41–50 of 114 posts
I'd doubt this is legal under HIPAA law in the US, but good luck
> The company plans to grab four categories: your sleep, your medications, your medical records, and your cycle tracking details So you buy a device but you can't effectively use half of its features because you'd also have to agree to send them your medical records? Ok then if I refuse, will they refund 50% of the device price since now it's not usable any more?
[flagged]
How can you be "condescending" to a company?
Where is the catch? You rather get two good things if you don't agree: - Samsung deletes your sensitive health data - Samsung does not use this data to train some AI :-)
> The company plans to grab four categories: your sleep, your medications, your medical records, and your cycle tracking details So you buy a device but you can't effectively use half of its features because you'd also have to agree to send them your medical records? Ok then if I refuse, will they refund 50% of the device price since now it's not usable any more?
[flagged]
Don't threaten me with a good time.
I'm so tired of tech companies shoving AI into everything, everywhere.
shouldn't this get them turbo obliterated in europe?
no, in fact gdpr requires that they get consent before they process the data. They are not preventing people from accessing the data, only indefinite storage as i understand. They may claim that storage is needed for the processing (which might make sense, they want to train on the whole time series).
"Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance."
Earlier quoted context omitted.
[flagged]
> I really feel like "grab" is quite condescending By all means, let's use a more appropriate term, like "abuse" or "misappropriate". It's not sufficiently condescending for a company that's trying to train AI on people's private health data.
Earlier quoted context omitted.
no, in fact gdpr requires that they get consent before they process the data. They are not preventing people from accessing the data, only indefinite storage as i understand. They may claim that storage is needed for the processing (which might make sense, they want to train on the whole time series).
Recital 11 of the GDPR says that consent must be "freely given", and recital 43 says (in part): "Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not…
> The company plans to grab four categories: your sleep, your medications, your medical records, and your cycle tracking details So you buy a device but you can't effectively use half of its features because you'd also have to agree to send them your medical records? Ok then if I refuse, will they refund 50% of the device price since now it's not usable any more?
[flagged]
The headline as described sounds to me like they're violating GDPR by tying to force "consent" for a not-strictly-necessary-for-functionality use of health data. The European Data Protection Board has repeatedly stated that consent is (generally) not considered to be "freely given" if there is a significant detriment for refusing it or if the user has no genuine choice.
Note however that caveat: as described. There may be some more details which make this not unlawful. Also, actually deleting your data if you don't consent is the kind of thing GDPR requires.