Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Court decides "Pay or Okay" on DerStandard.at is illegal

noyb.eu

Post reply on HN
Print view View original

31–38 of 38 posts

Re: Court decides "Pay or Okay" on DerStandard.at is illegal

#31

Post by mytailorisrich »

yladiz wrote: post #29
mytailorisrich wrote: post #27

Earlier quoted context omitted.

> Their attempt to obtain freely given consent is because their purpose is not actually necessary, else they could use that on its own as the basis for the processing. Why would the GDPR even describe consent and consent in relations to contract, then? > The idea that "it is necessary for our balance sheets to sell your data" would be sufficient for any and all processing seems the most extreme one to me. That's an o…

> This implies a right to access commercial websites for free, which cannot be reasonable, or only a choice between no access and payment, which also cannot be reasonable. What do you mean the latter isn’t reasonable? It is perfectly reasonable to make your website only accessible to paying users. > More broadly, this is a strange take in the EU: The same people that are happy to have to carry ID cards, to have "free…

> The EU considers privacy a right, i.e. something you can’t sell away in a contract

You can sell your privacy in a contract in the EU. This actually highlights the incoherence here, and my point to some extent.

And there is no geopolitical spin since I am an EU citizen myself. It is just that I think that the EU is going to shit a little more every day.

Re: Court decides "Pay or Okay" on DerStandard.at is illegal

#32

Post by yladiz »

mytailorisrich wrote: post #31
yladiz wrote: post #29

Earlier quoted context omitted.

> This implies a right to access commercial websites for free, which cannot be reasonable, or only a choice between no access and payment, which also cannot be reasonable. What do you mean the latter isn’t reasonable? It is perfectly reasonable to make your website only accessible to paying users. > More broadly, this is a strange take in the EU: The same people that are happy to have to carry ID cards, to have "free…

> The EU considers privacy a right, i.e. something you can’t sell away in a contract You can sell your privacy in a contract in the EU. This actually highlights the incoherence here, and my point to some extent. And there is no geopolitical spin since I am an EU citizen myself. It is just that I think that the EU is going to shit a little more every day.

Why is sell in quotes? What do you mean by sell here?

Re: Court decides "Pay or Okay" on DerStandard.at is illegal

#33

Post by Dilettante_ »

Ukv wrote: post #11
Dilettante_ wrote: post #7

Earlier quoted context omitted.

Devil's Advocate? It pays for the services we use for free.

I feel that's only really true in the way it is of a JS bitcoin miner. Locally appears to make something free (if ignoring time/energy) that wasn't before, but is overall a detriment to average affordability because it's a net loss of resources (mostly just a zero-sum game, with some small side benefits).

I don't disagree with that at all, and by 'free' I suppose I didn't even mean 'as in free beer', I just meant there was no financial transaction taking place.

Maybe at some point we're really gonna see an upfront-micropayment structure as some people have mused about.

Re: Court decides "Pay or Okay" on DerStandard.at is illegal

#34

Post by mytailorisrich »

Ukv wrote: post #30
mytailorisrich wrote: post #27

Earlier quoted context omitted.

> Their attempt to obtain freely given consent is because their purpose is not actually necessary, else they could use that on its own as the basis for the processing. Why would the GDPR even describe consent and consent in relations to contract, then? > The idea that "it is necessary for our balance sheets to sell your data" would be sufficient for any and all processing seems the most extreme one to me. That's an o…

> Why would the GDPR even describe consent and consent in relations to contract, then? Freely given consent is a lawful basis, allowing for processing even if it's not necessary for legal/contractual reasons that would qualify the processing for another basis (or a mix of necessary and unecessary). But here they're clearly not meeting the "allow separate consent to be given to different personal data processing opera…

> Freely given consent is a lawful basis, allowing for processing even if it's not necessary for legal/contractual reasons that would qualify the processing for another basis (or a mix of necessary and unecessary).

Again, this is all a narrow and militant interpretation of "necessary for contractual reason", not least when all data show that the people are fine with it. In a contract, a form of quid pro quo is necessary, if targeted ads are the form of "payment" asked and if there is no imbalance of power or coercion (and it's hard to see how being refused access to a random website any sort of coercion or serious negative consequence) then there should be no issue and the "deal" is actually the main aspect of the contract. Any other outcome is either that the GDPR is badly drafted or that this is an ideological agenda at play (obviously I favour the latter).

