Does creating an account or making a purchase apply consent for all marketing communications? Many companies I have registered with or interacted with sign me up to their email newsletters without my providing my consent. For example, I created an account using my email and hired a bike from a bike sharing company through their app. Now I am on their email newsletter. Does the company have the right to send me marketing emails based on the fact that I purchased something from them even though I didn't give my explicit consent for my data to be processed in that way? Is consent assumed for every kind of processing/communication based on one reason (a purchase or making an account)? Can I withdraw my consent for marketing specifically?
Under the GDPR, consent is not the only legal basis that allows processing of your personal data. Other legal bases such as legitimate interest exist as well. So the question is: does the company have a legitimate interest to send you these emails? The answer is that this case is more about direct marketing, less about personal data. The circumstances under which direct marketing emails can be sent are covered by the ePrivacy directive, which is implemented in the UK via PECR (Privacy and Electronic Communications (EC Directive) Regulations 2003). PECR and ePrivacy introduce a concept known as soft opt-in: where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message in case the customer has not initially refused such use. (ePrivacy Directive, Art 13(2)) In plain language, they are allowed to send unsolicited marketing emails to existing customers, under the following restrictions: this only applies to customer relationships the marketing must be for similar products or services you must be able to object to further messages, i.e. unsubscribe upon collection of contact details you were given the opportunity to opt out
As Rick mentioned in comments this would most definitely be considered processing of personally identifiable information (PII) under the UK GDPR. You mention &quot;advertising&quot; and &quot;marketing purposes&quot; so it's pretty clearly not for your own personal household/family use and that means you would have to comply with the GDPR. That means you're going to need what's called a &quot;Lawful Basis&quot; for processing this data. There's six different ones: (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) You haven't provided enough information for to hazard a guess at what your basis would be but the ICO has an on-line tool which would give you a starting point. It's a very good idea to make sure you have all your i's dotted and all your t's crossed before you start processing any PII - and that includes documenting the process. Otherwise, what consequences may I face if I do so? In some ways the consequences of non-compliance are &quot;what have you done?&quot; coupled with &quot;how much have you got?&quot;, the maximum penalty is £17.5m or 4% of your annual turnover (whichever is greater) and fines issued under the UK GDPR to date have ranged from mere pocket change to almost enough to buy a tank of petrol. Widen it to the EU and small property owners association got a €500 slap on the wrist and Amazon managed to net themselves a €746m fine.
am I required to send the stuff back? No, but you should be able to prove that you met the conditions of the original contract between you two. There is no gift. There is a compensation that forms part of the contract between the offeror and you. The offeror's preference to call it a "gift" does not change the legal fact that his offer and your acceptance to complete Nightwave Season 2 constitutes the formation of a contract. From that standpoint, you are entitled to keep the items he mailed to you as long as you honor your part in that contract. You are right by conjecturing that a party is not allowed to unilaterally alter a contract. Any modification has to be agreed upon by all parties to that contract. However, a consent or agreement may be inferred from the parties' subsequent conduct. Hence the best way to pre-empt or supersede any such inference consists of letting that party know that you disapprove of the belated alteration(s). The absence of a written agreement can only complicate matters, though, since it appears that neither party has an objective, directly credible way to prove the terms of the original contract. Perhaps such terms can be deduced from the subsequent emails that he has been sending you, but that is impossible to ascertain without knowing the wording of the subsequent communications between you two. Lastly, enforceability of your contract is less clear if completing Nightwave Season 2 through someone else's performance amounts to an unlawful act. Not being knowledgeable of the terms and conditions of that game (?), I am unable to state with certainty whether the offeror could lawfully recover from you the items he mailed.
No, they can't do that. GDPR Recital 42 states: Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. Here's some more context on consent requirements.
No, it is not legal. Regardless of their location, the only legal options for companies serving to EU residents are to either deny access altogether or to make consent truly optional1 Recital 42 states (emphasis mine): Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement[...] Recital 43 states: Consent is presumed not to be freely given [...] or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. 1 Of course, remember that consent is only one of several means that allow them to process data. For example, if you were getting a trial account for a limited time, it would be considered a legitimate business need to ensure that you are not just opening new trial accounts when the old ones expire. So, if they wanted some data from you to ensure that you are not a previous user and you refused to provide it, then they could deny giving you that trial account without breaking the GDPR.
