Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications I originally posted this on another Stack Exchange website but was advised this might be a better place for it. Original is here: https://security.stackexchange.com/questions/215300/is-it-ok-to-assume-a-user-has-opted-in-to-receive-emails-in-an-application-where/ I'm working on a web application where the main purpose/functionality is notifying users when there have been changes to regulations in a particular industry. The content of the email is always related to specific legal changes that have occurred. The users are not being "sold" anything from the content of the email, it contains factual information only. The application is subscription based, i.e. you have to pay for an account and using it is a choice. Any email addresses for accounts we hold are active users and we do not harvest this data from anywhere. So all email addresses we have are for real users who actively use the software. We are designing a setup wizard which allows users to set preferences on what information they receive. One of the settings is yes or no as to whether the application should send notifications via email. This raised debate as to what the default setting should be. The argument for "no" was that users should explicitly give their permission to receive automated emails and therefore this was the correct default. The argument for "yes" was that the users have implied consent because they are using an application whose sole purpose is to inform them about changes, and email delivery is the primary way of doing this. The application is still usable if the user doesn't receive emails because the data which is present in the emails is visible inside a web-based interface. The disadvantage of using the application in this way is that - unless the user logs in - they will not necessarily be aware of any updates. Therefore defaulting email opt-in is preferable. The pre-sale marketing material for the application makes it clear that email delivery is the main delivery method for the information and getting it directly to your inbox is an advantage of using the system. The application allows the user to change their settings at any time. So if they opt-in to receive emails today, they can opt-out tomorrow, and vice versa. They can change their preferences at any time. What are people's thoughts on this? We are based in the UK but deal with customers worldwide. Is this covered or referred to by GDPR?
GDPR does not require consent. It requires a legal basis. Consent is only one legal basis among many. Some other legal bases are: legitimate interest (implying an opt out solution) necessity for performance of a contract If your customers pay you to deliver email updates, that contract is the legal basis for sending email updates. The only wrinkle is that as you describe your service, the emails aren't an essential part of the service. Alternatively, you might assert that there's a legitimate interest to deliver updates via email so that updates aren't missed. In that case you must allow the users to object, e.g. via ab unsubscribe link in the email and via their account settings. Because a prior business relationship exists, there's a strong case for legitimate interest – even if this were marketing emails (!). Legitimate interest requires you to balance the legitimate interest with the data subject's rights and freedoms though. Your updates are most likely not marketing, so any advice you might read relating to marketing emailings is irrelevant. GDPR applies because you are established in the EU. The regulation applies in relation to all your users, not just EU users. If and when Brexit happens you will still be covered by the Data Protection Act, which transcribes the GDPR's requirements into UK law. However, processing data from EU users will then count as an international transfer which requires extra compliance work, at least until the EU issues an adequacy decision for the UK.
Yes, since you default to no consent, ergo consent would have to be positive. It's rather unsatisfactory though as a sort of double-negative, and needs careful wording to make sure consent is informed. However, this may be a technical problem as it seems odd that you can't have an unchecked checkbox. Does the word 'checked' perhaps appear in the HTML? https://ux.mailchimp.com/patterns/forms#radio
I very much suspect she is in right to 1) no receive promotion emails anymore, 2) Have them close the account again and 3) have them delete her pictures. No, she does not have those rights. She agreed to a legally binding contract when she signed up for the service when she clicked "OK" to open the account. That contract outlines her "rights," as you call them, and they can be very different from what you assume to be ethical and moral bounds to a business relationship. What you imagine to be fair business practices could be generally regarded as fair and normal consumer relations; but that's not necessarily what may be in the contract. What she agreed to in the Terms of Service (TOS) could be some form of long term licensing of her photos to the service, and that could be why they won't delete the photos and why she can't delete them in bulk. The TOS states the terms of the promo emails she agreed to receive. Read the TOS; everything will be outlined. The company is in no way obligated to make life easy for her or change the contract to appeal to her; she agreed to everything, including downloading all her photos. If she didn't read the TOS and feels they copied all her photos "without her knowing", that's her fault. It's possible that the company is breaking consumer protection laws with some of their practices, but you'll need to read Canada consumer laws and see if they require ease of use, permanent op-out of emails, etc. I doubt the company would be flagrantly violating consumer law.
Residents agree that the receipt of mail by any individual not listed as a Resident or Occupant in this Agreement at the Leased Premises shall be proof of occupancy of that individual and a violation of this Agreement. I assume that the lease states that only the listed individuals can reside in the unit. Maybe they think that this says that receipt of mail by an unlisted person is a further violation of the lease, I don't think that is clearly enough stated that the courts would agree that receiving mail is itself a violation of the lease. Instead, it seems to be intended to say something about an existing clause – you can't have other people living there. The courts would look at the requirements of the lease, and ask "did you comply"? The question of whether you did a certain thing is a question of fact that has to be resolved in court. However, the revised lease language does not state that all mail must be addressed to Johnny Johnson – it only addresses receipt by a person not on the lease. You are (apparently) on the lease, so you may receive mail there. Nothing in the lease controls how such mail can be addressed. If you receive mail addressed to Tommy Thompson, your defense is that you received the mail, and you are on the lease, so you will not have violated the new clause.