Re: Court decides "Pay or Okay" on DerStandard.at is illegal

#35

Post by strogonoff »

account42 wrote: post #13
borzi wrote: post #4

Absolutely crazy interpretation: "At the same time, only 1-7% of all users want to be tracked for online advertisement if asked openly. However, "pay or okay" gets 99.9% of users to agree to online tracking. If more than 90% of users do not get what they genuinely want, we have everything but a "genuine" choice." If I got to the shop and don't want to buy the product I should just get it for free, because that is wha…

What you miss is that the EU has decided that your business can not depend on people selling their privacy. This is very far from crazy, we disallow many other types to businesses too.

If EU punished the choice to provide the user an option to pay to not be tracked, EU ought to illegalise the entire business model of ad-supported “free” media where end user is the product delivered to advertisers, with no choice to not be tracked—even if you are not, in fact, a user (your shadow profile will still be built); otherwise seems to be hypocritical.

To pay to not be tracked is a joke of a choice—no one would choose to pay—but it only highlights the dark reality of how ad-supported media distort the market: honest competition is impossible against a “free” offer with a difficult to understand catch.

Re: Court decides "Pay or Okay" on DerStandard.at is illegal

#36

Post by Ukv »

mytailorisrich wrote: post #34
Ukv wrote: post #30

Earlier quoted context omitted.

> Why would the GDPR even describe consent and consent in relations to contract, then? Freely given consent is a lawful basis, allowing for processing even if it's not necessary for legal/contractual reasons that would qualify the processing for another basis (or a mix of necessary and unecessary). But here they're clearly not meeting the "allow separate consent to be given to different personal data processing opera…

> Freely given consent is a lawful basis, allowing for processing even if it's not necessary for legal/contractual reasons that would qualify the processing for another basis (or a mix of necessary and unecessary). Again, this is all a narrow and militant interpretation of "necessary for contractual reason", not least when all data show that the people are fine with it. In a contract, a form of quid pro quo is necess…

> Again, this is all a narrow and militant interpretation of "necessary for contractual reason",

Given "necessary for contractual reason" is on its own a lawful basis, I don't see how your interpretation (that selling your data to ad companies is "necessary") wouldn't effectively nullify much of the GDPR, allowing pretty much any use of customer data to be justified so long as the company makes money from it.

The European Data Protection Board, whose purpose is to ensure consistent application of the GDPR, has written:

> > If there are realistic, less intrusive alternatives, the processing is not ‘necessary’. Article 6(1)(b) will not cover processing which is useful but not objectively necessary for performing the contractual service [...] even if it is necessary for the controller’s other business purposes.

> > A controller can rely on the first option of Article 6(1)(b) to process personal data when it can [... establish ...] processing is necessary in order that the particular contract with the data subject can be performed. [Emphasis in original]

> > does not cover situations where the processing is not genuinely necessary for the performance of a contract

> > it is required that the processing is objectively necessary for a purpose that is integral to the delivery of that contractual service

> > Example 2: The same online retailer wishes to build profiles of the user’s tastes and lifestyle choices based on their visits to the website. Completion of the purchase contract is not dependent upon building such profiles. Even if profiling is specifically mentioned in the contract, this fact alone does not make it ‘necessary’ for the performance of the contract. If the on-line retailer wants to carry out such profiling, it needs to rely on a different legal basis.

(https://www.edpb.europa.eu/sites/default/files/files/file1/e...)

> not least when all data show that the people are fine with it.

Doesn't appear to be the case when the case when it's actually a freely given choice (as low as 0.1% when it's opt-in) - which is why companies fight so hard to manipulate user choice with dark patterns and obfuscation, or outright breaking the regulation.

Re: Court decides "Pay or Okay" on DerStandard.at is illegal

#38

Post by [deleted] »

preisschild wrote: post #28
Nextgrid wrote: post #6

Earlier quoted context omitted.

The law says that personal data is not a valid form of payment. Businesses have to adjust their business models accordingly.

Prostitution is legal here in austria (where derStandard is based) and germany Why should selling your personal data be illegal?

[deleted]
Post reply on HN