GDPR Violation: Scribd acquires PII on 500M users in a deal with LinkedIn

Sure the "rules" say to assume with best intentions. That goes along with "obfuscate and redirect". It's easier to point at rules as a club to make an example. But in reality, in the end VCs are themselves toxic.

Look no further than the crowd of businesses and partners YC surrounds itself with.

That said, if you want to do a funded start-up and you're in the United States nothing will come close to beating YC for effectiveness, even today.

If you get the popup, by all means, do NOT confirm or it will create an account. Haven't heard of people getting the popup though, strong hint that all users were magically autocreated.

After all, we can sign people up in 20 milliseconds, I don't see why marking an account as in the process of deletion should be so hard.

  * Never deleted an email from archive
  * Don't recall ever registering on either ScribD or Slideshare
  * Got the same email as the author, which is the first from either Slideshare or ScribD
  * Could log in using my LinkedIn account and saw all my personal information from LinkedIn there

By the way, my email is marked private on my linkedin account, but now it's on slideshare. So selling information you marked as private!

source: https://gdpr.eu/gdpr-consent-requirements/ on other legal bases for processing: Processing is necessary to satisfy a contract to which the data subject is a party.

The legitimate interest one is pretty fuzzy, what would the legitimate interest be here? "I want their data" isn't enough, I'm pretty sure.

A contract could transfer users, assuming regulations are followed and users were acquired legitimately (both of which are debatable here). However a contract that requires to transfer users without notice nor consent is defacto null because it is not lawful.

These are extremely serious considerations for the case at hands. Companies knew what they were doing, the acquisition and PII transfer is not merely accidental, that should be covered in the contract. Depending on the wording and the intent of the companies (and any public backslash that might ensue and bring things to light), either side might lawyer up and reconsider the contract, or a third party like a regulator might jump in (could fine the parties or void the acquisition).

Products and services aren't the issue; it's how you use+process users' data. Many products and services don't materially affect that, so won't require additional consent (e.g. if you're a company that sends news-updates by email to users that opted in, I don't believe sending them other updates is a PII issue - course, it might be spam, and IANAL). Also, products and services you're explicitly contracted for are exempt anyhow (e.g. if the user is paying you to remind them to take their meds on time, you don't need additional GDPR consent to store and process their sensitive personal data to the extent necessary to fulfill that contract - though other laws almost certainly apply to medical data).

If it was a LinkedIn-asset, that could look different (e.g. you can access YouTube with your Google Account created for GMail). But that would create another problem: if it was an asset (and not a company), you'd need opt-in from every user to transfer their user data over to the buyer, because the buyer would be a third party.

It's either a company or an asset, it can't be both at the same time.

https://www.legislation.gov.uk/ukpga/2018/12/contents

Which is still in force

In my understanding: either they violated GDPR by sharing data with SlideShare, or they violate it by selling SlideShare to Scribd.

Each use case of processing of personal information must satisfy the GDPR necessary requirement or have a priori informed consent.

During merger of Scribd into LinkenIn, they can argue that it is necessary to treat the databases as a single controller as a cost cutting measure. However, if they are going to treat Scribd as a separate severable entity, then it cannot be argued that it is necessary to process personal information into the Scribd databases which going forward will only process data in a manner not consented to.

If Scribd is not able to distinguish at that point original users that have meaningfully consented to being processed by Scribd from LinkedIn users who have not meaningfully consented to being processed, then they have no meaningful consent at all and therefore no real lawful user data because not knowing if a user has meaningfully consented or not is equivalent to not having meaningful consent for that user.

The most similar scenario is when GDPR took effect and many companies essentially had no meaningful consent for their userbase. During the grace period between GDPR taking effect and GDPR fines being enforceable, companies contacted their userbase to acquire consent and the diligent companies destroyed the user records of the users that did not contact them back since meaningful consent cannot be opt out. Of course, many companies were not diligent and held onto user records nevertheless and are waiting to see if they will have to pay the piper or not.

This is easily distinct from change of a controller when the new controller will continue the business: consent to have data processed in a particular way was acquired. In this case the separated entity will process data in a manner which was not consented to. Unless Scribd is somehow going to try to convince recruiters to use their service to find users who are going to manicure CV like profiles, which is more or less what LinkedIn users consent to.