7 ms·

Also not a lawyer, but I think it would technically count as personal information because it's a preference. Even if it's to provide functionality requested by

Also not a lawyer, but I think it would technically count as personal information because it's a preference. Even if it's to provide functionality requested by the user, it would still be necessary to inform the user that this preference is being stored, etc. However, I agree to your second point, that asking the user's browser to store the information, and then have the browser make decisions based on that without anything being shared back probably does not violate GDPR as it wouldn't count as 'processing'. It would seem (although, without a deep dive into the codebase, I can't be 100% sure) that the tool just adds a class to the body: https://github.com/themesberg/flowbite-react/blob/765fedb3c966ea93e384339f6e121beda320c22f/src/lib/components/Flowbite/Flowbite.tsx#L34 https://github.com/themesberg/flowbite-react/blob/765fedb3c9... If this is the case, I think it unlikely that this would be found to be a GDPR violation as Flowbite (or the company which has deployed Flowbite) would not normally be able to detect this preference. It would be different if for example the preference caused a different stylesheet to be downloaded, which could then be combined with server logs, but overall, it seems as though all of the processing of the data (whether you consider it personal or not) is done entirely on the user's computer, and there would be no processing of any data by the company which has deployed Flowbite, therefore it would not open up any GDPR liability. Once again though, IANAL.

mytailorisrich 4y ago
A preference is not personal data in itself. It must be linked to an identified or identifiable person in order to be so. So in itself the functionality and storage of necessary flag falls outside of the GDPR. Now, if for instance the flag is stored in the identified user's account then it becomes personal data but I think consent still isn't strictly required on the basis of legitimate interest (and frankly this is only a freaking flag for dark mode so about zero impact on privacy or anything else).
- d1sxeyes 4y ago
  Wouldn’t even necessarily need to be linked to a user account. If you could review server logs and identify that IP address x.y.z.a was using dark mode, you have a potential problem. Even if it would count as legitimate interest (which I don’t think it would), you would still need to offer opt out, right to erasure, and an explanation of what you’re doing with the data.
  - mytailorisrich 4y ago
    An IP address isn't personal data in itself, either. There is no need for any of that. This is only a flag for dark mode, it is necessary for the functionality, and it has no impact on privacy. No need for "GDPR hysteria".
    - deleted 4y ago
      [deleted]
    - d1sxeyes 4y ago
      I agree there's a lot of misinformation which leads to GDPR hysteria, however, unfortunately this is one such example of misinformation. https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r... clearly calls out IP addresses as the 6th bullet point underneath the heading 'Examples of Personal Data'. Article 4 paragraph 1 says personal data can be any data which could be linked to an identifiable person. The 'indirectly' word does seem to imply that it does not necessarily have to be the processor or controller who can link that data to a person. Quote from the GDPR itself: > 'personal data' means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier This has been tested in courts. At least in Germany, it has been ruled that an IP address in and of itself is personal data because it can be associated with other records to determine who a user is (even though the 'online media services provider'—the server operator—does not immediately have access to this information). https://curia.europa.eu/juris/document/document.jsf;jsessionid=12E1F2DF0925F6FE069EF247FD895759?text=&docid=191891&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=22136 https://curia.europa.eu/juris/document/document.jsf;jsession... > The fact that the additional data necessary to identify the user of a website are held not by the online media services provider, but by that user’s internet service provider does not appear to be such as to exclude that dynamic IP addresses registered by the online media services provider constitute personal data within the meaning of Article 2(a) of Directive 95/46. It is important to note though, that it is not unlawful to process personal data provided you have a privacy policy, etc. Maintaining server logs almost certainly is covered by legitimate interests, even though the IP addresses are personal data. However, it is not enough just to say 'it's a minor preference, we can hand wave this away'. You must absolutely make sure that you are meeting your obligations under the GDPR, including having proper privacy impact assessments, technical and organisational controls on who can access this data, etc. For this reason, the way it is currently implemented (end user does all 'processing' on their own computer) is best. However it's important to consider that even this may open up an organisation to some level of risk by inadvertently creating sets of circumstances which lead to the preference being detectable. For example, if you have an image which is set to 'display:none' when dark mode is enabled, then it would be possible to infer, based on the server logs, that because the user loaded the page but their browser did not load the image, they are likely using dark mode. Obviously this isn't true for all browsers, behaviour does vary, but still. The vast majority of GDPR hysteria is based on people not understanding that the majority of GDPR response should not be 'WE CAN'T DO XYZ OR WE GET A HUGE FINE', and instead 'we need to do a bit of paperwork to be allowed to do xyz'. For example, a dark mode toggle privacy impact assessment could include something along the lines of 'users have to actively choose this option', 'dark mode may be preferred by users with vision conditions, but we would not be able to interpret our data to determine which users (if any) have vision conditions', etc., and would probably be less than a hundred words of actual work (more with boilerplate, etc.). But GDPR complacency is also a problem. Companies can (and do) get fined all the time for doing things they thought weren't a big deal. You can check the fines here: https://www.enforcementtracker.com https://www.enforcementtracker.com

