Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

thatprivacyguy.com

Post reply on HN
Print view View original

111–120 of 308 posts

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#111

Post by XelNika »

setgree wrote: post #105

The part about this that's amazing to me is that they still are doing nothing after he noted another GDPR violation [0]. He's obviously both competent and litigious. What does the company expect to happen next?? [0] "Under Article 77(2) of the GDPR a supervisory authority is under a binding legal obligation to keep a complainant informed of the progress and the outcome of their complaint. It is not a courtesy and it…

As I understand it, this second complaint is not against the original company, but against the government authority that handled his case.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#112

Post by socalgal2 »

cheese_van wrote: post #102
engeljohnb wrote: post #17

I'm glad it all worked out for this individual. I hope more people live their lives like this as the dystopia progresses. Unfortunately, especially in the US, exercising your rights, or even just reading every paper you're expected to put your name to, not only constantly pisses people off for some reason, but also puts you at a significant disadvantage compared to the people that never push back in the interest of n…

Went to a new doctor. As part of the check-in process, I was asked to "sign" a little digital pad, so, as I was told, they could properly use my insurance. I asked to see the hard copy of what I was signing and they couldn't find one. Then, for some reason, they were unable to print one. I gave up and scribbled my sig with my finger and then was seen by a doctor. It's maddening.

I'm sure someone smarter than me has a solution. Those papers you're required to sign are generally the result of regulation. Some law got passed that say "you can't share info unless you get signed permission". The person dreaming up the law thought that would be enough to stop getting them to share info. But, even if they cared about privacy, they don't want to increase all their expenses and run their own IT department so they contract out for 3rd party billing, 3rd party document infra, etc etc. Like if they wanted to store your appointment in MS Word 365 or Google Docs, suddenly the regulation kicks in. They're not going build a document sharing platform to get their job done just so they can meet the regs. They're just going to get you to sign that they can do what they need.

As one example, I went to a doctor, he ordered an x-ray. I went over to the x-ray company then back to my doctor. He pulled up the x-ray immediately. He's only able to do that because I signed that he can share my info with the x-ray company and visa-versa.

Again, I don't have a solution. No regulation = he'd probably share my data. But regulation = he gets me to sign so he can legit provide the service, and still shared my data (Because I signed). So all the regs did is make visiting the doctor more annoying, and add $$$$ to push all the paperwork around.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#113

Post by cwillu »

arjie wrote: post #51

It's an interesting story, but I could not help but have my mind skip over it because of the LLMisms. Acts like one of those taboola reels to me. If even just there was a tutorial to get people to write in such a way that it's not obviously LLM text it would be nice because the story is interesting. I know, it's like complaining about JS etc. but it's like walking into an elevator and smelling very strong perfume. It…

> LLMisms

The word is “cliches”, and they existed long before LLMs.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#114

Post by buzer »

Insimwytim wrote: post #106
buzer wrote: post #78

Earlier quoted context omitted.

I haven't personally encountered that, but you are free to lodge complaint with your local DPA about it. That exact language is unlikely to be compliant. If you want to maximize your effect you could make Article 15 request to the company in question, get the list of actual recipients of data (make sure to be ask for this specifically) and then make another request to all of those companies. That will then allow you…

Wouldn't you have to "consent" first? What if you didn't and did not proceed with the process? Can you complain still? As in - if you didn't give your consent there's no violation has occurred and they don't have your data, so nothing to ask for?

That's a bit more complex.

Everyone is free to make a tip to DPA. However DPA is free to decide if they want to start their own investigation based on that unlike when you make Article 77 complaint.

There isn't a lot of case law around the threshold of Article 77. The text says "if the data subject considers that the processing of personal data relating to him or her infringes this Regulation". If read completely alone one could make argument that since you didn't consent no processing occurred -> you do not have right to make an Article 77 complaint.

However when taking the in account the goals and purpose of GDPR as well as recital 141 I would argue otherwise. To be specific recital 141 says "if the data subject considers that his or her rights under this Regulation". CJEU also often refers to GDPR's objective of ensuring high level of protection of fundamental rights and freedoms of natural persons. I feel that ex post requirement would be quite contrary to that.

Due to this my personal stance would be that just offering invalid consent choice where refusal has negative consequences is something that violates data subject's rights even if processing didn't occur and would be eligible for actual Article 77 complaint rather than just tip to DPA.

[EDIT] Also, there is Article 82 path via damages. In your case you could potentially argue that you suffered damages (like lost wages) due to company's invalid consent requirement. This, however, is generally a lot harder and more expensive path. Depending on how legal costs are allocated in your jurisdiction you could also end up with judgement where you need to pay your opponent's legal costs if you lose.

