3 ms·

o_O > Scenario: You have an app that only stores data in the cloud > Outcome: No consent is required > Why: You’re not storing data on the user’s computer bu

o_O > Scenario: You have an app that only stores data in the cloud > Outcome: No consent is required > Why: You’re not storing data on the user’s computer but on your own computer.

that_guy_iain 4y ago
From section on local storage consent. For storing data in the cloud you only need consent to store their personal data. You can store non-identifying data within th cloud. For example you have a web game and you use javascript code that generates a session id randomly then you use that session id to store data about a game stats in the cloud. (Why you would do this I am not sure) You wouldn't need permission from the user to store the non-identifying data.
- DarkWiiPlayer 4y ago
  Yea but then you need to be really careful not to let the user sneak in any PII anywhere; say a user sets their full name + address as their username; they can now request that you delete this data.
  - naniwaduni 4y ago
    While you probably do need to expect to delete usernames (usernames are expected to be identifying), but the user sneaking personal data into fields where it isn't expect is probably out of scope as not part of a filing system anyway. Certainly I wouldn't expect a serious problem to punt it to "we'll deal with it manually on a 3-month turnaround if it becomes relevant" as long as you're not actively designing your systems to not be able to delete data.
- happymellon 4y ago
  How about a high score table?
- naniwaduni 4y ago
  Practically speaking, if you're using personal data in ways that GDPR demads consent for, you ... probably shouldn't be doing that. You can store data that you need for a laundry list of legitimate purposes without consent. The consent provision is an escape hatch for incumbents with consent-tracking infrastructure to carry on doing (and raise barriers of entry to) mostly-illegitimate processing (and okay, the odd thing that might be reasonable but that the law hasn't considered).
- d1sxeyes 4y ago
  I see what you mean, but the statement is false as written. If it were 'You have an app that only stores non-identifying data in the cloud', then it would be correct. That said, depending on how you code your app, you might end up logging user requests in a way that could end up causing issues by accident. You'd have to make sure that the unique identifier can't be matched up with an IP address in any way. I think the article is giving advice which is overgeneralised, and could very easily end up misleading its readers.
mimsee 4y ago
The more I read this blog post, the more it seems like a joke. Definitely wouldn't take it as any kind of legal advice.
411111111111111 4y ago
That's correct. That assertion is explicitly about the cookies consent if you look at the header to that segment. If you don't have cookies, you don't need that. As such, it's entirely correct in it's context. You might still need a consent popup if you're tracking the user, but that's not the same as a cookie banner... Even though they can be combined.
- d1sxeyes 4y ago
  I think you and I would perhaps disagree on the definition of 'explicit', but if we put that to one side, what is the point of any data being stored at all if it is not possible to link it to an individual user? I think there's also a big risk that there would be accidental data capturing. In its context, and if you consider it in terms of the segment, and a literal reading, it's correct. But I think there's an AWFUL lot of scope for someone to follow this advice and end up being on the wrong side of the law, and it's bordering on negligence to share this without a lot of disclaimers, caveats, and warnings.
matthewmacleod 4y ago
To be clear, this example is clearly and explicitly in the context of whether or not consent to use cookies is required. Which it isn’t, if you aren’t storing cookies or cookie equivalents.

o_O > Scenario: You have an app that only stores data in the cloud > Outcome: No consent is required > Why: You’re not storing data on the user’s computer but on your own computer.

that_guy_iain 4y ago

From section on local storage consent. For storing data in the cloud you only need consent to store their personal data. You can store non-identifying data within th cloud. For example you have a web game and you use javascript code that generates a session id randomly then you use that session id to store data about a game stats in the cloud. (Why you would do this I am not sure) You wouldn't need permission from the user to store the non-identifying data.

DarkWiiPlayer 4y ago
Yea but then you need to be really careful not to let the user sneak in any PII anywhere; say a user sets their full name + address as their username; they can now request that you delete this data.
- naniwaduni 4y ago
  While you probably do need to expect to delete usernames (usernames are expected to be identifying), but the user sneaking personal data into fields where it isn't expect is probably out of scope as not part of a filing system anyway. Certainly I wouldn't expect a serious problem to punt it to "we'll deal with it manually on a 3-month turnaround if it becomes relevant" as long as you're not actively designing your systems to not be able to delete data.
happymellon 4y ago
How about a high score table?
naniwaduni 4y ago
Practically speaking, if you're using personal data in ways that GDPR demads consent for, you ... probably shouldn't be doing that. You can store data that you need for a laundry list of legitimate purposes without consent. The consent provision is an escape hatch for incumbents with consent-tracking infrastructure to carry on doing (and raise barriers of entry to) mostly-illegitimate processing (and okay, the odd thing that might be reasonable but that the law hasn't considered).
d1sxeyes 4y ago
I see what you mean, but the statement is false as written. If it were 'You have an app that only stores non-identifying data in the cloud', then it would be correct. That said, depending on how you code your app, you might end up logging user requests in a way that could end up causing issues by accident. You'd have to make sure that the unique identifier can't be matched up with an IP address in any way. I think the article is giving advice which is overgeneralised, and could very easily end up misleading its readers.

mimsee 4y ago

The more I read this blog post, the more it seems like a joke. Definitely wouldn't take it as any kind of legal advice.

411111111111111 4y ago

That's correct. That assertion is explicitly about the cookies consent if you look at the header to that segment. If you don't have cookies, you don't need that. As such, it's entirely correct in it's context. You might still need a consent popup if you're tracking the user, but that's not the same as a cookie banner... Even though they can be combined.

d1sxeyes 4y ago
I think you and I would perhaps disagree on the definition of 'explicit', but if we put that to one side, what is the point of any data being stored at all if it is not possible to link it to an individual user? I think there's also a big risk that there would be accidental data capturing. In its context, and if you consider it in terms of the segment, and a literal reading, it's correct. But I think there's an AWFUL lot of scope for someone to follow this advice and end up being on the wrong side of the law, and it's bordering on negligence to share this without a lot of disclaimers, caveats, and warnings.

matthewmacleod 4y ago

To be clear, this example is clearly and explicitly in the context of whether or not consent to use cookies is required. Which it isn’t, if you aren’t storing cookies or cookie equivalents.