5 ms·

The GDPR definition of "freely given consent" is explicitly written to exclude "sale of consent" - if you say that you'll give you $1 (or some other benefit) if

The GDPR definition of "freely given consent" is explicitly written to exclude "sale of consent" - if you say that you'll give you $1 (or some other benefit) if you consent, then according to GDPR that consent is not freely given and thus does not grant you the right to use that PII. In essence, "GDPR consent" applies when people really want you to do that thing with their data, and does not apply if they'd rather not but it comes as a requirement for something else or "bundled" with something desirable. Also, if consent is the legal basis for processing, it must be possible to withdraw consent without any adverse consequence, so if e.g. you give a discounted subscription to people who gave consent, then you can't revoke that subscription or discount if the data subject withdraws that consent a minute later. If you say that you'll provide some service only if the user "consents", then GDPR presumes that the consent is not freely given (e.g. recital 43 of GDPR).

SpicyLemonZest 4y ago
Which provision of the GDPR explicitly defines “freely given” to exclude “sale of consent”? Again, I know this is conventional wisdom that gets passed around a lot, but as far as I can tell it’s not present in the actual text of the regulation. e: I see a stealth edited reference to recital 43, which I hadn’t seen before and does seem to show I’m wrong here. Thanks for the reference.
- PeterisP 4y ago
  The main part is article 7.4 "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." which is a bit tricky legal language to make the distinction between PII use that's actually needed to perform the contract (which doesn't need consent, e.g. address to deliver goods) and uses beyond that (e.g. using the same address afterwards for ad targeting). The final part of recital 42 "Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment." is probably even more clarifying than recital 43.
jefftk 4y ago
I agree that's what the GDPR says, and what it will be interpreted by courts to mean. But, as I get into at the end of the post, I don't think this is what it should say.
- PeterisP 4y ago
  At its core, GDPR is not about digital advertising, it's about all-encompassing rules for all industries to tackle privacy in an appropriate way. The clauses regarding consent have to work well (and generally do) for things like supermarkets asking 'consent' for privacy-invasive things in their loyalty/discount cards, for cell phone operators selling location data with 'consent' of the users, for employees 'consenting' to surveillance by employers, for consent in landlord-renter and real estate broker relations, etc, etc - that is the main purpose of GDPR, websites are a relatively small part of it which is only getting attention because this part is the one that works remotely and thus affects USA companies. Adjusting GDPR core principles for the purposes of website ads would be like the tail wagging the dog - if it "fixes" web ads but worsens handling of much more sensitive things like companies wanting to exploit data in physical shopping, telecommunications, healthcare and banking, then it's not worth it.
  - dmitriid 4y ago
    > websites are a relatively small part of it which is only getting attention because this part is the one that works remotely and thus affects USA companies. On top of that there's USA itself. Which said "if an American company serves anyone anywhere in the world we have the right to request any and all data on all users of that company, regardless of their residence or citizenship". That's what Schrems II was about: there's either privacy and protection of people's data or working with US-based companies. Europe keeps chosing the former, thankfully.

SpicyLemonZest 4y ago

Which provision of the GDPR explicitly defines “freely given” to exclude “sale of consent”? Again, I know this is conventional wisdom that gets passed around a lot, but as far as I can tell it’s not present in the actual text of the regulation. e: I see a stealth edited reference to recital 43, which I hadn’t seen before and does seem to show I’m wrong here. Thanks for the reference.

PeterisP 4y ago
The main part is article 7.4 "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." which is a bit tricky legal language to make the distinction between PII use that's actually needed to perform the contract (which doesn't need consent, e.g. address to deliver goods) and uses beyond that (e.g. using the same address afterwards for ad targeting). The final part of recital 42 "Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment." is probably even more clarifying than recital 43.

jefftk 4y ago

I agree that's what the GDPR says, and what it will be interpreted by courts to mean. But, as I get into at the end of the post, I don't think this is what it should say.

PeterisP 4y ago
At its core, GDPR is not about digital advertising, it's about all-encompassing rules for all industries to tackle privacy in an appropriate way. The clauses regarding consent have to work well (and generally do) for things like supermarkets asking 'consent' for privacy-invasive things in their loyalty/discount cards, for cell phone operators selling location data with 'consent' of the users, for employees 'consenting' to surveillance by employers, for consent in landlord-renter and real estate broker relations, etc, etc - that is the main purpose of GDPR, websites are a relatively small part of it which is only getting attention because this part is the one that works remotely and thus affects USA companies. Adjusting GDPR core principles for the purposes of website ads would be like the tail wagging the dog - if it "fixes" web ads but worsens handling of much more sensitive things like companies wanting to exploit data in physical shopping, telecommunications, healthcare and banking, then it's not worth it.
- dmitriid 4y ago
  > websites are a relatively small part of it which is only getting attention because this part is the one that works remotely and thus affects USA companies. On top of that there's USA itself. Which said "if an American company serves anyone anywhere in the world we have the right to request any and all data on all users of that company, regardless of their residence or citizenship". That's what Schrems II was about: there's either privacy and protection of people's data or working with US-based companies. Europe keeps chosing the former, thankfully.