TOS said they'd save more data/ save it for longer than legally required. Changing their TOS would then affect what data they'd store on ex-customers if they retro-actively applied it. However, their TOS would be irrelevant in that case, as they'd violate GDPR.
- isbvhodnvemrwvn 6y ago
  There might be a new law which requires data on customers in germany to collect your transaction data for 10 years rather than 5 years. They can't apply it retroactively to data which they already had no right to process (for instance 7 years-old transactions at the time when the law required 5 years), but they can (and have to) apply to a transaction you did 3 years ago (which will now be held for 7 years rather than 2). They might also lessen the amount of data they hold on you, maybe after a review of what they actually needed. I agree they should not send you anything if they store no data whatsoever, but if they do - they should probably inform you about changes in their privacy policies, even if they don't affect you personally.
  - luckylion 6y ago
    > but they can (and have to) apply to a transaction you did 3 years ago (which will now be held for 7 years rather than 2). Are you sure? Laws that compel you to do something usually don't go into effect retroactively. They're like price-hikes in that regard: you can't just unilaterally decide that your customer's monthly subscription fee has doubled since three years ago. In any case, it wouldn't have anything to do with their TOS or privacy policies, and I don't think they'd have to inform you about their compliance with the current laws. > they should probably inform you about changes in their privacy policies, even if they don't affect you personally You're not a customer at that point, why would you be getting information that only concerns customers? Updating someone on the TOS changes implies that they either requested to be updated or are a customer. I understand the idea behind preferring to err on the side of informing too many people rather than too few, but we should value the recipient's time and attention as well. And once we do that, I believe it's clear that the sender has to spend the extra time to figure out who should receive this email and who shouldn't.
wl 6y ago
Their "legal reasons" can go jump off a cliff when someone else signs up for something with my email address. I didn't agree to any of this, including their ToS in all forms. Unsubscribe means unsubscribe. Any further email will be marked as spam.
- isbvhodnvemrwvn 6y ago
  What you wrote is based on emotions and not on law, and will be disregarded. The law allows many more reasons for processing your e-mail or other personal data without your consent.
  - luckylion 6y ago
    Not by a random private company. The parent comment seems to talk about cases where somebody signed up with somebody else's email address. There are plenty of that kind of stories around, and a few have made front page here. A company that does not validate that the email address actually belongs to the person/entity they have consent from does not have any reason to store and process that email address. The same goes for other PII. If I sign up with your data, you've never consented, and whatever terms I accepted with a click or two have no relevance to you. Companies just usually don't bother with validation unless they need it for billing purposes, because it's a hassle and might make the customer reconsider.
Hamuko 6y ago
>If they need the e-mail address for legal reasons then you can not withdraw consent, as consent was not the legal basis for storing this data in the first place. No, I can widthdraw consent as much as I want. If they have a legal basis for storing my email address, then they can keep it regardless of my consent. However, I have no way of knowing if they actually have a legal basis for storing my email address or if they are just holding onto it.
- isbvhodnvemrwvn 6y ago
  That's what I said. Your can withdraw consent (which you never gave), or tell them that you like color purple more than you like red, but it will have no effect since it's not the basis for processing it. The privacy policy should list what data they collect and for what reason. However if they process your e-mail for several purposes based on different legal basis (for instance they also use e-mail for marketing purposes), they should stop using it for these reasons which you requested (for instance - all applicable) where consent was the basis for processing.

donohoe 6y ago

Just want to emphasize how correct this is. Legally, despite but you nay want, they can still store info like thus for narrow reasons. This is Beardsley and normal.

cxr 6y ago
Even if true, neither you nor the person you're responding to see a distinction between: 1. retaining information because of a legal requirement and acting on their legal obligations as is necessary from time to time 2. retaining the information as above while saying that there's no such thing?
hyperdimension 6y ago
I'm usually decent at mental-typo-correction and typically won't point it out, but is 'Beardsley' supposed to be 'ordinary?'

luckylion 6y ago

How would a change to the terms of service change the legal basis? When the contract has been terminated, changes to TOS no longer apply to you, as you don't have a contract. The only way I see that to matter is if their TOS said they'd save more data/ save it for longer than legally required. Changing their TOS would then affect what data they'd store on ex-customers if they retro-actively applied it. However, their TOS would be irrelevant in that case, as they'd violate GDPR.

isbvhodnvemrwvn 6y ago
There might be a new law which requires data on customers in germany to collect your transaction data for 10 years rather than 5 years. They can't apply it retroactively to data which they already had no right to process (for instance 7 years-old transactions at the time when the law required 5 years), but they can (and have to) apply to a transaction you did 3 years ago (which will now be held for 7 years rather than 2). They might also lessen the amount of data they hold on you, maybe after a review of what they actually needed. I agree they should not send you anything if they store no data whatsoever, but if they do - they should probably inform you about changes in their privacy policies, even if they don't affect you personally.
- luckylion 6y ago
  > but they can (and have to) apply to a transaction you did 3 years ago (which will now be held for 7 years rather than 2). Are you sure? Laws that compel you to do something usually don't go into effect retroactively. They're like price-hikes in that regard: you can't just unilaterally decide that your customer's monthly subscription fee has doubled since three years ago. In any case, it wouldn't have anything to do with their TOS or privacy policies, and I don't think they'd have to inform you about their compliance with the current laws. > they should probably inform you about changes in their privacy policies, even if they don't affect you personally You're not a customer at that point, why would you be getting information that only concerns customers? Updating someone on the TOS changes implies that they either requested to be updated or are a customer. I understand the idea behind preferring to err on the side of informing too many people rather than too few, but we should value the recipient's time and attention as well. And once we do that, I believe it's clear that the sender has to spend the extra time to figure out who should receive this email and who shouldn't.

wl 6y ago

Their "legal reasons" can go jump off a cliff when someone else signs up for something with my email address. I didn't agree to any of this, including their ToS in all forms. Unsubscribe means unsubscribe. Any further email will be marked as spam.

isbvhodnvemrwvn 6y ago
What you wrote is based on emotions and not on law, and will be disregarded. The law allows many more reasons for processing your e-mail or other personal data without your consent.
- luckylion 6y ago
  Not by a random private company. The parent comment seems to talk about cases where somebody signed up with somebody else's email address. There are plenty of that kind of stories around, and a few have made front page here. A company that does not validate that the email address actually belongs to the person/entity they have consent from does not have any reason to store and process that email address. The same goes for other PII. If I sign up with your data, you've never consented, and whatever terms I accepted with a click or two have no relevance to you. Companies just usually don't bother with validation unless they need it for billing purposes, because it's a hassle and might make the customer reconsider.

Hamuko 6y ago

>If they need the e-mail address for legal reasons then you can not withdraw consent, as consent was not the legal basis for storing this data in the first place. No, I can widthdraw consent as much as I want. If they have a legal basis for storing my email address, then they can keep it regardless of my consent. However, I have no way of knowing if they actually have a legal basis for storing my email address or if they are just holding onto it.

isbvhodnvemrwvn 6y ago
That's what I said. Your can withdraw consent (which you never gave), or tell them that you like color purple more than you like red, but it will have no effect since it's not the basis for processing it. The privacy policy should list what data they collect and for what reason. However if they process your e-mail for several purposes based on different legal basis (for instance they also use e-mail for marketing purposes), they should stop using it for these reasons which you requested (for instance - all applicable) where consent was the basis for processing.