The Right to Access is pretty absolute. However, there are some limitations: Is the service even the Data Controller for the data in question? Here, you're talking about notes of one user about another. Is the platform the controller for the notes, or would the note-taker be the controller? Or both, jointly? If the platform weren't a controller but merely a data processor for these notes, it would be illegal for them to disclose the information. Trish also correctly points out that the GDPR does not apply to processing for purely personal or household purposes, e.g. personal social media use. So GDPR would not provide a basis to compel a user to disclose their notes to the data subject, assuming that the note-taker is covered by this exception. Of course, this exception wouldn't apply if the notes are taken for other purposes, e.g. professional networking. Also, this exception doesn't affect the platform. There is an explicit limitation to the right of access in Art 15(4): The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Disclosing user A's notes about user B to user B would likely violate the privacy rights of A. The notes are both A's and B's personal data. However, the correct balance depends on context. E.g. an employer probably can't refuse to provide access to a performance assessment merely because it was written by an identifiable manager. The UK ICO has provided detailed guidance on this aspect to the right of access. They propose a three-step test: Step one – Does the request require disclosing information that identifies another individual? For example, it might be possible to redact other people's information (but not in your Mastodon notes example). Step two – Has the other individual provided consent? Step three – Is it reasonable to disclose without consent? What is reasonable is highly context-dependent, but UK data protection law gives some concrete criteria to consider. The EU EDPB has draft guidance on the Right to Access. They note that the Art 15(4) can cover a wide range of rights, not just other people's privacy rights. But as in all things, the data controller is required to strike an appropriate balance between user A and B's conflicting rights. In the Mastodon user notes scenario, I think that the note author's rights to privacy should be considered more important than the data subject's right to access those notes, thus making it possible to reject that part of a DSAR under Art 15(4) GDPR. If we assume that the note-taker A is a (joint) controller for these notes, then it would also be necessary to consult them before making a decision about the access request.
Update: On 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that cookies require explicit consent regardless of personal data is being processed. (Where the exceptions don't apply). (paragraphs 68-70 of the ruling). That does probably invalidate my answer below. However, because I have based my answer on information provided by the Dutch DPA, I will not update my answer until that DPA has responded on this. 'By clicking agree or continuing to use this site you agree to our privacy policy' Neither of theses options is considered clear consent. Continuing to use the site, is implied consent, which is not sufficient. Also it does not give you the option to reject. Clicking agree to agree the privacy policy is not specific enough. You must offer a separate opt-in box for everything for which you need consent. The privacy policy is just a text in which you explain your privacy policy. It is not a contract which needs agreement. Also keep in mind that withdrawal of consent must be as easy as giving it. So you must be able to return to the settings and change them. Having said that, it is possible to configure Google Analytics in a way you don't need consent; Accept the Data Processing Amendment Go to Admin Choose Account Settings Scroll down to the data processing amendment Accept it Click Save Disable Data Sharing Go to Admin Choose Account Settings Scroll down to the data sharing settings Uncheck all checkboxex Click Save Disable Data Collection for Advertising Go to Admin Choose Account Settings Choose Property settings Choose Tracking info Choose Data collection Turn off these two options Click Save Disable the User-ID feature Go to Admin Choose Account Settings Choose Property settings Choose Trackinginfo Choose User-ID Turn off these options Click Save Anonymize your visitors IP Address Add { ‘anonymize_ip’: true } to the tracking code on your website Even though you don't need consent, you still need to add a few lines to your privacy policy: You are using Google Analytics cookies. You have a data processing agreement with google. You have enabled IP anonymization/masking. You have disabled data sharing. You are not using any other google services in combination with Google Analytics. The Dutch DPA has a more complete manual, but unfortunately it is not available in English.
"1) Can I use an pre checked tick box under GDPR?" Nope. "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." (Recital 32) "2) Since GDPR also requires the data collector to ensure that the user is not under the age of 13 so I am planning to ask the users age only for that region i.e. EU Region. Now will simply mentioning that "By continuing you acknowledge that you are above 13 years" will work or will I have to ask the users age?" You have to require some affirmative action. Implicit consent (just continuing) is not acceptable (ibid.) "3) The GDPR requires the data collector to have a proof of the users consent. Now what kind of proof will be required for my App? I am ensuring that the user cannot move forward without providing the consent (only once) is that sufficient as a proof or is any other proof required?" If you are collecting data about the user, you should record the time and date consent was given as part of the user profile. If you are not collecting data about the user (this is only done by third party services such as Google analytics etc.) and there are no user profile, then preventing the user from using the app will have to do. The GDPR also requires data-minimization, and creating a user profile to record consent when no user profile is otherwise required will violate data-minimization-principles.