Re:First complaints under the GDPR lodged within hours
by IshKebab on Saturday June 09, 2018 @01:05PM
(#17273882)
If the personal information is not necessary you need explicit consent.
> Processing shall be lawful only if and to the extent that at least one of the following applies:
>
> 1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
>
> 2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
>
> (there are a few more cases)
Given that there is no contract for which the personal information is necessary when you view a news site, they have to ask for consent. Which is why they ask for consent. However:
> Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data [...]. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance [...]. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. [...] the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
I would say that this especially violates the last sentence. It is definitely unnecessarily disruptive.
Unfortunately this is in a "Recital", not in the main text. I have no idea what that means but I expect we will have to wait for a court case to find out the real answer.
> Processing shall be lawful only if and to the extent that at least one of the following applies: > > 1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes; > > 2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; > > (there are a few more cases)
Given that there is no contract for which the personal information is necessary when you view a news site, they have to ask for consent. Which is why they ask for consent. However:
> Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data [...]. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance [...]. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. [...] the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
I would say that this especially violates the last sentence. It is definitely unnecessarily disruptive.
Unfortunately this is in a "Recital", not in the main text. I have no idea what that means but I expect we will have to wait for a court case to find out the real answer.