<story><title>Publishers Haven&apos;t Realized How Big a Deal GDPR Is</title><url>https://baekdal.com/strategy/publishers-havent-realized-just-how-big-a-deal-gdpr-is/</url></story><parent_chain><item><author>molf</author><text>Be careful with hiding everything behind &amp;quot;consent&amp;quot;, because consent &lt;i&gt;cannot&lt;/i&gt; be a precondition for providing a service. Put differently: if a user does &lt;i&gt;not&lt;/i&gt; consent, you cannot refuse them the service if the data you wanted to collect is not strictly necessary to provide the service.&lt;p&gt;The alternative is to only collect data that is &lt;i&gt;strictly&lt;/i&gt; necessary to provide the service. In that case GDPR allows you to collect the data even without explicitly given consent – according to GDPR in that case the user can reasonably expect the data to be necessary to provide the service. (This does not apply to sensitive personal data and biometric&amp;#x2F;genetic data – then you always need consent.)&lt;p&gt;Quoting GDPR:&lt;p&gt;&amp;quot;Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement.&amp;quot; [1]&lt;p&gt;&amp;quot;Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.&amp;quot; [2]&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gdpr-info.eu&amp;#x2F;recitals&amp;#x2F;no-32&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gdpr-info.eu&amp;#x2F;recitals&amp;#x2F;no-32&amp;#x2F;&lt;/a&gt;
[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gdpr-info.eu&amp;#x2F;recitals&amp;#x2F;no-43&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gdpr-info.eu&amp;#x2F;recitals&amp;#x2F;no-43&amp;#x2F;&lt;/a&gt;</text></item><item><author>mstolpm</author><text>I’d add: Get (documented, active) permission of users to store and use their data, understand that permission is given only for a defined cause&amp;#x2F;usage (and not indefinitely for everything you right now might not even think of), be prepared to tell users what data you store about them, why and (briefly) how it is used. Be prepared to delete user data on request. Be prepared to show documentation on how you handle the (personal) data. And delete data that is not necessary any longer in regular intervals. And: Don’t share, sell or rent personalized data to any third party without given user consent.</text></item><item><author>michaelbuckbee</author><text>GDPR articles seem to be getting some traction on HN as everyone is trying to figure out: &amp;quot;Do I need to do something for this? Is so, what?&amp;quot;&lt;p&gt;For a recent project I read (and translated to plain english) [1] every single article in the GDPR legislation and for our purposes it can be summed up as:&lt;p&gt;&amp;quot;Treat user data like names and emails as if they were credit card numbers&amp;quot;&lt;p&gt;AKA: be paranoid about keeping them, encrypt them, use SSL on your site, respond to requests from people if they ask if you have them, fix them if they&amp;#x27;re wrong, don&amp;#x27;t use them if they say you can&amp;#x27;t.&lt;p&gt;Obviously that&amp;#x27;s not the entirety of it, but as a working mental model I think it goes a long way.&lt;p&gt;1 - &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.varonis.com&amp;#x2F;gdpr-requirements-list-in-plain-english&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.varonis.com&amp;#x2F;gdpr-requirements-list-in-plain-eng...&lt;/a&gt;</text></item></parent_chain><comment><author>blowski</author><text>&amp;gt; consent cannot be a precondition for providing a service&lt;p&gt;IANAL.&lt;p&gt;This is more nuanced than it appears, as it is balanced against the firm&amp;#x27;s right to conduct business.&lt;p&gt;If you&amp;#x27;re generating leads by providing a whitepaper, then realistically you&amp;#x27;re not going to be penalised for saying &amp;quot;you need to consent to receive our newsletter to access this whitepaper&amp;quot;.&lt;p&gt;On the other hand, an airline saying &amp;quot;you can only book a flight on our plane by consenting to us sharing everything we know about you with loads of third parties&amp;quot; would be frowned upon.&lt;p&gt;Our GDPR lawyer at least has advised not to ask for consent, since it is difficult to establish whether it was given, and has not been withdrawn. It&amp;#x27;s easier to rely on legitimate business use and NOT ask for consent, as long as it genuinely falls into that category.</text></comment>
