3 ms·
If you pay attention to ToS's, you'll find companies are increasingly trying to pull stunts like this. The CRA's terms are objectionable, yet sadly benign comp
by rkagerer 4y ago
If you pay attention to ToS's, you'll find companies are increasingly trying to pull stunts like this. The CRA's terms are objectionable, yet sadly benign compared to other reprehensible terms I've seen gating the web. Lawyers are copying each other's tactics and propogating dark patterns that I doubt will stand the test of litigation (but will cost some poor sap a lot of money and time to get there). Indemnity clauses are another one (no, I'm not going to reimburse you for damage if my account gets hacked through no fault of my own).
When I encounter clearly dodgy terms like this I often contact the organization and tell them I do not accept the given clause. Sometimes they say 'stop using our service' (rarely enforced) but most often they simply don't respond.
Someone at CRA with authority to fix this might perk up if thousands of Canadians start emailing them about it, report it to MP's, the Privacy Commissioner and other ombudsmen, etc.
- slickrick216 4y agoYeah like you say this isn’t a new phenomenon. In some cases they even try to shield themselves with legislation. For example let’s look at Ireland. [0] Ireland tries to exclude itself from GDPR https://www.thejournal.ie/data-protection-bill-2018-3853647-Feb2018/ https://www.thejournal.ie/data-protection-bill-2018-3853647-... [1] Entire health system compromised and possibly majority of PHI data exfiltrated https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf https://www.hse.ie/eng/services/publications/conti-cyber-att... [2] Irish health service only begins notifications to confirmed affected individuals a year later https://www.hse.ie/eng/services/news/media/pressrel/hse-begins-national-data-breach-notification-programme.html https://www.hse.ie/eng/services/news/media/pressrel/hse-begi... [3] selective punishment of companies whose data is breached eg google https://techcrunch.com/2022/03/14/dpc-sued-google-rtb-complaint https://techcrunch.com/2022/03/14/dpc-sued-google-rtb-compla... vs meta https://www.dataprotection.ie/en/news-media/data-protection-commission-announces-conclusion-two-inquiries-meta-ireland https://www.dataprotection.ie/en/news-media/data-protection-... Laws unevenly applied make a mockery of justice.
- nickff 4y agoRe: [0] My understanding is that member states (and perhaps all sovereigns) are not required to comply with GDPR unless they explicitly choose to.
- slickrick216 4y agoYes somewhat correct. That is for operations of critical public services such as civil registries. This was several steps beyond that. There was other reporting on this as well.