-2

Is it legal if we do not offer an explicit opt-out option in our app for non-persnonal data collection?

We planned to explain to the user what data we collect and at the bottom of the screen there would be a button that would say something like "I understand". By pressing that button user would be able to open the rest of the app and use the app. The above mentioned screen would be the first screen new users would see. All users could opt out afterwards in the app settings.

|improve this question

closed as off-topic by Nij, mark b, User37849012643, Tim Lymington supports Monica, feetwet♦ Jul 21 at 23:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    If its not personal data then the GDPR doesn't apply anyway. ico.org.uk/for-organisations/guide-to-data-protection/… – Paul Johnson Jun 30 at 10:50
  • @PaulJohnson You're right but we might collect user IP address and UUID in order to improve our service and I think that IP falls in GDPR terms for personal data (even though you can't know who's using that IP address). So I'm not 100% sure that above-mentioned way of giving consent is 100% legal since users can't decline (they can decline to start using the app). – Uranus Jun 30 at 11:14
  • There seems to be a bit of a question over whether IP address is personal data. They mostly are, because they can point to household, but if you don't plan to do the extra processing to actually match the IP with a subscriber then probably not. You should read the Information Commissioner's Website I linked above and then come back here with a new question about anything you still don't understand. Also, you don't need consent to store an IP address. Consent is only one of the 6 bases for processing. – Paul Johnson Jun 30 at 13:13
  • 2
    For what purposes and under what legal basis will you be collecting that data? Legitimate interest? If so, fine – but your legitimate interest must outweigh the user's interests. Consent? No, valid consent requires a free choice which you wouldn't be offering. Even if you're not required to, it would make sense to create a Records of Processing document to help think about what you're doing and what your compliance requirements will be. – amon Jun 30 at 22:00
1

Either consent is required or not, depending on your use of the data. If consent is not required, you are fine.

If consent is required, and you don’t allow users of your website access without consent, then pressing whatever button to be able to use your site doesn’t constitute consent, so you would be handling data from any EU residents without consent.

|improve this answer
0

Before you start Processing Personal Data (collecting; storing; accessing; processing; sharing) you must have a defined Lawful Base to do it.

If it is an App and people will download it themselves, then you must start by making clear the Terms of Service... so if Personal Data is mandatory for the App to deliver it's "services", then make crystal and in that case Consent is (in the majority of Apps' cases) the Lawful Base.

Not asking for Consent and enabling at a later stage the user (Data Subject) to opt-out is "consent by default" which under GDPR does not exist.

Users will provide their Consent and then they may also opt-out in the future; starting to process their Personal Data with no established Lawful Base and then (maybe) they will opt-out = unlawful Processing = GDPR breach.

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.