Why not do it like with cookies?
People are already used to accept these cookie policies, so why not just widen it to GDPR related stuff?
Also how much can be caught with "security" reasons?
People are already used to accept these cookie policies, so why not just widen it to GDPR related stuff?
Also how much can be caught with "security" reasons?
Most cookie policies in practice are all or nothing: you either accept and continue, or you decline and cannot use the service/website. That is not allowed under GDPR.
"Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement [...]" [1]
"Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." [2]
[1] https://gdpr-info.eu/recitals/no-32/ [2] https://gdpr-info.eu/recitals/no-43/
but to play the devil's advocate, if it costs money to provide a service, but that money is currently supplied by selling personal data to third-parties, then isn't it true that the service cannot be provided without the data?
My understanding is that there can be other consents, such as consent to changes of Terms of Use, which are required to access a service.
Only things you only use for security purposes. You can't say "we need X for anti-fraud" and then use it for marketing purposes without consent.
Part of GDPR effect is that if you get caught, you can't talk it away with some blanket claim in your EULA, you need to have a detailed justification, and there is potential for painful fines, so the risk increases.
If the details of the breach indicate you were using data for another purpose than what was allowed you will have a problem.