1

We're implementing the EU's GDPR regulations on a certain project and I'm wondering about the following:

Company A develops an App, which also has a website version available to customers. The website implements a mechanism that allows the user to disable tracking and data collection. This decision is made when they land on the website, regardless of whether they are logged in at the time or not. Practically, it is very probable that large portion of users will land on the website, click "Allow all" and then log in.

I have two questions:

  1. When they log in, can we presume their approval of data collection is still applicable, if we can make the connection between them accepting it before they logged in and their user profile now that they did log in?
  2. Regardless of whether they accept or decline, is the mobile app required to adopt that decision? For example, user opted to deny any data collection by clicking on "Decline" on the website. They then logged in. After a while, they opened their mobile app on their phone (native app). What should the app do? Should it ask for permission again, since it is a different platform? Should it be able to communicate with the API and understand that the user opted out?

Again, I'm not asking from UX perspective. I'm asking from legal perspective. Is there any specific scenario in this case that we are supposed to follow by law?

4
  • that depends on how the contract is written - and that would be legal advice. Ask your lawyer. – Trish Dec 18 '20 at 12:27
  • What contract do you mean? – masiton Dec 18 '20 at 13:00
  • The EULA is a contract with the user. And so is the agreement if/that you may store/track/process their data. – Trish Dec 18 '20 at 13:01
  • 2
    This is asking what the law requires or permits, not what the asker should do. It should not be closed as asking for specific legal advice. – David Siegel Dec 18 '20 at 16:31
1

can we presume their approval of data collection is still applicable

My understanding is that by "make the connection" you mean that your system identifies that the individual who consented to tracking & data collection is the same person who logged in. If my understanding of your description is correct, then yes, your presumption of approval is valid. However, keep in mind that lapse of time tends to weaken your ability to prove that identity of approver and logged user.

The briefer the lapse of time between approval/consent and login, the harder for a logged user to refute that he consented to tracking & data collection. That is because it seems unreasonable for a user to give his consent despite knowing that he was going to log in shortly thereafter. This does not exempt you from providing the mechanism for people to withdraw their consent at any time, though.

What should the app do? Should it ask for permission again, since it is a different platform?

Yes, it should. That is because a person's consent decision might depend on the type of device with which he uses your system. For instance, geolocation tracking could dissuade a person from consenting from his mobile whereas he might have no objection to consenting from his desktop. Conversely, a person could consent from his mobile but not from his desktop because only on the latter he handles data he considers sensitive.

2
  • 1
    I think the last part here is very important: consent should be informed and specific. “Informed” would require that the data subject understands whether they are consenting to data collection from one device or from all their devices. “Specific” would require that they can independently select consent status for different processing purposes. Likely, this would also mean that they should control data collection from different devices independently. But this would clearly depend on the specific circumstances of the service. – amon Dec 18 '20 at 22:27
  • 1
    I am marking this an answer, specifically because of the last paragraph - this explains why separate approvals might not be viewed as a "sneaky" way to ignore data collection setting previously set, but a vital feature to the user. I didn't think of it this way. However, answer David Siegel is also worth mentioning & reading. – masiton Dec 21 '20 at 7:57
2

GDPR Article 13 section 1 says:

Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

  • (a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

  • (b) the contact details of the data protection officer, where applicable;

  • (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

  • (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

  • (e) the recipients or categories of recipients of the personal data, if any;

  • (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

Article 14 section 1 says:

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

Article 21 (2) says

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Nothing in any of these sections, or anywhere else that I can find, says that different ways of accessing the service must use the same access choices. When asking for consent to process and store data, it can be spelled out whether this consent applies toi a different access method (web site vs mobile app) or not. As long as the user is clearly asked for consent, and has a method to withdraw consent, the processor should be in compliance.

To answer the specific questions:

(1) yes, you may assume that consent lasts until it is withdrawn, provided that you cna be sure it is the same user, and provided thst the request for consent made i8ts duration clear.

(2) The mobile app may rely on the previously given consent, or may ask for consent separately. If it relies on previously given consent, it must offer some method by which consent can be withdrawn.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.