Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

thatprivacyguy.com

Post reply on HN
Print view View original

211–220 of 308 posts

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#211

Post by CalRobert »

BadBadJellyBean wrote: post #202
CalRobert wrote: post #146

Earlier quoted context omitted.

Getting consent in a truly compliant way is basically impossible (it should be opt IN, not opt OUT). Though we've trained people to just accept literally everything now.

Why is opt in "basically impossible". That is the definition of consent. Ask BEFORE you do something. It might sound strange but most people really don't want their data gathered by everyone.

I agree!!

To be clear, if you ask for consent in a way that is actually legal, almost nobody will actually consent.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#212

Post by AlexanderHanff »

throw9394494 wrote: post #26

I wonder if anyone who are cheering this fine, actually read and tried to implement GDPR. It is a nightmare to be fully compliant for small companies. It is mostly just a theater (like endless cookie consent dialogs in anonymous browsing), to employ more experts and bureaucrats. EU is now pushing privacy laws that severely undermine privacy.

Absolute nonsense. Any company that was complying with the old Data Protection Directive should have had zero issues upgrading their processes and policies to comply with GDPR there are very few material differences between the two and the previous law existed since 1995 - most of the changes are around accountability (record keeping).

Also cookies literally have nothing to do with GDPR other than the definition of consent - Cookies are governed under and entirely different law which has existed since 2002 (Directive 2002/58/EC).

It bugs me when I see people criticising the law when they actually havent even bothered to research and understand it or even look at the correct law.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#213

Post by AlexanderHanff »

DarkUranium wrote: post #90
throw9394494 wrote: post #26

I wonder if anyone who are cheering this fine, actually read and tried to implement GDPR. It is a nightmare to be fully compliant for small companies. It is mostly just a theater (like endless cookie consent dialogs in anonymous browsing), to employ more experts and bureaucrats. EU is now pushing privacy laws that severely undermine privacy.

The cookie consent dialogs were never required in this form. That was literally just malicious compliance in order to get people mad at the law instead of the companies (at least at first, there's also a huge amount of cargo-culting nowadays). Congrats, you've been psy-opped.

I wrote this 5 years ago, hopefully it will clear up some of the misconceptions around cookie banners:

https://www.linkedin.com/pulse/truth-behind-cookie-banners-a...

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#214

Post by subscribed »

cm2012 wrote: post #148
0xfffafaCrash wrote: post #20

> The reply I received a few days later did me the favour of putting the violation on the record. Their position, in their own words, was that "in order to receive marketing / offers, it is a condition to be a member of the customer club." That one sentence is the whole case. They had taken a right I am entitled to exercise for free and turned it into the price of admission. I don’t understand… it would be one thing…

He was an Elkjøp/Elgiganten customer club member. He wanted to keep the club membership and discounts/offers, but stop the marketing emails. Elkjøp’s setup told him the only way to stop the marketing was to cancel the club membership altogether. To me, Elkjop seems perfectly reasonable here. But EU policy disagrees.

I think you might gloss over the fact that marketing content implies extensive data collection, sale and sharing of personal data with third parties.

The company was selling the data without checking if buyers would offer similar levels of protection (LOL, in that case). It was found the members weren't properly informed SO the consent was not freely given, they basically extorted and lied to their customers. I'm very happy they were fined.

I'm very happy you're not in charge of privacy laws, but seriously, I don't see how would a consumer ever want more surveillance? Unless you're not a consumer.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#215

Post by infinite_spin »

I would like to see these regulations in place here. I have always felt very uncomfortable with companies like TurnItIn.com getting to train their models off of my work, without compensation, where my consent is assumed and there is no opt-out. I've brought this up before, and the general consensus was that my college enrollment is optional, and therefore my consent is freely given. I should have a right to attend a school I pay for and qualified for, without requiring me to give up other rights.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#216

Post by AlexanderHanff »

buzer wrote: post #194
veltas wrote: post #187

Earlier quoted context omitted.

When the official EU websites use the same kinds of annoying dialogs, how is this true?

