News for hackers. Stuff that matters.
Re:Prison time, hefty fines for data privacy violations: dra... by i_am_nomad on Sunday November 04, 2018 @12:51PM (#18377070)
That would be a very positive consequence.
Re:Prison time, hefty fines for data privacy violations: dra... by paulcnichols on Sunday November 04, 2018 @12:59PM (#18377113)
Very true in some cases, i.e. unrollme. But I also like free content and am mostly willing to trade a little privacy for access.
Re:Prison time, hefty fines for data privacy violations: dra... by Etheryte on Sunday November 04, 2018 @01:07PM (#18377162)
I think the trade-off should be a lot more explicit though, e.g. you get to choose whether pay 5€ per month or your usage data gets sold.
Re:Prison time, hefty fines for data privacy violations: dra... by scarejunba on Sunday November 04, 2018 @02:58PM (#18377794)
If you want to be GDPR compliant I don't think you can do that. If you offer the "usage data gets sold" option you also have to make that full opt-in _and_ not deny the service if they don't opt-in.
Re:Prison time, hefty fines for data privacy violations: dra... by esotericn on Sunday November 04, 2018 @07:30PM (#18378897)
Is charging a (reasonable) fee 'denying the service'?
Re:Prison time, hefty fines for data privacy violations: dra... by kruczek on Monday November 05, 2018 @04:18AM (#18380940)
Possibly.

Under GDPR, if your data processing is based on user consent, then that consent must be given freely. That means you should provide equivalent service, regardless of consent being given. Providing one service for free and another for a fee is not equivalent, so I'd argue that such consent would be invalid, as it was not freely given.

However, consent is only one of several conditions for processing data. Another would be "legitimate interests" of the business. If you choose to process data based on it, then you do not need consent at all. In such case you can provide separate services: free with data sharing, and paid without data sharing.

The trick here is that you actually need to be able to prove that "legitimate interests" of your business require collection and processing of that data. And additionally such interests are overridden by "fundamental rights and freedoms" of users. Which is probably why most businesses went the consent route, as it appears to be more clear-cut.

Re:Prison time, hefty fines for data privacy violations: dra... by Etheryte on Tuesday November 06, 2018 @05:28PM (#18395488)
Thanks a lot for the insight, wasn't familiar with the GDPR logic. I think it'd be very hard to make a business case for processing non-paying users only so it's pretty easy to understand the consent option now.