mytailorisrich 4y ago

A preference is not personal data in itself. It must be linked to an identified or identifiable person in order to be so. So in itself the functionality and storage of necessary flag falls outside of the GDPR. Now, if for instance the flag is stored in the identified user's account then it becomes personal data but I think consent still isn't strictly required on the basis of legitimate interest (and frankly this is only a freaking flag for dark mode so about zero impact on privacy or anything else).

d1sxeyes 4y ago
Wouldn’t even necessarily need to be linked to a user account. If you could review server logs and identify that IP address x.y.z.a was using dark mode, you have a potential problem. Even if it would count as legitimate interest (which I don’t think it would), you would still need to offer opt out, right to erasure, and an explanation of what you’re doing with the data.
- mytailorisrich 4y ago
  An IP address isn't personal data in itself, either. There is no need for any of that. This is only a flag for dark mode, it is necessary for the functionality, and it has no impact on privacy. No need for "GDPR hysteria".
  - deleted 4y ago
    [deleted]
  - d1sxeyes 4y ago
    I agree there's a lot of misinformation which leads to GDPR hysteria, however, unfortunately this is one such example of misinformation. https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r... clearly calls out IP addresses as the 6th bullet point underneath the heading 'Examples of Personal Data'. Article 4 paragraph 1 says personal data can be any data which could be linked to an identifiable person. The 'indirectly' word does seem to imply that it does not necessarily have to be the processor or controller who can link that data to a person. Quote from the GDPR itself: > 'personal data' means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier This has been tested in courts. At least in Germany, it has been ruled that an IP address in and of itself is personal data because it can be associated with other records to determine who a user is (even though the 'online media services provider'—the server operator—does not immediately have access to this information). https://curia.europa.eu/juris/document/document.jsf;jsessionid=12E1F2DF0925F6FE069EF247FD895759?text=&docid=191891&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=22136 https://curia.europa.eu/juris/document/document.jsf;jsession... > The fact that the additional data necessary to identify the user of a website are held not by the online media services provider, but by that user’s internet service provider does not appear to be such as to exclude that dynamic IP addresses registered by the online media services provider constitute personal data within the meaning of Article 2(a) of Directive 95/46. It is important to note though, that it is not unlawful to process personal data provided you have a privacy policy, etc. Maintaining server logs almost certainly is covered by legitimate interests, even though the IP addresses are personal data. However, it is not enough just to say 'it's a minor preference, we can hand wave this away'. You must absolutely make sure that you are meeting your obligations under the GDPR, including having proper privacy impact assessments, technical and organisational controls on who can access this data, etc. For this reason, the way it is currently implemented (end user does all 'processing' on their own computer) is best. However it's important to consider that even this may open up an organisation to some level of risk by inadvertently creating sets of circumstances which lead to the preference being detectable. For example, if you have an image which is set to 'display:none' when dark mode is enabled, then it would be possible to infer, based on the server logs, that because the user loaded the page but their browser did not load the image, they are likely using dark mode. Obviously this isn't true for all browsers, behaviour does vary, but still. The vast majority of GDPR hysteria is based on people not understanding that the majority of GDPR response should not be 'WE CAN'T DO XYZ OR WE GET A HUGE FINE', and instead 'we need to do a bit of paperwork to be allowed to do xyz'. For example, a dark mode toggle privacy impact assessment could include something along the lines of 'users have to actively choose this option', 'dark mode may be preferred by users with vision conditions, but we would not be able to interpret our data to determine which users (if any) have vision conditions', etc., and would probably be less than a hundred words of actual work (more with boilerplate, etc.). But GDPR complacency is also a problem. Companies can (and do) get fined all the time for doing things they thought weren't a big deal. You can check the fines here: https://www.enforcementtracker.com https://www.enforcementtracker.com