Re:Mental-health information 'sold to advertisers'
by PeterisP on Wednesday September 04, 2019 @12:35PM
(#20878845)
It's not that clear-cut. If particular metrics of 'browsing habits' directly reflect health information, then it is not legal to collect and use these metrics unless very specific conditions are met (which generally can't be met in the generic third party advertiser case). Under GDPR, health data, among with some other categories, counts as especially protected data with much more stringent restrictions than the usual GDPR restrictions.
For example, if you place a cookie recording visits to a specific results page of a mental health test (e.g. a page saying "you got 14-18 points on this test which implies foobar" or get a https://www.hotjar.com/ recording of what the user typed in that test, then that would be blatantly illegal, violating GDPR article 9.1. I'm not even talking about using that data for targeting ads, the default position (if no exceptions are met) is that you're not allowed to collect and store that data.
Collecting user browsing habits is not (in EU) "legal by default" - it may be legal, but it may be not (e.g. if sensitive data are collected as in this case) and it's the duty of data controller to ensure that all the requirements are met - if it turns out that it's too difficult for you to automatically distinguish which browsing habits you are allowed to collect and which not, then the only legal option is to assume that you're not allowed to collect them.
Having your health data not be collected by random companies is an important inalienable right (e.g. privacy as one of the core rights in EU charter of human rights); while collecting and storing browsing habits of other people is a privilege, you're allowed to do that only if you can meet all the required conditions.
For example, if you place a cookie recording visits to a specific results page of a mental health test (e.g. a page saying "you got 14-18 points on this test which implies foobar" or get a https://www.hotjar.com/ recording of what the user typed in that test, then that would be blatantly illegal, violating GDPR article 9.1. I'm not even talking about using that data for targeting ads, the default position (if no exceptions are met) is that you're not allowed to collect and store that data.
Collecting user browsing habits is not (in EU) "legal by default" - it may be legal, but it may be not (e.g. if sensitive data are collected as in this case) and it's the duty of data controller to ensure that all the requirements are met - if it turns out that it's too difficult for you to automatically distinguish which browsing habits you are allowed to collect and which not, then the only legal option is to assume that you're not allowed to collect them.
Having your health data not be collected by random companies is an important inalienable right (e.g. privacy as one of the core rights in EU charter of human rights); while collecting and storing browsing habits of other people is a privilege, you're allowed to do that only if you can meet all the required conditions.