You don't have to, but you probably want to for a couple of reasons: It's courteous, and in the spirit of open source It's someone else's work, and you're using it. The least you can probably say is &quot;thank you.&quot; It will also probably help you stay in the clear: since you're using software in binary form, where the notice isn't immediately accessible, then by providing a copy of the license, you respect that licensing term in another way. It tells your users what's up with the program Let's admit it, having the license accessible to the users tells them what's in the program and so on. It's another way of providing attribution, like I listed in the first reason above. Many apps, desktop and mobile, have a screen or panel to indicate the projects and licenses that they use. They don't have to be straight in the user's face, they can be a little button in the &quot;About&quot; screen of the program. To answer a little confusion: the binaries are still a derived form from that source code. Analyse the heading: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. The software is still there, it's just there in a different form, a compiled form. Therefore, the copyright and permission notice should probably stick around, even if it's just a file somewhere.
it would violate law? It would be very dependent of what your jurisdiction is and what the software does. I would expect most software that would be lawful to install at your home would be lawful to install at your company, but there may be exceptions. To put an hyperbolic example, if you work at the CIA and you install some remote access software that allows you to access your workstation from a non-secure PC through non-secure methods, I am pretty sure that would be illegal, even if you had the best of intentions. A recent scenario taken from real life involves some members an organization who are required to use official e-mail servers for FOIA purposes setting up their own private mail servers. Of course, YMMV. can I purchase it for myself, and then use at workplace Even if the software is legal it does not mean that it is ok to use it at the workplace. Most business have rules about what software may be installed in the PCs, who may install it and how to manage it. Your software could introduce security vulnerabilities that your IT team may need to be aware of, or incompatibilities with other software. It may introduce legal liabilities (you install a "home edition" licence in a corporate environment where that licence is invalid). Your company may discipline you if you breaking those guidelines and install software without authorization, even if there is no harm for them for this action. On top of that, if your actions cause some damage to the company, it can sue you to get you to pay for those damages. Before taking any action you should inquiry about your company's IT policy and, if your company does not have one or if the policy is not clear about allowing you to install the software, ask the people in charge (preferably in writting).
The GDPR does not mandate specific features, but that any processing is lawful and transparent etc. So what would be the purpose of storing a revision history? Once that is clear you can work out an appropriate legal basis (e.g. a legitimate interest) and then figure out which data subject rights apply. For example, let's assume that there is a security interest in keeping a revision history, so that (a) mistaken edits can be rolled back, and (b) the user can be notified of possibly unauthorized changes. This would be a legitimate interest primarily of the account holder, secondarily of you as the system operator. Of course, such security requirements have to be proportional, but I'd see that as given when there's a payment method on file. You are required to apply appropriate safety measures and to apply the data minimization principle. E.g. is it necessary to store this revision history for all eternity? No, one or two months will likely be sufficient. Who should have access to this data? If the purpose is to defend against unauthorized access, it could make sense to only give out this data on request, and otherwise only make it available to support and security staff. Now we can discuss how this interfaces with rectification or deletion. That the user is able to rectify their data themselves is very good. However, that doesn't imply a prohibition on keeping a revision history: the revision history indicates what data was stored at what point in time, and is by definition correct. This assumes that you are not using the revision history for any other purposes. When the legal basis is a legitimate interest, a request for erasure has to be preceded by (or implies) an objection (opt-out) to further processing. The objection must weighed against the legitimate interest: the objection can be denied when there are overriding grounds to continue processing. This might be the case for a security purpose: if someone with unauthorized access can just erase their traces, the purpose cannot be achieved. But perhaps the user could opt out when they create their account? Or opt-out later, but with some delay to still achieve the security purpose at the time of opt-out? In any case, erasure is required when the data is no longer necessary for its purpose – this ties back to picking an appropriate retention period, as discussed above. So it's not really possible to provide a general answer, and it really depends on the specific purpose you are trying to achieve.
I'm not entirely sure why you have to store the data of the invited user? You can simply hash the email address. Hashes are meaningless without the original input so that would allow you to store the data. Sending email means that you're processing personal data. In your use case it would fall under Art 6 (f): Legitimate Interest. (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. I do advice you to also follow these guidelines in the submission of the email: https://sendgrid.com/docs/Classroom/Deliver/Address_Lists/peer_initiated_email_invitation_requirements.html