For Article 82 claim you almost definitely will need a lawyer.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#115

Post by arjie »

cwillu wrote: post #113
arjie wrote: post #51

It's an interesting story, but I could not help but have my mind skip over it because of the LLMisms. Acts like one of those taboola reels to me. If even just there was a tutorial to get people to write in such a way that it's not obviously LLM text it would be nice because the story is interesting. I know, it's like complaining about JS etc. but it's like walking into an elevator and smelling very strong perfume. It…

> LLMisms The word is “cliches”, and they existed long before LLMs.

Haha they are cliches, yes. But a specific type of cliche that is unique to current language models.

> That one sentence is the whole case

This example, for instance, is more uniquely LLM than mere common cliche.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#116

Post by ghssds »

socalgal2 wrote: post #112
cheese_van wrote: post #102

Earlier quoted context omitted.

Went to a new doctor. As part of the check-in process, I was asked to "sign" a little digital pad, so, as I was told, they could properly use my insurance. I asked to see the hard copy of what I was signing and they couldn't find one. Then, for some reason, they were unable to print one. I gave up and scribbled my sig with my finger and then was seen by a doctor. It's maddening.

I'm sure someone smarter than me has a solution. Those papers you're required to sign are generally the result of regulation. Some law got passed that say "you can't share info unless you get signed permission". The person dreaming up the law thought that would be enough to stop getting them to share info. But, even if they cared about privacy, they don't want to increase all their expenses and run their own IT depar…

> They're not going build a document sharing platform to get their job done just so they can meet the regs.

What is so hard in respecting the spirit of the law?

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#117

Post by wafflemaker »

jazz9k wrote: post #48

I'm so glad the GDPR never took hold in the US. Little Karens getting companies fined millions of dollars over what amounts to nothing. You can always not use their service. Plenty of alternatives out there.

I for one was signed up for Elkjøp kundeklubb membership unbeknownst to me. It happened when I was picking up a water cooker. Seller asked if I would like an electronic receipt and asked me for my email. That was in Elkjøp at Solsiden in Trondheim.

The more annoying is that I gave him my regular email address and not a generated alias that I always give to companies.

Was super pissed when spam started landing on my main address.

So no, not plenty alternatives here.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#118

Post by throw1234567891 »

ghssds wrote: post #116
socalgal2 wrote: post #112

Earlier quoted context omitted.

I'm sure someone smarter than me has a solution. Those papers you're required to sign are generally the result of regulation. Some law got passed that say "you can't share info unless you get signed permission". The person dreaming up the law thought that would be enough to stop getting them to share info. But, even if they cared about privacy, they don't want to increase all their expenses and run their own IT depar…

> They're not going build a document sharing platform to get their job done just so they can meet the regs. What is so hard in respecting the spirit of the law?

There are many dollars in between.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#119

Post by ihodes »

socalgal2 wrote: post #112
cheese_van wrote: post #102

Earlier quoted context omitted.

Went to a new doctor. As part of the check-in process, I was asked to "sign" a little digital pad, so, as I was told, they could properly use my insurance. I asked to see the hard copy of what I was signing and they couldn't find one. Then, for some reason, they were unable to print one. I gave up and scribbled my sig with my finger and then was seen by a doctor. It's maddening.

I'm sure someone smarter than me has a solution. Those papers you're required to sign are generally the result of regulation. Some law got passed that say "you can't share info unless you get signed permission". The person dreaming up the law thought that would be enough to stop getting them to share info. But, even if they cared about privacy, they don't want to increase all their expenses and run their own IT depar…

Regarding information sharing, not quite. Covered entities (term of art in HIPAA), which include providers (and also payers!) including both the lab and your doctor, do not need your permission to share information between them for the purposes of treatment, payment, or operations (commonly, "TPO"). A BAA between a covered entity and a vendor (like an EHR or PACS [viewer for your imaging]) also does not require any patient consent.

There are sometimes things you might not like hidden in the releases you're signing, beyond the run of the mill acceptance of financial responsibility / assignment of benefits, notice of privacy policy acknowledgment, consent to treat.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#120

Post by cwmoore »

throw1234567891 wrote: post #118
ghssds wrote: post #116

Earlier quoted context omitted.

> They're not going build a document sharing platform to get their job done just so they can meet the regs. What is so hard in respecting the spirit of the law?

There are many dollars in between.

Like with criminal fraud?
Post reply on HN