46 ms·

If I go to the EU website ( https://european-union.europa.eu https://european-union.europa.eu ) and see a pop up, surely there's a better way of implementing th

by shagie 2y ago

If I go to the EU website ( https://european-union.europa.eu https://european-union.europa.eu ) and see a pop up, surely there's a better way of implementing that it if it wasn't the best way to do so. If there is a pop up there, for just accessing the home page of the European Union, is that site collecting too much data? There's even a bit at the bottom of https://gdpr.eu https://gdpr.eu > We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.

ryanisnan 2y ago
I'm being a bit snarky, but maybe the better way involves not tracking people to death.
- shagie 2y ago
  Under the GDPR, an IP address is PII and recording the IP address of a visitor can be problematic. https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/ Looking back at the GDPR’s definition, we have a list of different types of identifiers: “a name, an identification number, location data, an online identifier.” A special mention should be made for biometric data as well, such as fingerprints, which can also work as identifiers. While most of these are straightforward, online identifiers are a bit trickier. Fortunately, the GDPR provides several examples in Recital 30 that include: Internet protocol (IP) addresses; cookie identifiers; and other identifiers such as radio frequency identification (RFID) tags. These identifiers refer to information that is related to an individual’s tools, applications, or devices, like their computer or smartphone. The above is by no means an exhaustive list. Any information that could identify a specific device, like its digital fingerprint, are identifiers.
  - p_l 2y ago
    The trick is to read through and understand what falls under "Legitimate Interest" (important note: it never involves giving other services access to it!). A very common example is recording the IP address for technical (debugging, ensuring site functionality) and legal (security, audit logs) does fall under Legitimate Interest. Worst case you have to mention it in privacy policy. The thing you can't do is let your marketing team or others grab at it in any way, or sell it to other vendors, and arguably you should not move outside of safe countries.
fmbb 2y ago
GDPR.eu is operated by Proton AG, a Swiss technology company offering privacy-focused online services. It’s not an EU site.
- shagie 2y ago
  Nonetheless, is it possible for the site to fulfill its obligations under the GDPR without needing a cookie or other tracking information that would warrant needing to say "you are being tracked"? GDPR.EU is a website operated by Proton Technologies AG, which is co-funded by Project REP-791727-1 of the Horizon 2020 Framework Programme of the European Union. This is not an official EU Commission or Government resource. The europa.eu webpage concerning GDPR can be found here. Nothing found in this portal constitutes legal advice. The "here" link goes to https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations_en https://commission.europa.eu/law/law-topic/data-protection/r... Would you be surprised if there was a big banner at the bottom of the page that read This site uses cookies. Visit our cookies policy page or click the link in any footer for more information and to change your preferences
  - janosdebugs 2y ago
    As far as I can tell, yes. If cookies (or other means of storing data on the users computer) are strictly technically necessary, and no data collection takes place as a legitimate interest, and you do not process data requiring consent, neither the ePrivacy directive nor the GDPR requires you to create a cookie banner. Needless to say, I'm not a lawyer and this is not legal advice. On a technical level this would likely mean turning off access logs and other tracking mechanisms. (IP addresses are considered personal data last I checked.)
rakoo 2y ago
That popup is not the half-height YOUR PRIVACY IS IMPORTANT TO US blocker, it's a banner at the bottom. Totally different (but still worth a block from my side if possible)

by shagie 2y ago

ryanisnan 2y ago

I'm being a bit snarky, but maybe the better way involves not tracking people to death.

shagie 2y ago
Under the GDPR, an IP address is PII and recording the IP address of a visitor can be problematic. https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/ Looking back at the GDPR’s definition, we have a list of different types of identifiers: “a name, an identification number, location data, an online identifier.” A special mention should be made for biometric data as well, such as fingerprints, which can also work as identifiers. While most of these are straightforward, online identifiers are a bit trickier. Fortunately, the GDPR provides several examples in Recital 30 that include: Internet protocol (IP) addresses; cookie identifiers; and other identifiers such as radio frequency identification (RFID) tags. These identifiers refer to information that is related to an individual’s tools, applications, or devices, like their computer or smartphone. The above is by no means an exhaustive list. Any information that could identify a specific device, like its digital fingerprint, are identifiers.
- p_l 2y ago
  The trick is to read through and understand what falls under "Legitimate Interest" (important note: it never involves giving other services access to it!). A very common example is recording the IP address for technical (debugging, ensuring site functionality) and legal (security, audit logs) does fall under Legitimate Interest. Worst case you have to mention it in privacy policy. The thing you can't do is let your marketing team or others grab at it in any way, or sell it to other vendors, and arguably you should not move outside of safe countries.

fmbb 2y ago

GDPR.eu is operated by Proton AG, a Swiss technology company offering privacy-focused online services. It’s not an EU site.

shagie 2y ago
Nonetheless, is it possible for the site to fulfill its obligations under the GDPR without needing a cookie or other tracking information that would warrant needing to say "you are being tracked"? GDPR.EU is a website operated by Proton Technologies AG, which is co-funded by Project REP-791727-1 of the Horizon 2020 Framework Programme of the European Union. This is not an official EU Commission or Government resource. The europa.eu webpage concerning GDPR can be found here. Nothing found in this portal constitutes legal advice. The "here" link goes to https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations_en https://commission.europa.eu/law/law-topic/data-protection/r... Would you be surprised if there was a big banner at the bottom of the page that read This site uses cookies. Visit our cookies policy page or click the link in any footer for more information and to change your preferences
- janosdebugs 2y ago
  As far as I can tell, yes. If cookies (or other means of storing data on the users computer) are strictly technically necessary, and no data collection takes place as a legitimate interest, and you do not process data requiring consent, neither the ePrivacy directive nor the GDPR requires you to create a cookie banner. Needless to say, I'm not a lawyer and this is not legal advice. On a technical level this would likely mean turning off access logs and other tracking mechanisms. (IP addresses are considered personal data last I checked.)

rakoo 2y ago

That popup is not the half-height YOUR PRIVACY IS IMPORTANT TO US blocker, it's a banner at the bottom. Totally different (but still worth a block from my side if possible)