Hacker News Reader

Comment by matsemann | Hacker News Reader

GDPR is nice in this regard: Consent isn't enough. The consent must be freely given (aka no stipulation saying you can't rent without accepting), informed (aka you should be told all your rights and what's included in your consent, just not a general "by signing the rental agreement you're accepting us collecting your data"), and they can't even collect the data unless they have a legitimate use for it (which again someone could challenge, the landlord doesn't need to know when I come&go to do their job).

View on HN

All of that might not be enough. Renters might still find they are in a weak position to negotiate a contract details like that, if they even comprehend the full meaning and consequences. Landlords will figure out the "Legitimate use" legalese and paste it in each contract, and it is in the nature of data collection that mose abuse goes unnoticed.

Casual surveillance and the landlord-renter power dynamic are things that should be established at the society-level.

That’s not how “freely given consent” works.

Freely given means that consent is given in a way that it does not affect any other aspect of the transaction. There is no negotiation to be made. I would imagine that a competent legal system would never allow it to be attached to a separate contract since it then becomes consideration as part of a separate transaction.

> Landlords will figure out the "Legitimate use" legalese and paste it in each contract

I have no doubt that they will.

However, ultimately they will end up on this list https://www.enforcementtracker.com/ (or they were in the US and so it was irrelevant).

> and it is in the nature of data collection that mose abuse goes unnoticed.

Unnoticed by the average person maybe but people honestly think GDPR has had no _absolutely zero_ effect as well; doesn't make them correct.

> (aka no stipulation saying you can't rent without accepting)

Is this specifically for landlords, or are companies forced to serve you even if you reject data collection?

Also, will this actually be enforced in practice? Websites with n > 1 million users are one thing, but landlords / apartment management companies with a few hundred units are going to be tough to go after one by one.

It's all organizations. Data collection cannot be a stipulation to receive full service. It must be completely optional and opt-in.

That's why the reject all button exists right?

You just make a "required need" and installing a biometric access to the building might be enough to trigger that.

Plus the nice, fancy buildings will require it as a de rigueur add-on.

"we only let in the best, and we offer top security, so that means retinal scans and facial recognition"

> they can't even collect the data unless they have a legitimate use for it

They can collect any and all data if you give free and informed consent. They do not need consent to collect data with a legitimate interest, but they do need to inform you of it.

No, actually not. GDPR also has rules related to "data minimisation", aka you shouldn't collect data you don't need.

Got a source for that?

GDPR article 5.1c https://gdpr-text.com/read/article-5/#related_gdpr-a-05_1c

This article and data minimisation don't mean you can't collect information, they just say you can't collect more than what you need for the specific purpose. If the specific purpose is ad targeting via a bunch of data from tracking and you have a lawful basis (ie. consent) for it, there is no problem, as far as you're really using (and need to use) that data for ad targeting.

if the rental application, looks like im installing windows, im renting elswhere.

Reply on news.ycombinator.com