4 ms·
From what I understand, GDPR applies only to retention of data, and not such technical requirements. It does not require operators to inform users unless the se
by rendall 3y ago
From what I understand, GDPR applies only to retention of data, and not such technical requirements. It does not require operators to inform users unless the server will be retaining the IP address.
- sokoloff 3y agoIn any distributed system, what "retention" means is unclear* and, in the face of that lack of clarity, a company deciding to play it safe and require consent for things that GDPR says needs consent seems reasonable. * If I put your content-type and IP address onto a queue for processing by another system, that's arguably retaining the data, even if that length of retention is typically measured in seconds. Given that, the safest thing for me to do is to require your consent for the retention of IP address and related data.
- rendall 3y agoI suppose? The GDPR is very clear: if you serve European residents, you cannot collect their identifiable data without their informed consent, nor can you make consent the price of viewing your content. If you are found to do so, you are liable to huge fines. The language of the law itself is not very far from that clarity. Check it out for yourself: https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_en https://commission.europa.eu/law/law-topic/data-protection/d... I find it not credible that a company would read that second part, think "My goodness that sounds awful! Out of an abundance of caution, we better include language around arcane technical edge cases!" but then go on to violate the very, very clearly stated core intent of the law regarding consent and actual data retention and brokering. So... it is confusing. Probably intentionally so. Perhaps their legal strategy would be to somehow conflate these edge cases? Try to baffle judges?