3 ms·

>[regarding personal information e.g., demographics, political beliefs] ...the mere fact that a user visits websites or apps that may reveal such information d

>[regarding personal information e.g., demographics, political beliefs] ...the mere fact that a user visits websites or apps that may reveal such information does not in any way mean that the user manifestly makes public his or her data Part of the underlying reasoning, given in the court decision that prompted this ban[1]. I think this gets at the core of what makes such data collection & utilization in targeted advertisements so problematic. Also of interest from the same, regarding processing of any data in general without explicit consent: >only on condition that the data processing is objectively indispensable such that the main subject matter of the contract cannot be achieved... Where subject matter means the purpose for which the user is using the site. And then this: >the personalised advertising by which the online social network Facebook finances its activity, cannot justify [data processing] ...in the absence of the data subject’s consent Basically, "But that's how we keep the lights on" is not sufficient to justify using this data without consent. I can't easily think of a product or service that could not function, as a matter of practicality, unless it used my data without my consent. If a product or service cannot function without such data, it seems like that would be pretty clear by the nature of the product? Are there counter examples to this where the exception might apply? [1] https://www.datatilsynet.no/en/news/aktuelle-nyheter-2023/temporary-ban-of-behavioural-advertising-on-facebook-and-instagram/ https://www.datatilsynet.no/en/news/aktuelle-nyheter-2023/te...

jsnell 3y ago
> Are there counter examples to this where the exception might apply? The "legitimate interest" basis for processing data is meant for things like security, fraud prevention, etc. So more concretely, credit card buyers can't to opt out of data processing for fraud prevention, because that's what every fraudster would do. Or as another example, sites need to be able to log data like IP addresses for a reasonable time to figure out if they're under a Dos attack, or a password stuffing attack, etc, and to block abusive IPs. These can't require consent, because an attacker will not give consent. (And you can't just block everyone that withholds consent either.) Legitimate interest is definitel not supposed to be used as "it's our legitimate interest to make as much money as possible", and it's kind of crazy how many companies have tried that. There's just no ambiguity to that. But there is various interesting and ambiguous middle ground. Is a site allowed to claim legitimate interest in order to use Recaptcha to protect their login form? It is necessary to protect that login page one way or another. But there could be other ways to protect it with a smaller data footprint. Those ways might not be as effective, or they might not be more expensive, but obviously the law doesn't specify any kind of crisp criteria for just what tradeoffs are acceptable.

jsnell 3y ago

> Are there counter examples to this where the exception might apply? The "legitimate interest" basis for processing data is meant for things like security, fraud prevention, etc. So more concretely, credit card buyers can't to opt out of data processing for fraud prevention, because that's what every fraudster would do. Or as another example, sites need to be able to log data like IP addresses for a reasonable time to figure out if they're under a Dos attack, or a password stuffing attack, etc, and to block abusive IPs. These can't require consent, because an attacker will not give consent. (And you can't just block everyone that withholds consent either.) Legitimate interest is definitel not supposed to be used as "it's our legitimate interest to make as much money as possible", and it's kind of crazy how many companies have tried that. There's just no ambiguity to that. But there is various interesting and ambiguous middle ground. Is a site allowed to claim legitimate interest in order to use Recaptcha to protect their login form? It is necessary to protect that login page one way or another. But there could be other ways to protect it with a smaller data footprint. Those ways might not be as effective, or they might not be more expensive, but obviously the law doesn't specify any kind of crisp criteria for just what tradeoffs are acceptable.