The telemetry goes to telemetry.dropbox.com. You get this telemetry because you have installed the Dropbox desktop app, which means Dropbox already has lots of access to your machine. If this telemetry just went back mixed with normal Dropbox communications (like most apps), would people even be aware of it?
There doesn't seem to be any discussion of what the telemetry actually is, just annoyance it exists.
There is no explicit consent.
Also consent to store does not imply consent to read, process, make use of.
I distinctly recall a webcomic in the past few years lampooning cloud storage. There was a guy who said "hey, there's this guy down the street who lets me keep stuff on shelves in his garage." "What does he charge you?" "Nothing, he says it's just cool if I keep it there." and then the stuff is sold off or tampered with, the guy is irate, and the moral of the story is essentially "why did you trust a random guy with a garage to keep your stuff?"
It's okay for a free service to change how they operate with a take-it-or-leave-it offer. It is not okay for a free service to invade your privacy without permission.
Additionally, all users should be able to trust Dropbox just as much as the paying users.
Too bad Dropbox does not see it that way.
To bad they just start scanning everything in ~/Dropbox.
It's a shame. I wish more engineers would see things through Richard Stallman's eyes, and realize that software is supposed to serve its users, not its creators. But, as the saying goes: "It is difficult to get a man to understand something, when his salary depends on his not understanding it."
Nonetheless, the potential is there and GDPR does consider it personal data from the point of view of consent, so dropbox is almost certainly violating the rules here even if they do not sell the data for advertising (as unlike the actual data they store, it is not necessary for providing the service, merely useful to the company for improving their service). Such telemetry almost certainly requires an opt-out, and most likely should be an opt-in as far as GDPR is concerned.
There was an opt-out telemetry proposal in Go [0], which caused a huge backlash. The proposal authors were so focused on the benefits of the telemetry, that they did their best to invent all kinds of very convincing arguments why their telemetry is okay, useful, not intrusive, etc. etc. They completely ignored the ethics of the problem - that they are not entitled to users' data without consent.
It took a very dramatic reaction from the community to convince them that adding opt-out telemetry without users' explicit consent is a bad idea, no matter how "non-intrusive" and "helpful" it is.
It will send the IP regardless of whether telemetry is enabled. But they do claim that no PII is stored for telemetry. Whenever the topic of Telemetry comes up I try to keep to the discussion about properly anonymous telemetry, simply because that’s where there is any discussion at all. If anyone transmit or stores anything they aren’t entitled to it’s obviously always wrong so that’s not an interesting discussion.
Dropbox of course already stores PII (your files) but that doesn’t mean they can do so for other info or other purposes.
Whenever the topic of telemetry comes up, I try and point out that just because someone says it's just telemetry, it doesn't mean a damn thing. If anyone thinks it's not interesting because they think things are obviously always wrong, I ask them: what does telemetry mean to you? What does it mean to the company?
Are you sure those two definitions are in 100% agreement?
Similarly, they might have an opt out but not honor it (in the case of Dropbox it wouldn’t be noticeable)
So all those things aside, the interesting discussion is the discussion that assumes they are honest when they say they don’t store any PII in telemetry. That means, for example that the IP isn’t stored.
“Telemetry” as a term means nothing about what’s stored which is why I try to be specific and talk about “anonymous usage statistics and crash reports” or similar. Telemetry without PII tends to be exactly that.
So yes there are two things: GDPR which is irrelevant here, and storage of non-PII which should be done transparently because it’s polite to be transparent, but not a regulatory requirement.
The few exceptions that exist are only applicable in cases where there is no potentially identifiable data collected at all, which is obviously not the case here.
Here is a very accessible (although non-official) GDPR resource that I've come across: https://gdpr-info.eu/
Obligatory "I am not a lawyer" disclaimer :)
Not if the data isn't PII, no. Not in any way shape or form.
> The few exceptions that exist are only applicable in cases where there is no potentially identifiable data collected at all
The whole point of collecting "anonymous usage data" (which is what telemetry usually does) is that it shouldn't be possible to attribute to a physical person, and thus not be PII. As an extreme example, you could take the most typical form of telemetry: a feature usage count. When a feature is used, the telemetry collects a (+1) for that feature. The only long term stored data is the total count N for each feature across the entire user base. Of course there is no PII stored.
> which is obviously not the case here.
Why do you say that it's "obviously" not the case, when there is no indication about what data it is, other than the Dropbox representative saying precisely that there is no PII collected so the GDPR isn't relevant? There may be PII (in which case they are both at fault for not disclosing, and complete asshats for lying in the support forum). But it would be a pretty uninteresting discussion once one assumes that...
Obligatory "I'm not a lawyer either but I've implemented telemetry in software and had those implementations thuroughly analyzed by lawyers a couple of times"
The major differentiating factor here is that that Dropbox does in fact process PII - convenient storage and distribution of their customers digital life is their raison d'être, after all, it's precisely what those people expect of Dropbox and pay them their monthly fee for.
In this case, where telemetry is gathered by the same desktop application that is also a primary component of their legitimate and consented-to data processing activities no less, they would at minimum be required to specify what information goes where, how it is anonymised, and for what purpose they require it.
I'm not assuming ill intent or unsanctioned data mining activities or anything of the sort, but whatever it is that they are collecting and doing is not as clear as it should be.
All the complaints are about them collecting PII. Even if they say they don't, the concern is that they could be lying, or change easily, and nobody would know.
There's no legal requirement for someone to be polite to a cashier at a supermarket, yet complaining when somebody is an asshole is still a valid complaint.