Hacker News Reader

Comment by downandout | Hacker News Reader

Interesting that WaPo's free option seems to be in violation of GDPR. It has no option to reject personalized ads and third party trackers - you can simply accept and view the site, or go away:

http://prntscr.com/joqj3d

That seems to be in direct conflict with GDPR provisions that force web publishers to give people the option to reject personalized ads while still giving them the services they were trying to access. I'm sure that when regulators come calling, they'll claim "legitimate interest," but if this model is acceptable under GDPR, then almost nothing has actually changed under it.

View on HN

That is only if you use consent as your lawful basis.

The reason why nearly everyone is using consent currently is because the other straightforward one which is:

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

Is so vaguely defined as far as benchmarks go and no one is up for taking the risk of being at the mercy of the judgment of 28 different regulators and court systems.

I don't think it's necessarily the case that everyone's using consent currently. They just think (probably correctly) that regulators will be more favorable to a company that always makes disclosures and asks for permission up front.

The disclosure part is unrelated to the basis, you need to tell the user what you collect for what purpose and what is the lawful basis for it. Consent is no more lawful than interest however it’s less open to interpretation despite its likely not the most appropriate basis for many cases. Consent doesn’t enables you to do more or less all the lawful bases by definition are equal in their scope.

If it makes you anxious whether or not you are compliant, you're probably not. As a rule of thumb this goes pretty well with a lot of legislation.

That’s not how the real world works at all virtually all proper regulation has set of benchmarks and a defined compliance validation process.

> That seems to be in direct conflict with GDPR provisions that force web publishers to give people the option to reject personalized ads while still giving them the services they were trying to access.

Which part of the GDPR requires a site to give access to someone who doesn't agree to their terms?

On the off chance that you're not just trolling, this is one of the main points of the GDPR. If this is news to you, I invite you to read up on the subject.

I think you should follow your own advice because what you said is completely untrue.

Not an EU citizen or a lawyer (NEUCoLa) so, yeah, nothing leaped out at me (https://eur-lex.europa.eu/eli/reg/2016/679/oj) as requiring a site to give access to someone, regardless.

Reply on news.ycombinator.com