7 ms·

How do you object to the site's legitimate interest use of your personal data? That is a legal grounds for processing, which can be enabled by default as long a

by Rygian 9mo ago

How do you object to the site's legitimate interest use of your personal data? That is a legal grounds for processing, which can be enabled by default as long as you are provided with an option to actively object. https://noyb.eu/en/your-right-object-article-21 https://noyb.eu/en/your-right-object-article-21

upofadown 9mo ago
If it is an actual legitimate interest then you would likely be expected to contact the site out of band to object to the use of your data. Depending on the technical details you might not be able to continue using the site after a successful objection. In some cases the site might be able to reject your request. The cookie banner thing is intended to allow the user to explicitly provide consent, should they for some reason wish to do so.
- Rygian 9mo ago
  The cookie banners are routinely used to object to "legitimate interest" uses and the corresponding sites continue to work normally, not sure what your alternate understanding is based on.
  - upofadown 9mo ago
    The cookie banners are for initial consent. You just consent to less stuff sometimes. A website might claim some sort of legitimate interest for the initial collection of data but might not think that they can claim that for the retention of data I suppose. That would seem kind of dodgy to me... Just because a website claims something doesn't mean it is valid. There isn't a lot that falls under legitimate interest for a website.
    - Rygian 9mo ago
      What you state is provably wrong. Consent and objection to legitimate interest are two different things, in the eyes of GDPR, and are managed separately in privacy banners: Navigate to a website of your choice [1]. Let's assume its privacy banner is served by onetrust. The text at the top of their "Privacy Center" says, verbatim, "We share this information with our partners on the basis of consent and legitimate interest. You may exercise your right to consent or object to a legitimate interest" If you then unfold the "Manage Consent Preferences" you will notice that you can, _separately_, provide your consent for a given purpose, by sliding the switch to the right to enable it, and also, _at the same time_, "Object to Legitimate Interests" by clicking on the button labeled so. Of course, this is a dark pattern to make it as cumbersome as possible to object to Legitimate Interest purposes. [1] (I took vox dot com as an example.)
kuschku 9mo ago
Legitimate interest is defined as that usage that is absolutely technically necessary. Which is why you cannot object to legitimate interest. Legitimate interest is for example a website using your IP to send you the necessary TCP/IP packets with the website's content upon request. Many websites use the term "legitimate interest" misleadingly (or even fraudulently), but that's not how GDPR defines it.
- prox 9mo ago
  It’s also to check if something works. I recently added something new and while I cannot and will not track any personally identifying information, I still need some data if people go through the whole process alright. That covers legitimate interest. It’s the minimum data I collect and its get wiped after some time.
- rglullis 9mo ago
  An IP address is not "personally identifiable data". You can not know who the person is just because you got an IP address in the request. We are almost 10 years into the GDPR, and we still have these gross misunderstandings about how to interpret it. Meanwhile, it has done nothing to stop companies from tracking people and for AI scrapers to run around. If this is not a perfect example of Regulatory Capture in action, I don't know what is.
  - Nextgrid 9mo ago
    The lack of enforcement is consistent across all companies big and small so I don’t think it counts as regulatory capture.
    - kuschku 9mo ago
      Tbh, Google and Facebook, after several enforcement actions, now provide a simple "Reject All" button, while most smaller websites don't. I'd argue that's the opposite of regulatory capture.
      - 9mo ago
psychoslave 9mo ago
>How do you object to the site's legitimate interest use of your personal data? With the legitimate individual control over one own data required to run a healthy society and unavoidable to sustain a democracy. If a business can't exist without threatening society, the sooner it's going out of existence the better.

by Rygian 9mo ago

upofadown 9mo ago

If it is an actual legitimate interest then you would likely be expected to contact the site out of band to object to the use of your data. Depending on the technical details you might not be able to continue using the site after a successful objection. In some cases the site might be able to reject your request. The cookie banner thing is intended to allow the user to explicitly provide consent, should they for some reason wish to do so.

Rygian 9mo ago
The cookie banners are routinely used to object to "legitimate interest" uses and the corresponding sites continue to work normally, not sure what your alternate understanding is based on.
- upofadown 9mo ago
  The cookie banners are for initial consent. You just consent to less stuff sometimes. A website might claim some sort of legitimate interest for the initial collection of data but might not think that they can claim that for the retention of data I suppose. That would seem kind of dodgy to me... Just because a website claims something doesn't mean it is valid. There isn't a lot that falls under legitimate interest for a website.
  - Rygian 9mo ago
    What you state is provably wrong. Consent and objection to legitimate interest are two different things, in the eyes of GDPR, and are managed separately in privacy banners: Navigate to a website of your choice [1]. Let's assume its privacy banner is served by onetrust. The text at the top of their "Privacy Center" says, verbatim, "We share this information with our partners on the basis of consent and legitimate interest. You may exercise your right to consent or object to a legitimate interest" If you then unfold the "Manage Consent Preferences" you will notice that you can, _separately_, provide your consent for a given purpose, by sliding the switch to the right to enable it, and also, _at the same time_, "Object to Legitimate Interests" by clicking on the button labeled so. Of course, this is a dark pattern to make it as cumbersome as possible to object to Legitimate Interest purposes. [1] (I took vox dot com as an example.)

kuschku 9mo ago

Legitimate interest is defined as that usage that is absolutely technically necessary. Which is why you cannot object to legitimate interest. Legitimate interest is for example a website using your IP to send you the necessary TCP/IP packets with the website's content upon request. Many websites use the term "legitimate interest" misleadingly (or even fraudulently), but that's not how GDPR defines it.

prox 9mo ago
It’s also to check if something works. I recently added something new and while I cannot and will not track any personally identifying information, I still need some data if people go through the whole process alright. That covers legitimate interest. It’s the minimum data I collect and its get wiped after some time.
rglullis 9mo ago
An IP address is not "personally identifiable data". You can not know who the person is just because you got an IP address in the request. We are almost 10 years into the GDPR, and we still have these gross misunderstandings about how to interpret it. Meanwhile, it has done nothing to stop companies from tracking people and for AI scrapers to run around. If this is not a perfect example of Regulatory Capture in action, I don't know what is.
- Nextgrid 9mo ago
  The lack of enforcement is consistent across all companies big and small so I don’t think it counts as regulatory capture.
  - kuschku 9mo ago
    Tbh, Google and Facebook, after several enforcement actions, now provide a simple "Reject All" button, while most smaller websites don't. I'd argue that's the opposite of regulatory capture.
    - 9mo ago

psychoslave 9mo ago

>How do you object to the site's legitimate interest use of your personal data? With the legitimate individual control over one own data required to run a healthy society and unavoidable to sustain a democracy. If a business can't exist without threatening society, the sooner it's going out of existence the better.