4 ms·

This is confusing. By my read (IANAL, but had to implement GDPR for a startup), under the GDPR selling location data like this is obviously illegal; why bother

This is confusing. By my read (IANAL, but had to implement GDPR for a startup), under the GDPR selling location data like this is obviously illegal; why bother to gesture at GDPR compliance by listing all of the companies that you're illegally selling data to? Maybe this list is very out of data, but even at the time this should have raised a big flag. ("Datenschutzrichtlinie" seems to be "data protection guideline"? You need to say what the subprocessor is doing with your data, this is not sufficient explanation, unless this actually translates to something meaningful.) > 5)1): Personal data shall be: ... a) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; This is exactly the sort of thing that GDPR was designed to prohibit. You simply cannot use data for a hidden purpose that isn't core to your product. Simply saying "we also sell your Personal Data" in the EULA is not compliant with GDPR. You have to clearly ask customers to opt in to non-essential processing. I suspect that this processing is just for US customers - as far as I can tell, data brokers like SafeGraph are fundamentally not compatible with the GDPR, since approximately nobody would knowingly opt in to giving away their data to these companies. (Anyone in the industry know more about how the EU data broker industry has evolved in the last few years? It's been a little while since I have been directly in contact with the EU regulatory system.)

x0x0 5y ago
Per GDPR, nearly anything you for which you get consent is legal. As your quote shows: a purpose must relate to a legal basis, and one of the legal bases is consent. Was there actual consent? Unlikely, but I can't read the German in that clip explaining what's going on with these companies.
- theptip 5y ago
  > Per GDPR, nearly anything you for which you get consent is legal. I think this requires qualification. There are a bunch of cases where consent is not considered valid, and there are requirements on being explicit about what you're getting consent for. See Article 7: https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ > If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. In other words, burying consent in a 10-page EULA probably doesn't float. The subject can withdraw consent at any time. This must be easy to do. And more importantly, see Article 6 - you can't just get consent for "monitoring your children" and then use the data for unrelated things that you claim are part of that task. In this case the only way you could be compliant is if you had a pop-up that says "we'd like to sell your location data to other companies (listed here). This isn't required to offer you our location tracking service. Do you give consent? Y/N". In which case the story would not be news, as everybody would be aware that this is what the app does.
  - x0x0 5y ago
    > In this case the only way you could be compliant This is overstated. Yes, consent must be clear. But it doesn't have to be a popup; merely clear. And you would probably be legal to require users to pay more to avoid data collection -- there are conflicting cases from the ICO / washington post case and the Austrian DPA / derStandard.at case.

x0x0 5y ago

Per GDPR, nearly anything you for which you get consent is legal. As your quote shows: a purpose must relate to a legal basis, and one of the legal bases is consent. Was there actual consent? Unlikely, but I can't read the German in that clip explaining what's going on with these companies.

theptip 5y ago
> Per GDPR, nearly anything you for which you get consent is legal. I think this requires qualification. There are a bunch of cases where consent is not considered valid, and there are requirements on being explicit about what you're getting consent for. See Article 7: https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ > If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. In other words, burying consent in a 10-page EULA probably doesn't float. The subject can withdraw consent at any time. This must be easy to do. And more importantly, see Article 6 - you can't just get consent for "monitoring your children" and then use the data for unrelated things that you claim are part of that task. In this case the only way you could be compliant is if you had a pop-up that says "we'd like to sell your location data to other companies (listed here). This isn't required to offer you our location tracking service. Do you give consent? Y/N". In which case the story would not be news, as everybody would be aware that this is what the app does.
- x0x0 5y ago
  > In this case the only way you could be compliant This is overstated. Yes, consent must be clear. But it doesn't have to be a popup; merely clear. And you would probably be legal to require users to pay more to avoid data collection -- there are conflicting cases from the ICO / washington post case and the Austrian DPA / derStandard.at case.