Hacker News Reader

Comment by dessant | Hacker News Reader

> For GitLab.com users: as we roll out this update you will be prompted to accept our new Terms of Service. Until the new Terms are accepted access to the web interface and API will be blocked.

Blocking service until the user consents is illegal under GDPR, especially when the consent is requested for data collection that is not essential for providing the service, such as telemetry and analytics.

https://gdpr.eu/gdpr-consent-requirements/

> “Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.”

View on HN

Despite using gitlab i'll probably report them to my country's organization that handles GDPR violations.

If I get locked out for not agreeing to their ToS before I'm finished migrating away, I'll be reporting them too. Then, when I'm done migrating, I will be doing a GDPR request for my data and another right of erasure request.

Is this personal data?

Unless they anonymize absolutely everything, including our IP addresses, then yes, it is personal data.

https://about.gitlab.com/privacy/

> Third party tracking services gather certain simple, non-personally identifying information over time, such as your IP address, browser type, internet service provider, referring and exit pages, timestamp, and similar data about your use of the Website. We do not link this information to any of your personal information such as your user name.

They don't have to link your IP address to your name, because the IP address itself is already an identifier and so considered personal data.

Even then it just takes a very small amount of effort to argue that the anonymized data is still personal and can be linked back to individuals with a bit of statistical analysis.

In addition to dessant's links, the European Commission has a good page which lists out examples (including IP address) of what is considered personal data[1].

[1] https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Anything that can be used to identify the user is considered personal data. Even something innocent enough like screen resolution can be personal data if you’ve got someone with a unique browser window size (let’s say they have a custom window manager that makes the window slightly smaller than the common screen resolution, and it never changes because it’s a filing window manager and they always keep the browser in the same place).

Reply on news.ycombinator.com