Hacker News Reader

Comment by hispanic | Hacker News Reader

I appreciate the thought, but I don’t see how that complies with either the spirit or the wording of the GDPR. One of the goals of the GDPR is for data controllers to obtain explicit consent that is rather granular in nature - aligned with the purposes for each data collection. In the case of me providing a form allowing people to subscribe to my blog, the ostensible (and stated) purpose of me collecting their email address is so I can send them emails notifying them when I post a new article. But, if I’m also using their email addresses to track their interaction with my emails, that’s a distinct and separate purpose to which they never consented. More info: https://www.gdpreu.org/compliance/email-tracking/

Embedding implied consent to such tracking in a separate document (privacy policy) does not seem to be very transparent. What am I misunderstanding?

View on HN

I think it's more easy. When they subscribe to your blog, you should include the aspect that the data processor (handling the email) do some additional tracking in order to pursue a specific service. Regarding the consent (article 7 of the GDPR), provide a clear description why you do tracking and the objective. The transparency aspect is very important.

PS: It's usually better to have a look at the GDPR on the official website of EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

You would still need to ask specifically for opt-in for that tracking, because it is not essential to the "service" (the newsletter).

And yet, amongst all of the privacy policy update emails I've received of late, I haven't been explicitly asked to consent to email tracking.

MailChimp wants to embed GDPR-compliance language akin to the following: "You acknowledge that the information you provide will be transferred to MailChimp for processing in accordance with their Privacy Policy (https://mailchimp.com/legal/privacy/) and Terms (https://mailchimp.com/legal/terms/).”

But, MailChimp allows open-tracking to be disabled. So, that wouldn’t seem to be a required element of their processing. Which means it’s for the controller to decide. I don’t understand how article 7 of the GDPR allows for email tracking to be immune from explicit consent.

It's not immune to explicit consent. You have to clearly state it why you (or your data processor) does email tracking. This can be included and described when the user subscribe to your blog post.

Oh - OK. Then we’re of the same understanding. And yet I don’t see anyone do this. But I seriously doubt everyone is disabling their email tracking en masse. Which is why I asked my original question. :)

Reply on news.ycombinator.com