26

I have recently come across this part of an app from a well-known US company:

enter image description here

Is this a legal way of handling some of the technical obstacles GDPR introduced? Is this a "flexible" interpretation of the law or is it straight up illegal?

To give the whole picture - I was asked where I live and based on that I was presented with this consent sheet. If I don't check the box, I cannot move any further - I have to give consent if I want to use the app.

I was OK with giving that consent, but does that mean I also lose my rights that come with GDPR? The right to download my data, the right to be forgotten etc?

I'm not interested in shaming the company, but I am interested in knowing if the approach - "I'll ask if they are OK with losing those rights so that I can do whatever I want" - is a correct way of handling the law. I didn't assume GDPR is "optional". Kind of defeats the purpose of having it if companies can put this in the fine print or worse - disallow anybody to use their software unless they give their private data to them with no strings attached.

I saw and read a connected question here, but in my situation, I am actually unable to do anything unless I accept the terms.

Improve this question
16
  • 6
    It doesn't seem to say anything about their compliance with GDPR, or lack thereof. Asking whether you consent to your data being processed outside the EU is orthogonal to them being subject to GDPR by virtue of them serving a EU citizen.
    – mustaccio
    Jan 6, 2020 at 21:13
  • 15
    While the GDPR protections can't be waived, as the answers state, it's reasonable for a company to disallow anyone from using their software if the user doesn't give their consent to a required use of their data (as long as the data use and request are legal). The company has a right to not provide service to anyone they choose, as long as it's not for an illegal reason. In fact, it's quite normal and, actually, necessary for a company to refuse to provide service unless they have your consent to use your data. Requiring companies to explicitly get that consent was one of the things GDPR did.
    – Makyen
    Jan 6, 2020 at 21:28
  • 6
    @Makyen: That's not exactly so simple. The GDPR absolutely requires that consent is freely given, and it appears that withholding the service means the consent is no longer freely given. You're right that the company has the right to do business with whoever they want, but only within the law including the GDPR.
    – MSalters
    Jan 7, 2020 at 9:11
  • 11
    Were the tick boxes automatically ticked? Because even that is a bit questionable from a GDPR standpoint (consent should be 'opt-in' not 'opt-out')
    – DaveMongoose
    Jan 7, 2020 at 9:58
  • 9
    @MSalters I think you have a skewed view of what freely given means. The company doesn't owe you service. If they were legally mandated to provide you service, then there might be an argument that consent wasn't freely given. The company clearly establishing that they won't begin giving service unless you give consent to their use of your data is part of a typical contractual relationship. The GDPR doesn't give you a right to force them to provide service to you, which is what you are effectively arguing.
    – Makyen
    Jan 7, 2020 at 10:44

5 Answers 5

Reset to default
41

GDPR does not cease to apply because of the location of data storage. It applies based on the location of the data processor, data controller, and data subject. If you are in the EU, you are a data subject covered by GDPR. It does not matter where the data are stored.

Note that you are asked to confirm that you're aware that US laws may be less protective, but you're not asked to acknowledge that anything about the arrangement causes the "laws of your country/region" not to apply. The company also does not seem to be claiming that they don't apply, although it seems that they want you to think so, and it's not clear whether they think so.

You are correct that GDPR doesn't allow its protections to be waived. A data subject may always consent to certain processing, and some processing may be performed without consent, but it's not possible to waive the right to withhold consent for processing that does require it.

