4 ms·
CNIL disagrees and says you can need them to secure your service. Legitimate interest (art. 6(1)f) is applicable (recital 49). You can also be required by law
by cccbbbaaa 3y ago
CNIL disagrees and says you can need them to secure your service. Legitimate interest (art. 6(1)f) is applicable (recital 49). You can also be required by law to keep them for some time, so legal requirement is applicable (art. 6(1)c). Other uses may require consent.
Cf: https://www.cnil.fr/sites/default/files/atoms/files/recommandation_-_journalisation.pdf https://www.cnil.fr/sites/default/files/atoms/files/recomman... (in French, though)
- whstl 3y agoExactly. It's not just about what you collect and store, but also about what you do with the information. You can freely collect data as a legal requirement, or for "legitimate interest" purposes such as fraud prevention. But you can't use the data you just collected for analytics without proper consent.
- mpeg 3y agoContractual basis too, is often the easiest way to collect and store PII. Eg if you have a contract with someone you can often store a lot of their data to fulfil the contract. There is meant to be a sense of proportionality, but as many things with privacy laws it's subject to interpretation and intentionally left vague.