4 ms·

Notable quote: > Civil law contracts do not need to fulfill the strict requirements of "consent" under the GDPR. [...] Facebook users now have fewer rights und

Notable quote: > Civil law contracts do not need to fulfill the strict requirements of "consent" under the GDPR. [...] Facebook users now have fewer rights under the GDPR than they did before under the old data protection law because, according to the Vienna Higher Regional Court, they have entered into a [civil law] contract to receive personalized advertising. This is just ridiculous.

StavrosK 6y ago
Seriously, what the hell? This means you can bypass the GDPR with a sentence in your ToS. It is beyond ridiculous.
- mindslight 6y ago
  I hope this is just a narrow ruling based on the specific legal claim. It does make sense that you can skip having a separate consent step by making it part of the contract, if and only if the user is actually aware that is part of the terms (and no, the fiction that they will read through the legalese does not count). If the contract said something prominent like "Faceboot will process your data for purposes of publishing it to your friends", that would be reasonable consent to me. But it is obviously nonsensical for a user to be thinking they're signing up to interact with their friends, while insisting they're technically somehow contracting for "advertising services". There's also the severability part of the GDPR, where a user should be able to consent solely for the interaction with friends, while explicitly not consenting for these "advertising services".
  - StavrosK 6y ago
    But the GDPR already allows keeping data with informed consent. Why have another proviso for the same thing?
    - d1sxeyes 6y ago
      I think the point here is that Facebook are allowed to process data under the legal basis of 'performance of a contract' rather than 'consent'. This means that a Facebook user cannot both use the service and require Facebook not to process their personal data by refusing to provide consent. My understanding is that where you rely on consent, you are not allowed to refuse to offer the service based on refusal to provide consent, otherwise consent is not considered to be 'freely given'. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/when-consent-valid_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... It will be interesting to see how this pans out, because the link says 'Consent isn’t freely given [...] when a business/organisation requires individuals to consent to the processing of unnecessary personal data as a pre-condition to fulfil a contract or service.'
      - mytailorisrich 6y ago
        A contract implies consent as consent is the basis for a contract to be formed. Note also that in the text you quote there is an important word, "unnecessary". So the question is whether the data Facebook collects is unnecessary. The specific circumstances are key here. One argument is that what Facebook collects is necessary since it is the very business model here: you get access and in exchange Facebook shows you targeted ads, for which the data are necessary. I have never been clear about the basis for claiming that consent is not freely given if it is linked to accessing the service. To me that negates the very nature of contracts, which is an exchange. People freely agree or they don't. Sometimes it seems that 'freely' is interpreted as meaning 'gratis', but that would not be what is typical meant by 'freely given' when discussing agreement or consent, which usually means 'without being coerced or misled'.
        d1sxeyes 6y ago
        The first sentence is not correct. The EU has established that various forms of contract (eg: employment contracts) do not allow for consent to be given freely - and as your tailor is rich, I'm assuming that you'll be comfortable with the less ambiguous French wording: '[le] consentement [...] doit être donné librement'. However, I do agree 'unnecessary' is an odd choice of word from the EU here, as 'consent' is the only legal basis for data processing which does not include the word 'necessary' in the actual regulation. > I have never been clear about the basis for claiming that consent is not freely given if it is linked to accessing the service. The basis for this is Article 7.4. As an example, if I walk in to a restaurant, it would be 'unnecessary' to require me to provide a name before serving me. They can still require it, and they can refuse to serve me if I don't. HOWEVER, if I do provide my name they cannot claim that I have consented to doing so (and therefore, they must have another legitimate basis for processing my personal data - a good recent example might be a track and trace scheme, where they have a legitimate basis to process personal data as it is in the vital interests of both myself and other patrons). However, it would not be unnecessary to require me to provide a name before