Hacker News Reader

Comment by alfredallan1 | Hacker News Reader

>It's my understanding (which could be wrong, is constantly evolving, and desperately needs test cases) that being able opt out of unnecessary PII collection or processing is a legal right, and phooey to the ToS that claims otherwise.

That’s actually a great point. Collecting PII is NOT illegal, as far as I can see. Nor can it be illegal. Same for personalized ads.

Consider a real estate agent. To show you the right kinds of houses to buy and finally make the contract, they have to have enough PII about you. If they know nothing about you, they’ll end up showing 1-bedroom studios for a family of five and a three bedroom suite for a bachelor living alone. Similar arguments can be made for all kinds of service providers.

Now onto the issue of FB, the only service they offer is “communication tools with built in personalized ads”. PII is necesary to provide that service.

View on HN

well, I'm cagey with "unnecessary" because I honestly think it's going to take a good few cases in front of judges until we properly understand where that lays. Which will be fun.

I'm also curious where other points will land in reality. eg, if I ask Apple to remove all data they have about me, will that also remove me from your address book? If I ask Google to remove all data they have about me, will that also remove any emails you've received from me?

In this light, I'm happy to see the first complaints arrive against Google and Facebook, as they're exactly the examples we all have in mind, and we need to see how they'll play out in reality.

(Albeit, I also trust the European legal systems won't commonly wield the maximum possible fines, but rather seek compliance. The scary big numbers, the source of so much FUD, should be reserved for wilful disregard after this step. "Walk softly but carry a big stick" style.

Yes, indeed. It will take a few cases to see what reality is. Though I am equally sure companies which make billions off personal data will leave no stone unturned to argue that their use case is legit.

Their case will be helped by the fact that they can simply have the user “consent” to stuff. And since none of those are “critical” services, they will find ways to prove that user consent was actually voluntary, and not coerced.

So I think you’re right that only the most egregious violations will have real trouble.

The judges might also want to demonstrate to everybody (including their own system) that the big stick can in fact be wielded to real effect. If people start beliving that the stick is really just a prop, no point carrying it, is there…

> Collecting PII is NOT illegal, as far as I can see. Nor can it be illegal.

Article 6 [0] is phrased negatively, making collecting PII illegal unless x or y. These points cover all the use cases the lawmakers deemed valid; a real-estate agent may collect PII because of 6.1b (taking steps to enter a contract at the request of the data subject). Should a new, possibly valid reason to collect PII come up it would first need to be checked and then added to the list.

Since most websites and online services do not aim to form a contract nor fit points c-f, they have to obtain consent by the data subject (6.1a) to make collecting PII legal.

[0] https://gdpr-info.eu/art-6-gdpr/

Doesn’t “consent” (point a) supersede all the rest? Looking at how people have been conditioned to so easily click on "I agree", that will be the most obvious thing to pursue for most companies.

You can do more or less anything with the subject's consent, but one of the big changes under the GDPR is that subjects can always withdraw that consent later and then exercise their right to erasure if there is no other lawful basis for that processing.

Since most websites and online services do not aim to form a contract nor fit points c-f, they have to obtain consent by the data subject (6.1a) to make collecting PII legal.

Many common purposes for data processing might come under point f (legitimate interests) depending on the circumstances. Analytics, marketing, monitoring to check for fraud or other abuses are just a few examples.

Reply on news.ycombinator.com