The GDPR isn't nearly as scary as people set it out to be, and it gives companies a huge amount of wiggle room.
Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
1) for exercising the right of freedom of expression and information;
2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
3) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
5) for the establishment, exercise or defence of legal claims.
The first example is effectively a carte blanche to argue nearly any request for refusal in court.
The second one allows member states to pretty much tell companies not to delete information, whilst this was set up with compliance in mind, the wording has likely been formatted to also fit other needs such as security and state monitoring.
The third one pretty much allows you to keep medical records and insurance information.
The forth one is similar to the first with celebrities, public figures and major events in mind (the Gawker clause).
The fifth one has been singled out by dating sites and other services such as ride sharing apps as the reason for them to keep data.
I am not a lawyer this isn't a legal advice, speak to a legal firm or an auditor for proper advice.
I have been working on a few GDPR compliance projects internally for the past year and I've had to speak with quite a few lawyers and they all pretty much said it's actually far better for most companies than the existing framework as long as they can automate data discovery and know where they data comes from and where does it go.
You can fight the right to erase the data of a user pretty easily, what you cannot cockup (Art. 15, 20 and 21 of the GDPR primarily) is the ability to disclose what data you have on them and what is it used for which is like I've previously stated the tricky part for most cases. And as far as I can see Tinder pretty aced the tricky part.
So the issue is not the right to delete data in the case where you no longer use Tinder. The issue is that Tinder is simply not allowed to keep your data. In fact they must on their own initiative actively ensure they dont store data they are not allowed to, that is, on their own initiative delete your data, if you revoke your consent.
Edit: oh, and the best part. If you withdraw your consent Tinder is responsible for instructing all other companies that they shared your data with (including sold to) to delete your data (and followup that they did).
I'm also not sure if how did Tinder get the data (and yes it's important), Data sharing, 3rd party clauses etc. are also covered by the GDPR.
Does the GDPR can improve privacy? yes, but it really isn't the sledge hammer that people think it is.
This is a very big subject to big to cover over this channel to be frank.
Also (from B&B): "Individuals can require data to be ‘erased’ when there is a problem with the underlying legality of the processing or where they withdraw consent."
This is also a bit vague but it looks like withdrawing consent does not invoke deletion explicitly, it might simply change the lawfulness of processing which might require you to delete data if it's you only use consent as the basis of your LP.
However explicit consent is also not the only way to do "lawful processing" there are other ways to keep and get data.
Tinder can claim lawful processing after a retraction of consent with other allowances under Article 6:
1) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
2) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The 2nd one is pretty straight forward this is in essence a third party clause loophole, and the first one can be used by Tinder or the likes specifically in such cases where they would need to give data to the authorities in the such cases as sexual assault or harassment.
There is also a difference with what the GDPR defines as "further processing", which what happens when you want to use information for other purposes than what consent was given for, there has to be a link but this is again vague enough to be on a case by case basis.
"Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations."
Bird & Bird has a lot of free information on GDPR and it's real world implications for companies google them :)
Completely agree that there are other basis for legality, but most of the seem to favor either the registered person or other laws. And that was sort of my thought when saying Tinder would have to delete if you withdraw consent: I would think consent would be the only grounds for processing data for a company like Tinder. Wrt 1 and 2 of article 6 you mention. I'd have though Tinder wouldnt be able to claim anything since for 1) the interest of the subject would the to delete it and 2) "Tinder making money on your data" cannot be considered a legitimate interest. And when it comes to Tinder havning to store due things like in the case of sexual assault they would still have to consider the priciples of limitation on what they use the data for (eg. cannot sell your sexual prefernces to adverticers if the only legal grounds is some law requirinh them to store data for a very scific cause), right? And then there is the whole notification to the subject thats going to be a major pain aswell.
Anyway, not a lawyer, and all the special cases you point out is probably valid. But thats why the only really interesting thing is to see the first cases and judgements on this so we can get some indication of interpretation. And ofcourse seeing EU will actually execute the high fines - if not then all this wont have any effect anyway
I believe the company in question would also need a legal entity in the EU in order for the EU to prosecute them, as I don't think you can take (e.g.) an American company to an EU court. IANAL though.
Without a US court case they'd be dependent on assets or an income stream in the EU to be able to force payment of any fines, though.
If the company wants to do business with a EU customers, they have _some_ surface area in the EU, which is enough.
> an income stream in the EU
If the company cares for EU customers, there's probably also _some_ way to make money on them. Unless EU customers will exclusively get Netflix USA ads in the future (which are 100% useless to them) on an otherwise 100% free service, there is a money stream to hook into.
That said, that's usually only a problem with small companies. Very few large companies manage to avoid all financial exposure to the EU and still do business with EU residents, so it has relatively little practical impact.
e.g. if Facebook pulled out (unlikely), then someone can just make a new Facebook site (we already know what functionality to copy), and then suddenly Facebook has a competitor.
But I can't find anything about how they'd make it enforceable in other jurisdictions (as opposed to enforcing the judgements by e.g. fining EU subsidiaries and the like).
Article 50 does say the Commission should take "appropriate steps" to ensure international "cooperation mechanisms", and its clear under e.g article 44 onwards that carrying out a transfer to a jurisdiction where the data would be subject to inadequate controls would be a violation of the directive, so you may very well be right.
Sure you can. EU Courts did it to Microsoft over (IIRC) internet explorer resulting in a brand new SKU. Microsoft tried the logic you used at which point the EU courts started levying 1.5m euro / day fines for noncompliance.
Turns out that if you want to do business in a jurisdiction badly enough, it creates their leverage to enforce their laws on you.
I don't quite get what logic you think I used that doesn't agree fully with what you said above would be.
No, but they can go after the original company who transfered the data. Remember, under EU law, companies don't own that personal data. It's not theirs to give away.
At first I thought "how would they know that" but it's simple: establish "home" for each of a match pair and identify that both parties' devices are at one or the other "home" during certain hours after matching.
In that sense, it's more than just data, it's inference, and that's almost worse as a private company's data could end up libeling you if it leaks!
It's going to be interesting to see how Tinder tackles the 2018 EU General Data Protection Regulation in 2018 and how things will play out in courts and practice.
For example, are you allowed to store information that I have chosen to unlink? Will Tinder have an easy way to export the data without having to settle to long email conversations, as there is a right to data portability? If so, in what format will this data be presented?