reserving a table, as the name would be necessary to identify me as the person who reserved the table, and so they can rely on consent as a basis for processing my personal data here. Moving back to Facebook: It is necessary for Facebook to process some personal data in order to provide the service of allowing me to communicate with my friends - for example, my name, my friends' network graph, maybe my email address, information that I upload to the site, etc. As a result, this personal data can be processed under the basis of consent. It is not necessary for Facebook to share that information with advertisers, so they cannot use consent as a basis for processing this data, and they must have another legitimate basis for doing so (and they may well do, I would imagine they could build a pretty solid case either for performance of a contract or legitimate business interests). This means that either: Facebook agree that they are processing this data based on consent, in which case consent can be withdrawn or refused for specific purposes (which is not possible), or they cannot rely on consent as a basis. It is important which legal basis is used for processing personal data as the paperwork and thresholds for passing PIAs vary.
  - mytailorisrich 6y ago
    There is nothing new in the fact that a contract is what the parties agree on and consent to. Where the law requires explicit consent it is perfectly valid to include this consent in a contract. An important aspect, though, especially in relation to consumer protection laws is that this must be clear and attention may even need to be specifically brought to it.
  - wdb 6y ago
    Yeah, I am curious how it was worded in 2018 in their new contract/agreement? I can't believe it would have been something similar to what Apple demands now for the Apps in the App Store
  - pmontra 6y ago
    > if and only if the user is actually aware that is part of the contract And if the user understand s/he's entering into a contract with Facebook. It's very unusual to digitally/personally sign a contract when entering a relationship with a site like Facebook giving away a service for no money. It's very usual or inevitable (and expected) to do it when starting an online bank account or for a car sharing service, internet and phone providers, even a subscription to music/movie streaming or online news, something you pay for. There are usually a lot of forms to fill to enter into those contracts and that makes those contracts very visible and understood. I hope this will be overruled at EU level.
    - Jon_Lowtek 6y ago
      It is not unusual at all to enter into a contract by registering an account on a webpage.
  - privacylawthrow 6y ago
    Facebook, as a data controller, is required to provide all information specified in GDPR Article 13 regardless of whether its legal basis for processing that data is consent or contract. Article 13 is a long list of mandatory disclosures that data controllers have to provide to data subjects, informing them of the identity of the data controller, categories of data collected, data retention periods, etc.
vmception 6y ago
this is the same as before GDPR, this seems like the judge didn't know what the purpose of GDPR was?? or maybe Austria's legislative implementation of GDPR really does allow this much latitude.
- tom_mellior 6y ago
  GDPR is a regulation (https://en.wikipedia.org/wiki/Regulation_(European_Union) https://en.wikipedia.org/wiki/Regulation_(European_Union) ), which means that it applies directly. The ruling also refers to various sections of GDPR directly. There is no local legislative implementation of regulations; you are thinking of directives (https://en.wikipedia.org/wiki/Directive_(European_Union) https://en.wikipedia.org/wiki/Directive_(European_Union) ), of which GDPR is not one.
  - vmception 6y ago
    Okay. Is there anything rational about what this judge in Vienna did?
    - the_mitsuhiko 6y ago
      The judge originally even didn’t want to rule on the case. It looks very much they wanted the case to go to a different court and have nothing to do with it.
masswerk 6y ago
On the other hand, we now know that Facebook is in essence a contractor for delivering targeted advertising. (Meaning, receiving and/or sharing any messages is just an accidental side effect of this objective.) ;-) More seriously, I don't think that this will hold. The idea about contracts is about services that imply the use of certain data in order to fulfil the respective objective of a contract. (E.g., a postal service will need to handle the name of the recipient and the delivery address, as implied by the objective of the very contract.) Here, however, the extraction and use of personal data is not a side effect of the contract, it rather describes the objective of the contractor in its entirety. (Disclaimer: I'm not learned in the law, but actually Austrian, if this is of any help.)

