Hacker News Reader

Comment by cm2012 | Hacker News Reader

cm2012

He was an Elkjøp/Elgiganten customer club member. He wanted to keep the club membership and discounts/offers, but stop the marketing emails. Elkjøp’s setup told him the only way to stop the marketing was to cancel the club membership altogether.

To me, Elkjop seems perfectly reasonable here. But EU policy disagrees.

View on HN

According to the article, that is not what Elkjøp told him. You're making the assumption that what the article says must make sense, which is unfounded.

While we cannot be sure what Elkjøp exactly told him, the Norwegian DPA's findings included following:

* Published benefits: https://web.archive.org/web/20220613175535/https:/www.elkjop... (e.g. "Rabatt på en rekke av våre tjenester utført i varehus", i.e. something like "Discount on a number of our services performed in warehouses")

* Conditions to join, i.e. to receive the benefits (DPA's translation):

* You may be contacted electronically (e.g via SMS and e-mail), via phone and mail with personal offers and other relevant information

* Collect and analyse information about you and your customer relationship.

* Create a customer profile, in order to provide more relevant information and a better service.

* You have to be minimum 15 years old and you can choose to leave the customer club at any time.

So to get the discount you would need to consent to being contacted for "personal offers and other relevant information".

Which is exactly the point - under Article 21 of the GDPR every person has a legal right not to be subjected to direct marketing so any forced direct marketing is unlawful and consent cannot be bundled (it must be specific under the GDPR) so bundling consent to direct marketing along with consent to join the Club is not lawful.

Which is why my next step is litigation.

> Which is exactly the point

The point in this subthread is that your article says the opposite of what you appear to have meant. You don't provide anything other than what is apparently a very bad English translation. The rest of the article makes it pretty clear that you meant to write something different, but it threw me for a loop when I read it and clearly I am not alone.

This is why, when I'm reporting my translation of something in a foreign language, I tend to include the original text too.

I think you might gloss over the fact that marketing content implies extensive data collection, sale and sharing of personal data with third parties.

The company was selling the data without checking if buyers would offer similar levels of protection (LOL, in that case). It was found the members weren't properly informed SO the consent was not freely given, they basically extorted and lied to their customers. I'm very happy they were fined.

I'm very happy you're not in charge of privacy laws, but seriously, I don't see how would a consumer ever want more surveillance? Unless you're not a consumer.

You might well think it is reasonable, but the law doesn't permit this, it is explicit that the person has an absolute right not to be subjected to direct marketing activities (Article 21 of the GDPR) and Article 5 of the GDPR requires that any processing of personal data must comply with all other relevant laws in order to be lawful under the GDPR - ePrivacy Directive (Article 13) governs Direct Marketing in the EU and requires consent - but that consent must meet the requirements of Article 7 under the GDPR in order to be valid (freely given) and any consent which is bundled and is a condition of access to a service where such processing is not necessary to provide that service - is not considered as freely given.

This is not new, we have a lot of case law and regulatory guidance on this.

Reply on news.ycombinator.com