Hacker News Reader

Comment by cblconfederate | Hacker News Reader

> it's my information. You have no right to any

If it was yours, you would be able to sell it in exchange for something else. The EU's rules forbid this, basically giving ownership to the state

Also, let's be clear, it's not only YOUR information since you didn't collect it yourself, there could be an explicit formula about how much of it is yours. Just because GDPR says so doesn't mean it s correct.

also

> I take the stance that advertising is a cancer on society wasting: lives,talen

half the "articles" you read here is advertising

View on HN

> you would be able to sell it in exchange for something else. The EU's rules forbid this

Which rules? GDPR is all about being explicit about how the data is used and the right to choose. What is the rule preventing you from offering a service explicitly allowing people to sell their information?

https://gdpr.eu/gdpr-consent-requirements/

> “Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.”

> 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

That point applies to just one of the bases. It's basically for the extra information which you don't require, but still want.

If your business explicitly deals in user information:

> In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis

> ... these are the other legal bases:

> 1. Processing is necessary to satisfy a contract to which the data subject is a party.

In that business it's necessary to share the data which is being sold. It's part of the contract. As long as you comply with notification, listing 3rd parties, and other relevant points, you can require and sell that data.

Can a publisher demand "user information" in exchange for reading an article, even if it lists 1500 trackers, even if it's part of the contract? No , GDPR forbids it.

That's the gist of the matter. Private information is not tradeable, therefore it's not really property, and certainly not owned by the users since they can't sell it for goods they readily want to acquire.

The clause you quote only applies if the private info is necessary for the service rendered. GDPR considers advertising optional, despite the fact that it's crucial for the survival of websites.

They can sell it. What GDPR prevents is hiding the trade or bundling it into other exchanges.

So you're free to say "this access costs $x, you can sell your data for that much on this other service". If you learn through that that people actually are not prepared to sell their data, then GDPR achieved its purpose.

If you work on the other side, it may seem hard to handle. But if websites can't survive without trading user data, I'm happy for them to die and get replaced by something with better business model. Global data abuse is not worth it.

I guess you could also start a business explicitly selling user data to get access to 3rd party services as a replacement of payment. As long as it's a separate entity, it could work?

If it s not a tradeable goood how is it sellable then

Let alone, you cant demand consent even with self hosted ads. You are obliged to give the content for free even if they dont consent

I dont understand why you keep changing the subject

You're mixing trading data for services you provide with selling the data. GDPR prevents the first, (because it's been abused) but not the second.

If you run a data trading business, I can sell you my data, and GDPR will be ok with that.

No, GDPR considers collection, sharing and use of personal data to deliver targeted advertising optional. You can still deliver advertising that doesn't use any personal data.

Irrelevant. Users still cant sell their own info consensually, therefore they dont really own it

Yeah, and I hate those "articles" and flag them.

> If it was yours, you would be able to sell it in exchange for something else.

Where can I sell my information in the US? Oh wait, I can't, tech companies see it as a harvestable resource that they expect to get for free.

With GDPR's consent framework, I now could genuinely sell my data if I wanted to do so.

> I can't, tech companies see

You are right. But i could see a market forming if e.g. chinese companies were allowed to compete and offered direct monetary incentive to acquire users (would be cheaper than the ad spending they do)

>GDPR's consent framework, I now could genuinely sell my data

you couldn't because they are used for advertising, which is notnecessary for the provision of the service: https://gdpr.eu/gdpr-consent-requirements/

Reply on news.ycombinator.com