StavrosK 6y ago

Seriously, what the hell? This means you can bypass the GDPR with a sentence in your ToS. It is beyond ridiculous.

mindslight 6y ago
I hope this is just a narrow ruling based on the specific legal claim. It does make sense that you can skip having a separate consent step by making it part of the contract, if and only if the user is actually aware that is part of the terms (and no, the fiction that they will read through the legalese does not count). If the contract said something prominent like "Faceboot will process your data for purposes of publishing it to your friends", that would be reasonable consent to me. But it is obviously nonsensical for a user to be thinking they're signing up to interact with their friends, while insisting they're technically somehow contracting for "advertising services". There's also the severability part of the GDPR, where a user should be able to consent solely for the interaction with friends, while explicitly not consenting for these "advertising services".
- StavrosK 6y ago
  But the GDPR already allows keeping data with informed consent. Why have another proviso for the same thing?
  - d1sxeyes 6y ago
    I think the point here is that Facebook are allowed to process data under the legal basis of 'performance of a contract' rather than 'consent'. This means that a Facebook user cannot both use the service and require Facebook not to process their personal data by refusing to provide consent. My understanding is that where you rely on consent, you are not allowed to refuse to offer the service based on refusal to provide consent, otherwise consent is not considered to be 'freely given'. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/when-consent-valid_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... It will be interesting to see how this pans out, because the link says 'Consent isn’t freely given [...] when a business/organisation requires individuals to consent to the processing of unnecessary personal data as a pre-condition to fulfil a contract or service.'
    - mytailorisrich 6y ago
      A contract implies consent as consent is the basis for a contract to be formed. Note also that in the text you quote there is an important word, "unnecessary". So the question is whether the data Facebook collects is unnecessary. The specific circumstances are key here. One argument is that what Facebook collects is necessary since it is the very business model here: you get access and in exchange Facebook shows you targeted ads, for which the data are necessary. I have never been clear about the basis for claiming that consent is not freely given if it is linked to accessing the service. To me that negates the very nature of contracts, which is an exchange. People freely agree or they don't. Sometimes it seems that 'freely' is interpreted as meaning 'gratis', but that would not be what is typical meant by 'freely given' when discussing agreement or consent, which usually means 'without being coerced or misled'.
      - d1sxeyes 6y ago
        The first sentence is not correct. The EU has established that various forms of contract (eg: employment contracts) do not allow for consent to be given freely - and as your tailor is rich, I'm assuming that you'll be comfortable with the less ambiguous French wording: '[le] consentement [...] doit être donné librement'. However, I do agree 'unnecessary' is an odd choice of word from the EU here, as 'consent' is the only legal basis for data processing which does not include the word 'necessary' in the actual regulation. > I have never been clear about the basis for claiming that consent is not freely given if it is linked to accessing the service. The basis for this is Article 7.4. As an example, if I walk in to a restaurant, it would be 'unnecessary' to require me to provide a name before serving me. They can still require it, and they can refuse to serve me if I don't. HOWEVER, if I do provide my name they cannot claim that I have consented to doing so (and therefore, they must have another legitimate basis for processing my personal data - a good recent example might be a track and trace scheme, where they have a legitimate basis to process personal data as it is in the vital interests of both myself and other patrons). However, it would not be unnecessary to require me to provide a name before reserving a table, as the name would be necessary to identify me as the person who reserved the table, and so they can rely on consent as a basis for processing my personal data here. Moving back to Facebook: It is necessary for Facebook to process some personal data in order to provide the service of allowing me to communicate with my friends - for example, my name, my friends' network graph, maybe my email address, information that I upload to the site, etc. As a result, this personal data can be processed under the basis of consent. It is not necessary for Facebook to share that information with advertisers, so they cannot use consent as a basis for processing this data, and they must have another legitimate basis for doing so (and they may well do, I would imagine they could build a pretty solid case either for performance of a contract or legitimate business interests). This means that either: Facebook agree that they are processing this data based on consent, in which case consent can be withdrawn or refused for specific purposes (which is not possible), or they cannot rely on consent as a basis. It is important which legal basis is used for processing personal data as the paperwork and thresholds for passing PIAs vary.
- mytailorisrich 6y ago
  There is nothing new in the fact that a contract is what the parties agree on and consent to. Where the law requires explicit consent it is perfectly valid to include this consent in a contract. An important aspect, though, especially in relation to consumer protection laws is that this must be clear and attention may even need to be specifically brought to it.
- wdb 6y ago
  Yeah, I am curious how it was worded in 2018 in their new contract/agreement? I can't believe it would have been something similar to what Apple demands now for the Apps in the App Store
- pmontra 6y ago
  > if and only if the user is actually aware that is part of the contract And if the user understand s/he's entering into a contract with Facebook. It's very unusual to digitally/personally sign a contract when entering a relationship with a site like Facebook giving away a service for no money. It's very usual or inevitable (and expected) to do it when starting an online bank account or for a car sharing service, internet and phone providers, even a subscription to music/movie streaming or online news, something you pay for. There are usually a lot of forms to fill to enter into those contracts and that makes those contracts very visible and understood. I hope this will be overruled at EU level.
  - Jon_Lowtek 6y ago
    It is not unusual at all to enter into a contract by registering an account on a webpage.
- privacylawthrow 6y ago
  Facebook, as a data controller, is required to provide all information specified in GDPR Article 13 regardless of whether its legal basis for processing that data is consent or contract. Article 13 is a long list of mandatory disclosures that data controllers have to provide to data subjects, informing them of the identity of the data controller, categories of data collected, data retention periods, etc.

vmception 6y ago

this is the same as before GDPR, this seems like the judge didn't know what the purpose of GDPR was?? or maybe Austria's legislative implementation of GDPR really does allow this much latitude.

tom_mellior 6y ago
GDPR is a regulation (https://en.wikipedia.org/wiki/Regulation_(European_Union) https://en.wikipedia.org/wiki/Regulation_(European_Union) ), which means that it applies directly. The ruling also refers to various sections of GDPR directly. There is no local legislative implementation of regulations; you are thinking of directives (https://en.wikipedia.org/wiki/Directive_(European_Union) https://en.wikipedia.org/wiki/Directive_(European_Union) ), of which GDPR is not one.
- vmception 6y ago
  Okay. Is there anything rational about what this judge in Vienna did?
  - the_mitsuhiko 6y ago
    The judge originally even didn’t want to rule on the case. It looks very much they wanted the case to go to a different court and have nothing to do with it.

masswerk 6y ago

On the other hand, we now know that Facebook is in essence a contractor for delivering targeted advertising. (Meaning, receiving and/or sharing any messages is just an accidental side effect of this objective.) ;-) More seriously, I don't think that this will hold. The idea about contracts is about services that imply the use of certain data in order to fulfil the respective objective of a contract. (E.g., a postal service will need to handle the name of the recipient and the delivery address, as implied by the objective of the very contract.) Here, however, the extraction and use of personal data is not a side effect of the contract, it rather describes the objective of the contractor in its entirety. (Disclaimer: I'm not learned in the law, but actually Austrian, if this is of any help.)