News for hackers. Stuff that matters.
Re:First complaints under the GDPR lodged within hours by DanBC on Saturday June 09, 2018 @08:23AM (#17272673)
There are several lawful bases for processing personal data. Consent is one of them. The companies don't have to rely on consent. But if they do that consent must be freely given.

This point in GDPR could be clearer, and I hope the national regulators provide better advice.

Also, lots of complainants don't understand GDPR and so we will see a bunch of complaints based on incorrect understanding of GDPR.

https://gdpr-info.eu/art-7-gdpr/

> When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

Re:First complaints under the GDPR lodged within hours by alfredallan1 on Saturday June 09, 2018 @08:45AM (#17272753)
>Also, lots of complainants don't understand GDPR and so we will see a bunch of complaints based on incorrect understanding of GDPR.

Indeed, probably lots of entitled people who believe Facebook (though I’m no fan, and haven’t used it in years) ought to behave as a charity or govt-funded entity.

>https://gdpr-info.eu/art-7-gdpr/

Thanks for that (I’ll be reading through the link more fully).

>When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

So, the company needs to phrase/frame/present the “service” carefully enough - to take the example of FB again, the service they offer could be phrased as "a means to communicate with and see updates from your connections, together with ads that have been targeted based on your profile details”. Naturally a contract to execute such a service cannot be fulfilled without them processing personal data, and this is the only service they offer. Does this understanding seem correct?