Official EU website, generally speaking, are not bound by GDPR or ePD. Rather EU bodies are bound by EUDPR. I'm not well-versed on that specific thing, but EDPS and courts have previously found that EC has infringed EUDPR so it wouldn't be weird if their cookie banner was breaking the law as well.

They actually are bound by the ePrivacy Directive due to jurisprudence (EU bodies must comply with CJEU rulings).

I actually wrote to the EDPB on 25th May 2018 (the day GDPR came into effect) and forced them to make their own website compliant with the ePrivacy Directive (I still have the email thread, it was quite an interesting discussion).

I also filed a complaint against the Court of Justice on October 1st 2019 within minutes of them publishing their Judgment on the Planet49 case (C-673/17) because their own website didn't comply with the judgment - they fixed it within 18 minutes.

So yes EU institutions get it wrong sometimes, but they generally fix it quickly when they are informed. I currently have a big case ongoing with the EDPS against the European Commission and the European Parliament for hosting live streams directly on social media instead of the official live streaming platform setup for EU bodies (on the basis that forcing people to engage on social media is a breach of fundamental rights because it allows those platforms to infer special category data (political interests and others depending on the topic of the live stream).

EDPS just actually updated me this week that they have concluded their side and are now waiting on the final responses from the Commission and Parliament.

So yes, the rules do work, but you have to be pro-active, armchair activism doesn't work.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#217

Post by AlexanderHanff »

arjie wrote: post #51

It's an interesting story, but I could not help but have my mind skip over it because of the LLMisms. Acts like one of those taboola reels to me. If even just there was a tutorial to get people to write in such a way that it's not obviously LLM text it would be nice because the story is interesting. I know, it's like complaining about JS etc. but it's like walking into an elevator and smelling very strong perfume. It…

They are not written by an LLM lol, I have severe ADHD, this is how I write and there is plenty of my material out there spanning the last 20+ years (long before LLMs existed) to illustrate that.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#218

Post by subscribed »

mixdup wrote: post #40
0xfffafaCrash wrote: post #20

> The reply I received a few days later did me the favour of putting the violation on the record. Their position, in their own words, was that "in order to receive marketing / offers, it is a condition to be a member of the customer club." That one sentence is the whole case. They had taken a right I am entitled to exercise for free and turned it into the price of admission. I don’t understand… it would be one thing…

I think the "marketing/offers" means discounts? To be eligible for the discounts or special offers, you have to be a member of the club, and if you are a member of the club you have to be willing to receive the email messages, and somehow under EU law you're entitled to all discounts I guess?

That's pretty disingenuous thing to say.

The company was also processing, transferring and selling private data without doing as much as informing their customers.

It's perfectly possible to offer discounts to customers without egregious violations of law and privacy.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#219

Post by AlexanderHanff »

londons_explore wrote: post #16

If I did business in the EU, I would be banning this chap from my services on the basis that the risk he poses to the business is too great...

Processing my personal data in such a way (to ban me from your services pre-emptively) would be a breach of the GDPR and in some member states could involve criminal sanctions.

For example, in the UK we have a very famous case (The Consulting Association (TCA)) where building contractors joined together to build a list of construction workers they didn't want to hire - this was determined as a criminal breach of UK data protection law.

So have at it, I love a challenge...

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#220

Post by f4c39012 »

Insimwytim wrote: post #106
buzer wrote: post #78

Earlier quoted context omitted.

I haven't personally encountered that, but you are free to lodge complaint with your local DPA about it. That exact language is unlikely to be compliant. If you want to maximize your effect you could make Article 15 request to the company in question, get the list of actual recipients of data (make sure to be ask for this specifically) and then make another request to all of those companies. That will then allow you…

Wouldn't you have to "consent" first? What if you didn't and did not proceed with the process? Can you complain still? As in - if you didn't give your consent there's no violation has occurred and they don't have your data, so nothing to ask for?

Can i withdraw consent later? So, attend the interview (to maximise my chances of being offered the job), and then after the application process withdraw consent?
Post reply on HN