According to GDPR, does privacy decision made on website legally affect mobile app settings also?

Question

We're implementing the EU's GDPR regulations on a certain project and I'm wondering about the following:

Company A develops an App, which also has a website version available to customers. The website implements a mechanism that allows the user to disable tracking and data collection. This decision is made when they land on the website, regardless of whether they are logged in at the time or not. Practically, it is very probable that large portion of users will land on the website, click "Allow all" and then log in.

I have two questions:

1. When they log in, can we presume their approval of data collection is still applicable, if we can make the connection between them accepting it before they logged in and their user profile now that they did log in?
2. Regardless of whether they accept or decline, is the mobile app required to adopt that decision? For example, user opted to deny any data collection by clicking on "Decline" on the website. They then logged in. After a while, they opened their mobile app on their phone (native app). What should the app do? Should it ask for permission again, since it is a different platform? Should it be able to communicate with the API and understand that the user opted out?

Again, I'm not asking from UX perspective. I'm asking from legal perspective. Is there any specific scenario in this case that we are supposed to follow by law?

Answer 1

can we presume their approval of data collection is still applicable

My understanding is that by "make the connection" you mean that your system identifies that the individual who consented to tracking & data collection is the same person who logged in. If my understanding of your description is correct, then yes, your presumption of approval is valid. However, keep in mind that lapse of time tends to weaken your ability to prove that identity of approver and logged user.

The briefer the lapse of time between approval/consent and login, the harder for a logged user to refute that he consented to tracking & data collection. That is because it seems unreasonable for a user to give his consent despite knowing that he was going to log in shortly thereafter. This does not exempt you from providing the mechanism for people to withdraw their consent at any time, though.

What should the app do? Should it ask for permission again, since it is a different platform?

Yes, it should. That is because a person's consent decision might depend on the type of device with which he uses your system. For instance, geolocation tracking could dissuade a person from consenting from his mobile whereas he might have no objection to consenting from his desktop. Conversely, a person could consent from his mobile but not from his desktop because only on the latter he handles data he considers sensitive.

Answer 2

GDPR Article 13 section 1 says:

Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

• (a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

• (b) the contact details of the data protection officer, where applicable;

• (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

• (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

• (e) the recipients or categories of recipients of the personal data, if any;

• (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

Article 14 section 1 says:

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

Article 21 (2) says

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Nothing in any of these sections, or anywhere else that I can find, says that different ways of accessing the service must use the same access choices. When asking for consent to process and store data, it can be spelled out whether this consent applies toi a different access method (web site vs mobile app) or not. As long as the user is clearly asked for consent, and has a method to withdraw consent, the processor should be in compliance.

To answer the specific questions:

(1) yes, you may assume that consent lasts until it is withdrawn, provided that you cna be sure it is the same user, and provided thst the request for consent made i8ts duration clear.

(2) The mobile app may rely on the previously given consent, or may ask for consent separately. If it relies on previously given consent, it must offer some method by which consent can be withdrawn.