Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either:
- The user consents to having that piece of data collected while being able to maintain access to the service if the decline to consent
- There is a direct business need to store that data
- There is a legal need to store that data
However, consider the following scenario:
- There is a web app that requires users to log in to access
- Users can not log in unless they agree to the terms and conditions
- Once logged in all button clicks (and keystrokes on the site) by users are recorded (on the service operator's servers)
- This recording behavior is described in the terms in conditions
- The service operator needs to collect this data in order to identify how to improve their service in the future
Is such a scenario allowed? My gut inclination is that it would not be allowed since the need to identify future service offerings is not "direct" and that one of the benefits allowed by GDPR is that individuals have the right to opt out of analytics tracking while continuing to be able to use services. However, a counter argument that could be made is that this business need is direct. Which interpretation is correct?