What is the ‘legitimate interests’ basis?

> You are also likely to need consent under ePrivacy laws for most marketing calls or messages, website cookies or other online tracking methods, or to install apps or other software on people’s devices.

source: https://ico.org.uk/media/about-the-ico/consultations/2013551...

You only need consent when legit interests don't apply, so this is basically saying it isn't sufficient.

Also:

(47) … The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.

source: https://www.gdpreu.org/the-regulation/key-concepts/legitimat...

Sure. I admit, I simplified things because hackernews can be a rather hostile environment on this topic. It's not that you can't use consent, it's (as you say) that legitimate interest is insufficient as most types of electronic marketing require consent and those where it is possible is made much harder to justify as a long-term strategy.

The PECR section on the ICO website is a good start: https://ico.org.uk/for-organisations/guide-to-pecr/electroni...

Also, the ICO has an FAQ on exactly this at https://ico.org.uk/for-organisations/guide-to-the-general-da... . It is the question "Can we use legitimate interests for our marketing activities?". The whole thing is useful, but the bit below the yellow call-out is specifically about electronic marketing, and says:

"If you intend to process personal data for the purposes of direct marketing by electronic means (by email, text, automated calls etc) legitimate interests may not always be an appropriate basis for processing. This is because the e-privacy laws on electronic marketing – currently the Privacy and Electronic Communications Regulations (PECR) – require that individuals give their consent to some forms of electronic marketing. It is the GDPR standard of consent that applies, because of the effect of Article 94 of the GDPR." There's also a helpful table of possibilities below.

There's still the so-called 'soft opt-in', which is for cases where you're emailing someone that you've recently sold something to (or given a quote to) about a similar product or service and that you've given the explicit choice to refuse communications both when you collected the data and every time you've subsequently used it.

It's certainly possible to use legitimate interest for some forms of electronic marketing, but only in very specific circumstances. To give you an idea of it in practice, one of my clients has a marketplace style site. If you try and book a service but the booking falls through, for example because the service provider is unavailable, they'll email you within a couple of days if you don't look for someone new, pushing some suggestions. Then they'll stop emailing. That's legitimate interest through soft opt-in. They also send emails periodically about new service providers in your area, that is not covered by the soft opt-in so requires consent. Same for their general service newsletters.

There is also a PDF guide at https://ico.org.uk/media/1555/direct-marketing-guidance.pdf which has some good info. The header for the electronic marketing section is "General rule: only with consent", which I think is good advice. As others have said, there are other obligations under GDPR, so even if you can stretch the soft opt-in beyond what was intended, you're likely to run up against hurdles when it comes to the balancing test, or your data minimisation obligations. The soft opt-in is specifically for cases where a member of the public would expect to get communications because of the recent sale or enquiry, as time passes that expectation goes away and it starts to become very hard to justify in a GDPR context.

No, actually. Even before GDPR, it was illegitimate to use a pre-checked checkbox, or any other process that required out-out from the user.

This requirement was generally respected–I actually don't remember a single instance of it not being followed by European organisations.

“Reasonable person” tests are pretty common and well-understood in general. One of the reasons that the GDPR in particular avoids being overly prescriptive about how to meet its requirements is to avoid situations where it becomes inapplicable or obsolete due to changes in technology or habits.

And recording your IP address in the apache log?

It's a valid concern, but I don't think the line is as muddy as it seems at first glance: would I expect a Pyongyang hotel room to be bugged? No. But I also would not assume that it's not. With this construction you get two kinds of being surprised, with one taking all the variability derived from suspicions and the like while the other should remain quite stable. Just like most people were simultaneously surprised and not surprised at all by the Snowden revelations.

Obviously one would have to explicitly exclude from the "reasonable" test the kind of surprise that was not triggered by Snowden, because otherwise all our greatest fears would become legal by definition.

GDPR says explicit consent is enough for data tracking. FB gives a really clearly written prompt on, "By using FB I...". Pretty sure they are compliant, regardless of your moral judgments.