Re:Automating cookie consent and GDPR violation detection
by alfiedotwtf on Tuesday March 22, 2022 @01:50AM
(#30763105)
And what if you need third-parties like a payment gateway? How do you do this without sharing PII?
Re:Automating cookie consent and GDPR violation detection
by M2Ys4U on Tuesday March 22, 2022 @07:37AM
(#30764838)
Are you under the assumption that the GDPR requires consent for all processing of personal data?
Because it doesn't.
There are six legal bases for processing personal data in in Article 6 of the GDPR.
Consent is the first one, but the second one listed (paragraph (b)) is that the "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract".
That covers your payment case.
You don't have to ask for consent or permissions for data that is strictly required for the functionality of your website. You're still responsible for keeping PII data safe etc., of course.
basically, you created those problems for yourslef, and now blame the law.
> For people who claim GDPR compliance is clear and straightforward - I can't believe they actually have much experience working in Privacy.
It is very straightforward when it comes to the use cases you described.
> Actual implementation gets... very opaque.
That's your problem, not the law's problem. Ask only for data you strictly need. Keep safe. Do not share with/sell to third parties.
This was true for years before GDPR, and the only reason everyone found it "so hard" is that everyone, including you and your corporate sites, didn't give two craps about users' privacy.