You may argue against the GDPR, but it doesn't change the law as it stands today.
There is nothing illegal about having the above two lines of services. But when a user wants service no. 1, their personal data becomes neccessary to show personalized ads. If the user chooses to not “pay” in the curreny of personal data, it is perfectly fine, they can use service no. 2.
Why is this illegal? Please, be specific with which part of the law prohibits this.
Morally, ethically, I agree with you. 100%. I was in fact involved in a spread-the-word about GDPR campaign few months back. This discussion is about the legality and the technicality.
> Processing shall be lawful only if and to the extent that at least one of the following applies: > > 1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes; > > 2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; > > (there are a few more cases)
Given that there is no contract for which the personal information is necessary when you view a news site, they have to ask for consent. Which is why they ask for consent. However:
> Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data [...]. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance [...]. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. [...] the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
I would say that this especially violates the last sentence. It is definitely unnecessarily disruptive.
Unfortunately this is in a "Recital", not in the main text. I have no idea what that means but I expect we will have to wait for a court case to find out the real answer.
It is perfectly reasonably to have two versions of a service - one with ads/cookies and one without. The user uses the one they want.
If one considers personal information as a currency, it is something one can choose to or not to pay. If the user's privacy is important enough to them, they won’t give the company the right to track them or do whatever else with their data. The user decides whether access to that service is worth paying the price in terms of privacy. I think Facebook is too expensive (in terms of my personal data they get) so I don’t use the service. But I cannot complain that FB doesn’t service me for nothing. It is a for-profit company. The company is not obligated to service everyone - it is not public transport or the electricity company.