Hacker News Reader

Comment by cblconfederate | Hacker News Reader

https://gdpr.eu/gdpr-consent-requirements/

> “Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.”

> 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

View on HN

That point applies to just one of the bases. It's basically for the extra information which you don't require, but still want.

If your business explicitly deals in user information:

> In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis

> ... these are the other legal bases:

> 1. Processing is necessary to satisfy a contract to which the data subject is a party.

In that business it's necessary to share the data which is being sold. It's part of the contract. As long as you comply with notification, listing 3rd parties, and other relevant points, you can require and sell that data.

Can a publisher demand "user information" in exchange for reading an article, even if it lists 1500 trackers, even if it's part of the contract? No , GDPR forbids it.

That's the gist of the matter. Private information is not tradeable, therefore it's not really property, and certainly not owned by the users since they can't sell it for goods they readily want to acquire.

The clause you quote only applies if the private info is necessary for the service rendered. GDPR considers advertising optional, despite the fact that it's crucial for the survival of websites.

They can sell it. What GDPR prevents is hiding the trade or bundling it into other exchanges.

So you're free to say "this access costs $x, you can sell your data for that much on this other service". If you learn through that that people actually are not prepared to sell their data, then GDPR achieved its purpose.

If you work on the other side, it may seem hard to handle. But if websites can't survive without trading user data, I'm happy for them to die and get replaced by something with better business model. Global data abuse is not worth it.

I guess you could also start a business explicitly selling user data to get access to 3rd party services as a replacement of payment. As long as it's a separate entity, it could work?

If it s not a tradeable goood how is it sellable then

Let alone, you cant demand consent even with self hosted ads. You are obliged to give the content for free even if they dont consent

I dont understand why you keep changing the subject

You're mixing trading data for services you provide with selling the data. GDPR prevents the first, (because it's been abused) but not the second.

If you run a data trading business, I can sell you my data, and GDPR will be ok with that.

No, GDPR considers collection, sharing and use of personal data to deliver targeted advertising optional. You can still deliver advertising that doesn't use any personal data.

Irrelevant. Users still cant sell their own info consensually, therefore they dont really own it

Reply on news.ycombinator.com