5 ms·

I was a little surprised by this: "The DPA highlighted that users should have a real choice not to consent without any negative consequences." Does this mean t

I was a little surprised by this: "The DPA highlighted that users should have a real choice not to consent without any negative consequences." Does this mean that it is unacceptable to run a service which requires consent to share data? That seems overly restrictive - where does that leave services in which sharing data is the whole point of the service? The article goes on to say: "Grindr made use of the app conditional on consenting to data sharing or to paying a subscription fee." Is this the unacceptable part? I.e. Grindr is creating a financial penalty for users who exercise their data privacy rights? Would it be acceptable under GDPR to run an app where the choice is "consent to sharing data or do not use this app at all"?

zinekeller 6y ago
If a marketing service are upfront about "asking your preferences to serve as a reference to participating companies" and that is the primary purpose, they would be allowed under GDPR. Now the real question is would someone wants to do this? Knowing that around 17% of Americans would do this, it would fly in America. Now, would this fly in Europe?
remus 6y ago
> Does this mean that it is unacceptable to run a service which requires consent to share data? That seems overly restrictive - where does that leave services in which sharing data is the whole point of the service? In this case the issue was that the consent was not informed. That is, Grindr weren't making it clear enough that the highly personal information they collected was then shared with hundreds of advertising partners.
izacus 6y ago
> Does this mean that it is unacceptable to run a service which requires consent to share data? That seems overly restrictive - where does that leave services in which sharing data is the whole point of the service? GDPR literally says that you're allowed to run a service that requires data and you don't even have to ask for consent for that type of data. What you're not allowed is to collect data that's NOT critical for your service without consent.
- mjw_byrne 6y ago
  Thanks, that makes sense.
yarcob 6y ago
> where does that leave services in which sharing data is the whole point of the service? When you actively share data with others, consent to process the data for this implicit. So as I understand it, a dating app would not need your explicit consent to share a profile photo with others on the platform since that is the whole point of the app. But if the service decides to provide your personal data to advertisers, explicit consent is required, since that is not essential for providing the service. The service could just as well show anonymous ads, or target ads without tracking the user.
- mjw_byrne 6y ago
  Right, so the article is talking about data sharing which isn't core to the service, that makes sense.
conistonwater 6y ago
I also find this confusing. Article 7 says > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. https://gdpr.eu/article-7-how-to-get-consent-to-collect-personal-data/ https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers... So it does sound to me like you can't tie data sharing to provision of service because then consent is not freely given. Also: > Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. https://gdpr.eu/Recital-43-Freely-given-consent https://gdpr.eu/Recital-43-Freely-given-consent I think this means that even if Grindr obtains consent the way they do, it's still not freely given consent so even having obtained it they still don't have permission to use the data the way they want, since only freely given consent counts as consent. But I'm not sure, maybe it's more complicated.

zinekeller 6y ago

If a marketing service are upfront about "asking your preferences to serve as a reference to participating companies" and that is the primary purpose, they would be allowed under GDPR. Now the real question is would someone wants to do this? Knowing that around 17% of Americans would do this, it would fly in America. Now, would this fly in Europe?

remus 6y ago

> Does this mean that it is unacceptable to run a service which requires consent to share data? That seems overly restrictive - where does that leave services in which sharing data is the whole point of the service? In this case the issue was that the consent was not informed. That is, Grindr weren't making it clear enough that the highly personal information they collected was then shared with hundreds of advertising partners.

izacus 6y ago

> Does this mean that it is unacceptable to run a service which requires consent to share data? That seems overly restrictive - where does that leave services in which sharing data is the whole point of the service? GDPR literally says that you're allowed to run a service that requires data and you don't even have to ask for consent for that type of data. What you're not allowed is to collect data that's NOT critical for your service without consent.

mjw_byrne 6y ago
Thanks, that makes sense.

yarcob 6y ago

> where does that leave services in which sharing data is the whole point of the service? When you actively share data with others, consent to process the data for this implicit. So as I understand it, a dating app would not need your explicit consent to share a profile photo with others on the platform since that is the whole point of the app. But if the service decides to provide your personal data to advertisers, explicit consent is required, since that is not essential for providing the service. The service could just as well show anonymous ads, or target ads without tracking the user.

mjw_byrne 6y ago
Right, so the article is talking about data sharing which isn't core to the service, that makes sense.

conistonwater 6y ago

I also find this confusing. Article 7 says > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. https://gdpr.eu/article-7-how-to-get-consent-to-collect-personal-data/ https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers... So it does sound to me like you can't tie data sharing to provision of service because then consent is not freely given. Also: > Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. https://gdpr.eu/Recital-43-Freely-given-consent https://gdpr.eu/Recital-43-Freely-given-consent I think this means that even if Grindr obtains consent the way they do, it's still not freely given consent so even having obtained it they still don't have permission to use the data the way they want, since only freely given consent counts as consent. But I'm not sure, maybe it's more complicated.