<story><title>Publishers Haven&apos;t Realized How Big a Deal GDPR Is</title><url>https://baekdal.com/strategy/publishers-havent-realized-just-how-big-a-deal-gdpr-is/</url></story><parent_chain><item><author>molf</author><text>Be careful with hiding everything behind &amp;quot;consent&amp;quot;, because consent &lt;i&gt;cannot&lt;/i&gt; be a precondition for providing a service. Put differently: if a user does &lt;i&gt;not&lt;/i&gt; consent, you cannot refuse them the service if the data you wanted to collect is not strictly necessary to provide the service.&lt;p&gt;The alternative is to only collect data that is &lt;i&gt;strictly&lt;/i&gt; necessary to provide the service. In that case GDPR allows you to collect the data even without explicitly given consent – according to GDPR in that case the user can reasonably expect the data to be necessary to provide the service. (This does not apply to sensitive personal data and biometric&amp;#x2F;genetic data – then you always need consent.)&lt;p&gt;Quoting GDPR:&lt;p&gt;&amp;quot;Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement.&amp;quot; [1]&lt;p&gt;&amp;quot;Consent is presumed not to be freely given [...] if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.&amp;quot; [2]&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gdpr-info.eu&amp;#x2F;recitals&amp;#x2F;no-32&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gdpr-info.eu&amp;#x2F;recitals&amp;#x2F;no-32&amp;#x2F;&lt;/a&gt;
[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gdpr-info.eu&amp;#x2F;recitals&amp;#x2F;no-43&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gdpr-info.eu&amp;#x2F;recitals&amp;#x2F;no-43&amp;#x2F;&lt;/a&gt;</text></item><item><author>mstolpm</author><text>I’d add: Get (documented, active) permission of users to store and use their data, understand that permission is given only for a defined cause&amp;#x2F;usage (and not indefinitely for everything you right now might not even think of), be prepared to tell users what data you store about them, why and (briefly) how it is used. Be prepared to delete user data on request. Be prepared to show documentation on how you handle the (personal) data. And delete data that is not necessary any longer in regular intervals. And: Don’t share, sell or rent personalized data to any third party without given user consent.</text></item><item><author>michaelbuckbee</author><text>GDPR articles seem to be getting some traction on HN as everyone is trying to figure out: &amp;quot;Do I need to do something for this? Is so, what?&amp;quot;&lt;p&gt;For a recent project I read (and translated to plain english) [1] every single article in the GDPR legislation and for our purposes it can be summed up as:&lt;p&gt;&amp;quot;Treat user data like names and emails as if they were credit card numbers&amp;quot;&lt;p&gt;AKA: be paranoid about keeping them, encrypt them, use SSL on your site, respond to requests from people if they ask if you have them, fix them if they&amp;#x27;re wrong, don&amp;#x27;t use them if they say you can&amp;#x27;t.&lt;p&gt;Obviously that&amp;#x27;s not the entirety of it, but as a working mental model I think it goes a long way.&lt;p&gt;1 - &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.varonis.com&amp;#x2F;gdpr-requirements-list-in-plain-english&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.varonis.com&amp;#x2F;gdpr-requirements-list-in-plain-eng...&lt;/a&gt;</text></item></parent_chain><comment><author>gowld</author><text>How is &amp;quot;strictly&amp;quot; defined? I&amp;#x27;m going to guess it&amp;#x27;s define as &amp;quot;the magistrate knows it when it sees it&amp;quot;, so take to be both &amp;quot;don&amp;#x27;t use the most egregious interpretation&amp;quot;, and &amp;quot;don&amp;#x27;t be a populist punching bad that governments can make hay out of attacking&amp;quot;.</text></comment>