Hacker News Reader

Comment by adulau | Hacker News Reader

Why don't you put a privacy policy explaining this in your blog? As long as you ensure 'lawfulness, fairness and transparency', you can easily be "GDPR-compliant". Keep a record of your processing activities (e.g. MailChimp is data processor and your are the data controller) and a quick note about the risk associated.

View on HN

I appreciate the thought, but I don’t see how that complies with either the spirit or the wording of the GDPR. One of the goals of the GDPR is for data controllers to obtain explicit consent that is rather granular in nature - aligned with the purposes for each data collection. In the case of me providing a form allowing people to subscribe to my blog, the ostensible (and stated) purpose of me collecting their email address is so I can send them emails notifying them when I post a new article. But, if I’m also using their email addresses to track their interaction with my emails, that’s a distinct and separate purpose to which they never consented. More info: https://www.gdpreu.org/compliance/email-tracking/

Embedding implied consent to such tracking in a separate document (privacy policy) does not seem to be very transparent. What am I misunderstanding?

I think it's more easy. When they subscribe to your blog, you should include the aspect that the data processor (handling the email) do some additional tracking in order to pursue a specific service. Regarding the consent (article 7 of the GDPR), provide a clear description why you do tracking and the objective. The transparency aspect is very important.

PS: It's usually better to have a look at the GDPR on the official website of EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

MailChimp wants to embed GDPR-compliance language akin to the following: "You acknowledge that the information you provide will be transferred to MailChimp for processing in accordance with their Privacy Policy (https://mailchimp.com/legal/privacy/) and Terms (https://mailchimp.com/legal/terms/).”

But, MailChimp allows open-tracking to be disabled. So, that wouldn’t seem to be a required element of their processing. Which means it’s for the controller to decide. I don’t understand how article 7 of the GDPR allows for email tracking to be immune from explicit consent.

It's not immune to explicit consent. You have to clearly state it why you (or your data processor) does email tracking. This can be included and described when the user subscribe to your blog post.

Oh - OK. Then we’re of the same understanding. And yet I don’t see anyone do this. But I seriously doubt everyone is disabling their email tracking en masse. Which is why I asked my original question. :)

You would still need to ask specifically for opt-in for that tracking, because it is not essential to the "service" (the newsletter).

And yet, amongst all of the privacy policy update emails I've received of late, I haven't been explicitly asked to consent to email tracking.

It isn't enough anymore to put this into a PP. If the subscribers did not gave consent for this it cannot be tracked (at least I think).

Consent is only one reason for data handling. There are others. Consent doesn't always need to be given.

https://twitter.com/bainesy1969/status/995370110587154433

Only if it is strictly necessary in order to conduct business, and no longer than that. E.g. using cookies for managing a session’s shopping cart. Obviously tracking emails for marketing purposes is not allowed.

Tracking emails for marketing purposes can be seen as a legitimate interest. As long, it's describe to the data-subject and they give their consent, it's allowed.

Recital 48 is giving some explanation:

"The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

I really think the answer to this question at the moment depends upon the person asking. All I read in recital 48 is that PII might be shared within a group of companies that fall under the same holding.

IANAL, but I spent the past 2 years as CTO of an EU-based analytics company becoming compliant with GDPR, and consider myself quite informed on the topic. I would tread more carefully than what you are suggesting.

If a data-subject subscribes to a mailing-list by giving your email and you have a "request for consent shall be presented in a manner which is clearly distinguishable from the other matters" which can be clearly describe in your privacy policy, you are totally inline with the article 7 for the condition of consents.

Reply on news.ycombinator.com