3 ms·
> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies. You don't have to ask for consent or permissions for dat
by dmitriid 5y ago
> Product configurators, shopping carts, forms, downtime detection - all this stuff relied on cookies.
You don't have to ask for consent or permissions for data that is strictly required for the functionality of your website. You're still responsible for keeping PII data safe etc., of course.
basically, you created those problems for yourslef, and now blame the law.
> For people who claim GDPR compliance is clear and straightforward - I can't believe they actually have much experience working in Privacy.
It is very straightforward when it comes to the use cases you described.
> Actual implementation gets... very opaque.
That's your problem, not the law's problem. Ask only for data you strictly need. Keep safe. Do not share with/sell to third parties.
This was true for years before GDPR, and the only reason everyone found it "so hard" is that everyone, including you and your corporate sites, didn't give two craps about users' privacy.
- alfiedotwtf 5y agoAnd what if you need third-parties like a payment gateway? How do you do this without sharing PII?
- dmitriid 5y agoPayment gateways are covered by laws that supersede GDPR. So you share the strictly necessary info with them.
- M2Ys4U 5y agoAre you under the assumption that the GDPR requires consent for all processing of personal data? Because it doesn't. There are six legal bases for processing personal data in in Article 6 of the GDPR. Consent is the first one, but the second one listed (paragraph (b)) is that the "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract". That covers your payment case.