Improve this answer
6
  • 9
    Does GDPR actually have any teeth outside of the EU? I mean, if somebody living in the US creates a US-centric service with no intent of offering services to the EU, surely the company doesn't have any real obligations to obey GDPR if an EU citizen decides to sign up for it? Would a US court uphold EU law in this case? I'm assuming not.
    – ProgrammingLlama
    Jan 7, 2020 at 3:26
  • 2
    Seemingly not, if I'm reading it right.
    – ProgrammingLlama
    Jan 7, 2020 at 3:35
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – feetwet ♦
    Jan 8, 2020 at 19:00
  • 3
    @Chloe there are some questions here that go into that. The penalties are civil, however, not criminal, so there would be no extradition. A foreign civil judgment can be enforced in the US, which is I suppose why some US sites refuse to serve their pages to IP addresses in the EU. (But small violations would probably not be worth the effort.) Further discussion in the chat room, please.
    – phoog
    Jan 9, 2020 at 5:40
  • 2
    @John_ReinstateMonica: I think there is a huge difference in between "run a US company not targetting EU, and not knowing or caring who might use the service" on the one hand side, and explicitly asking, and then showing such a consent screen. Which unmistakably demonstrates the explicit intent to do business in the EU (thus making you subject to EU laws whether you like it or not). In the case of that particular US company, they happen to have an office in Ireland... so... they are bound by EU law one way or the other, even if they try to give a fraudulent impression to end users.
    – Damon
    Jan 9, 2020 at 16:48
27

GDPR consent must be freely given

The GDPR conditions for consent define it as (article 4.11) "‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her". It's worth noting that all the criteria are mandatory - if one of them is missing (e.g. it's not specific or not freely given) then it's not consent according to GDPR.

GDPR article 7.4 states "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." To clarify this, GDPR recital 43 states "Consent is presumed not to be freely given if [...] the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance." which is explicitly about cases like this - if providing the service is conditional on "consenting", then that consent shall be presumed to not be freely given, and thus it is not valid consent.

Thus, a record that this checkbox was checked does not give the company a legal basis to use your data. In particular, GDPR 7.1 states "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data." , so it's their duty to show that you actually consented and your consent fulfills all the criteria, and it appears that they can not. One way to proceed would be to 'agree' to the checkbox, immediately follow up with a GDPR data request (asking them to affirm what legal basis allows them to process the data), and if they list "consent" as the legal basis (they might not, there are other possible ways) then dispute that with your local data protection authority.

Improve this answer
8
  • 7
    Your answer assumes that the data collection is not essential to the performance of the service, which without knowing the specifics of the service, we cannot determine.
    – asgallant
    Jan 6, 2020 at 23:06
  • 2
    How do you know they don't need consent? The claim is that they need to collect and process certain personal data in order to perform the service. That seems to me to meet the criteria for requiring users to give consent. The presence of the checkbox is not automatically a red flag that the company is doing something wrong. You need to know more to make that determination. Ex, if a note taking app required users to consent to collection and processing of GPS data, contacts, etc, in order to use the app, that would be a red flag. (continued)
    – asgallant
    Jan 6, 2020 at 23:22
  • 6
    A health tracking app that collects heart rate, blood sugar levels, steps taken, etc. that requires consent to collect and process that data in order to use the app is not necessarily a red flag.
    – asgallant
    Jan 6, 2020 at 23:24
  • 2
    @Peteris Consider a firm which offers email alerts when something interesting happens. They will require the email address in order to provide the service; and "necessity" will be the legal basis of the data processing. They are still free to ask a prospective customer if it's OK to store and use the email address; if the answer is "no", then the deal is off - but better that than a pissed-off customer later. (Yes, this is a rather contrived example, but more realistic ones are possible.)
    – Martin Bonner supports Monica
    Jan 7, 2020 at 8:26
  • 3
    @MSalters My example specifically only involved one purpose (which is legally allowed as a necessity). I am trying to make the (linked) points that a) just because a website operator asks if it is OK to process data does not mean that the legal basis for processing that data is going to be freely given consent b) the operator is allowed to ask, even if the legal basis is not consent.
    – Martin Bonner supports Monica
    Jan 7, 2020 at 13:19
4

GDPR puts several requirements on a company to be compliant.

Among these is the requirement to seek informed consent from the data subject, ie. you, to store and use data.

As such the waiver you are asked to agree does not seem to be an attempt to bypass GDPR, but rather explicitly following the letter of the law.

Please note the following;

  • You are not being asked to waive any rights regarding a data breach.
  • The company is not asking to be allowed to use the data for purposes other than to provide wellness and fitness services.
  • The company is not asking to be allowed to store data not needed for it to provide wellness and fitness services
  • The company is not asking you to indemnify them if a data processor uses the data for purposes not required to provide you with wellness and fitness services.
  • The company explicitly notes that you are free to withdraw consent at a later time.
  • You where not asked to give up your right to receive the data.
  • You where not asked to give up any rights to have your data be deleted.

