Comparison of California Consumer Privacy Act (CCPA) and GDPR [pdf]

Re:Comparison of California Consumer Privacy Act (CCPA) and ... by l4u532 on Wednesday November 13, 2019 @03:39PM (#21529267)

GDPR is NOT entirely opt-in. For reasons of ‘legitimate interest’ a consent-less collection is warranted (ie. to perform the service). Yes, this does usually excludes data collection for marketing purposes. But it’s important to state that it’s not Entirely opt-in.

[ Parent | on HN ]

Re:Comparison of California Consumer Privacy Act (CCPA) and ... by ed on Wednesday November 13, 2019 @03:45PM (#21529349)

If the collection is truly necessary to provide a service, and the consumer has decided (opted in) to use that service, it seems pretty reasonable.

[ Parent | on HN ]

Re:Comparison of California Consumer Privacy Act (CCPA) and ... by jdlshore on Thursday November 14, 2019 @02:17AM (#21533466)

However, data collected for that "legitimate interest" may only be used for that specific legitimate interest. They can't turn around and use it to end-run the consent requirement.

Also, the "legitimate interest" of the business is required to be weighed against the interests of the data subject, so it isn't a blank check.

[ Parent | on HN ]