Comment by azernik | Hacker News Reader

Comment by azernik | Hacker News Reader

Parent Full thread

The activity they restrict isn't showing targeted ads; it's collecting the data necessary to show targeted ads. That is to say, you're not allowed to collect data that would show that the user is e.g. a 33-year-old African-American male living in Fremont, CA and with an interest in certain sports, which is necessary to show targeted ads. If you could show such ads without collecting that information, I'm sure GDPR drafters would be totally fine with it.

[EDIT: e.g. this article talks about "programmatic advertising using non-personal data": https://martechtoday.com/consent-unworkable-programmatic-ads...]

Recital 43 says you're not allowed to collect any data that isn't necessary for performance of a contract. In contract law, "performance" specifically refers to the actions one side is obligated to take by a contract; that is, the service provider is only allowed to collect information that is required in order to "perform" (that is discharge their obligations under) the contract. If the contract says the user's performance of the contract requires handing over data? Tough luck. The service provider isn't allowed to collect it.

Okay, I think I finally understand your argument.

You’re saying that Recital 43’s citation of “performance of a contract” refers to merely the performance of the provider — the good or service handed off by the provider to the customer. (It’s the sandwich in our example from earlier.) It does NOT also include whatever good the user provides to the service provider as their side of the contract.

So if a service provider says “You need to give me data in order for me to serve you targeted ads, and this is payment for the free service,” the user could not “freely consent” to providing that data, because it is a condition that is not necessary to provide the free service.

Okay, now another question: If the data given by the sandwich eater to get his free sandwich isn’t “freely given consent,” does that matter? Consent was never the legal basis under which the data was handed over in the first place; it was contractual fulfillment, which is a valid legal basis for processing personal data.

What am I missing?

Edit: I do remember the citation you gave earlier from ICO saying that contractual obligation is not a legal basis in the case where it has nothing to do with the performance of services on the part of the provider. I reviewed their site again, looking for a citation for why this is, but they don’t say. I assume they’re pulling that from recital 43, but again — that would seem to me to be a misreading of 43. That only means that the user didn’t freely consent to give that data. But that doesn’t matter because their data is not being processed under the legal basis of consent.

You're correct about Recital 43 not applying to the contract case - what it does is establish that the main alternative to "necessary for the performance of a contract" isn't there in the sandwich example.

The core of the regulation is Article 6(1), which is basically a big old "or" statement; you have to fulfill one of the conditions listed in order to lawfully process data. [1]

a) is consent, as explained in Recital 43 and clarified in other places. The sandwich vendor clearly doesn't have that, since they've conditioned the service on the delivery of data.

b) is "necessary for the performance of a contract". This is the option on which your free-lunch-giver is leaning. "Necessary" is not well-defined in the EU-wide regulation, but judging by the UK example I linked (the ICO), implementing Member State agencies are going to take a narrow view of "necessary" - as in where it's impossible for the controller to perform the contract without processing the data. By contrast, Recital 43 uses "dependent" to refer to the service provider establishing conditions. This also fits well with the usage of the word in the other tines of the Article 6(1) fork. (c: "necessary for the compliance with a legal obligation", d: "necessary to protect the vital interests of [actual people]", e: "necessary for the performance of a task carried out in the public interest or in in the exercise of official authority" [2]). This interpretation is also, in practical terms, the only one that makes sense, as otherwise the consent option (a) would be redundant.

[1] The most friendly version of the English-language full text I can find is here: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...)

[2] This interesting clause stemming from an even more interesting feature of GDPR: it applies to government agencies. Meaning the regulation needs specific language to specify that yes, the Ministry of Transportation in your country is allowed to use your vehicle registration information as part of its road planning process.

Reply on news.ycombinator.com