Considering that health information is considered sensitive it seems difficult to see how a company could offer "welness and fitness services" in a GDPR compliant manner without a waiver similar to the one you were presented with.

GDPR does put the requirement that the consent be freely given, but "If I do not give the consent I would be unable to use the service" is not usually considered coercion.

In conclusion, there are parts of the GDPR that applies even if the subject has agreed to a waiver (processes surrounding data breaches, not using data for purposes other than what it was provided for, etc.), but nothing in the agreement you are being asked for seems to touch this.

Improve this answer
1

Consent is a lawfuls basis for processing both sensitive data and for transferring data overseas. Providing consent does not give the data controller the ability to ignore your rights under GDPR, nor is this organisation implying this, so I expect you would have some assurance.

The issue with the solution provided here is that to be lawful under GDPR consent must be 'feeely given'. If you cannot have the service without consent, then it is not being given freely. Therefore the organisation is still not undertaking this processing legally.

Improve this answer
6
  • 3
    "If you cannot have the service without consent, then it is not being given freely": this is incorrect. In general, a consumer is free to refrain from buying a service. For consent to be coerced, something more must exist than simply not being able to use a service without consent.
    – phoog
    Jan 7, 2020 at 14:45
  • @phoog Depends on the service, but that's probably true for most services.
    – user253751
    Jan 7, 2020 at 17:41
  • 2
    @phoog: Art. 7 GDPR: When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
    – elaforma
    Jan 8, 2020 at 4:04
  • @fNek precisely: "...that is not necessary for the performance of that contract" means that the if the data processing is necessary for the performance of the contract then that doesn't have any bearing on the determination of whether the consent was freely given, because the data subject is free to refrain from entering into the contract.
    – phoog
    Jan 8, 2020 at 4:27
  • To expand on what @fNek says, knowing your age is probably necessary to providing a wellness and fitness service; knowing your date of birth is not. So (in theory at least) they are not allowed to demand your date of birth, only your age.
    – Michael Kay
    Jan 8, 2020 at 8:43
1

Respectfully: some other answers impliedly assume the question engages GDPR issues. It doesn't!!!

The correct answer is: "not a snowball's chance in hell". Why? Because the question actually confronts the rule of law which as meta-law, surprise surprise, aborts any other legal issue.

Any agreement between data subjects and controllers is private law. The GDPR is statutory. The proposed waiver falls into a certain category expressed roughly as follows: "Any private law agreement to usurp the jurisdiction of the Court is void for illegality".

For the same reason it's unenforceable. So the data subjects can reverse their decision to waive at any time without breaching any "agreement". Because the "agreement" was void ab initio.

For the same reason, of course, any T&C that imports any Privacy Notice [edit: in a way that would conflict with any statute] is likewise void for illegality (or at least the clause is severed if a valid severability clause exists compliant with local contract law severability doctrine).

Here's an illustration. A few months ago some judge, in the backwoods of some unenlightened hick jurisdiction, invented this crazy rule that forming a contract with a hit man to waive the compliance rules on murder and assassinate the [ boss / spouse / driver annoying you at the traffic lights] might risk a polite invitation to Court and another polite invitation to jail, expressed as an offer too good to refuse. Especially if the judge’s football team lost the previous day. So be careful where you strike such deals. And make sure your favourite assassins (and data subject users) don’t snitch on you. Just say please!

Even lawyers fall into this trap, on a metalevel. I've seen too many tech company contracts that include wording such as "the parties agree to waive the Court's domestic rules of private international law". When judges sees such words, they respond in some of three non-exclusive ways: rip into the drafters if they're stupid enough to be present in Court; limit themselves to a shark-like smile while laughing like a drain inside; or maintaining a polite poker face while wondering "how will I resist the temptation of screwing you over for this disrespectful and arrogant attempt to create a potential international incident?".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .