Hacker News Reader

Comment by dordoka | Hacker News Reader

I guess that sentence is referencing article 43. IANAL.

See http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN...

Article 43:

> In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

(My italics.) The second sentence seems clear: "consent is presumed not to be freely given" if the service could be provided without the consent. Which means consent cannot be traded in exchange for an unrelated service, like e.g. webmail.

I'm not sure what the relation between the two sentences is. Does the second one ("consent is presumed...") apply only to the cases addressed by the first, i.e. "where there is a clear imbalance"? Or are they independent?

Again IANAL and not english native speaker, but my understanding is that they are not independent.

Consent is presumed not to be freely given IF it does not allow..., OR IF the performance...

I was asking about the relation to the first sentence, the one starting with "In order to ensure that". That first sentence talks about "a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority". Is the second sentence ("Consent is presumed not to be freely given...") limited to cases with such imbalance?

Oh sorry. In that case, my understanding is that they are independent.

The above is a recital which gives background and useful in interpretation. However Article 7 is the meat in relation to consent.

https://www.privacy-regulation.eu/en/7.htm

In answer to your question the two items are independent. The first item gets at the idea that it's not possible to provide consent where the you really have no choice but to consent (i.e due to imbalance of power). One area of particular interest is in the field of employer-employee relations. Bundling up consent with a job offers means it's very difficult for the employer to refuse.

The other item gets at general service provision. You shouldn't make consent a condition of providing a service where that consent isn't necessary to provide the service.

So really the feeling at least consent-wise is that Google cannot attach consent to gather info for advertising with a service provision like search.

However they may instead seek to rely on a separate processing ground under art 6. The main one would be legitimate interests. There is some debate over the applicability if that ground is acceptable though.

/edit Plus the new ePrivacy Regulation brings additional considerations - in particular there's not currently any legitimate interests ground for processing

That's like a 50+ word sentence. I do hate these legal shenanigans. If you can't write it in plain English is not worth the bytes taken.

You can argue against the chosen font type, and it'd be still irrelevant. Most educated adults are able to read sentences longer than a few words. For the rest, trust your representatives.

It's not about people being able to read it. It's about trying to be intellectual. Long sentences are usually prone to interpretation. There is no value in making sentences this long. But that's just my opinion.

The legislation itself refers to this in article 7.4: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. " I don't think it is forbidden, but you'd have a hard time explaining why consent is freely given despite the fact that access to a web site is denied if you don't give consent.

A couple of specific scenarios:

Visit turbotax.com to file a tax return, it asks for your bank account before you fill out the tax information. But it's not required, unless you're reporting interest earnings on that account.

On turbotax.com, after you fill out the tax form you have a refund of overpaid taxes. The site asks for your bank account in order to arrange for the refund to be deposited, or instead they can arrange for you to receive a paper check and you don't have to give your bank account.

I misworded these hypothetical scenarios, making them seem like they would actually happen today. I don't recall that it asks you for bank account numbers before you even begin. It probably doesn't. I have used turbotax for years and had pretty much the same bank accounts during that time. It does ask for the numbers at reasonable times. If you don't give them you can still use Turbotax to take care of business.

Reply on news.ycombinator.com