News for hackers. Stuff that matters.
Re:Tim Hortons app violated laws in collection of ‘vast amou... by ljm on Wednesday June 01, 2022 @10:39PM (#31590653)
This is ostensibly the purpose of GDPR. Selling personal data is illegal unless the person opted in. It's opt-out by default.

The problem is that it's the internet... the law works for honest websites and companies but not for anyone else.

Re:Tim Hortons app violated laws in collection of ‘vast amou... by tremon on Thursday June 02, 2022 @06:47AM (#31593390)
Selling personal data is illegal unless the person opted in

That's not possible to opt in to under the GDPR, FAFAIK. People can consent to the purpose for which their data will be used, and any such purpose must be enumerated explicitly. "Selling the data" is not a processing purpose, and it would still be illegal even if the person consented (it does not meet the bar for informed consent).

Under the GDPR, the only legal way for personal data to be transferred between companies would be for the "buyer" (processor) to use the data original data from the "seller" (controller) on behalf of the controller. The data, as consented to be collected, remains the liability of the controller for its entire lifetime.

Re:Tim Hortons app violated laws in collection of ‘vast amou... by PeterisP on Thursday June 02, 2022 @03:55AM (#31592504)
On the other hand, the main source of the money for the industry - major advertisers - are legitimate above-board companies, who either are honest or are liable for enforcement.

GDPR is not really about selling personal data but about using it; a big part of its effect is on buyers of data since GDPR effectively (there are all kinds of nuances) means that it's not legally possible for legitimate company to simply buy personal data for arbitrary purposes, since the data subject obviously did not opt-in to that particular purpose by that company when the data was collected.