Is it okay to store user locations?GDPR - Withdrawn user consentUser consent required under GDPROpt Out Consent under GDPRWhat provisions should I make regarding GDPR consent when users do not sign themselves up?Am I allowed to store data of EU citizens as an Indian company?Can companies use user data for App Store marketing screenshots?User consent required under GDPRGDPR - Withdrawn user consentGDPR - A mobile App that allows user to store media do we have to option user consent?GDPR - Can I store domain names?How can GDPR affect user generated content?Store browser width / screen size and browser type without user consent?Storing chat messages in a private database with user consent
Resonance structure of acetate
Shabbos morning amidah - wrong biblical text - what to do?
How to decline invite to team dinner when I have a prior engagement?
Number in binary as a product
A short fiction about a stable-hand with rather strange charges
Is summon woodland beings (pixies) broken?
Having trouble understanding condition for Rolle's Theorem (russian translation)
Unexpected Code Coverage Reduction
How to manage publications on a local computer
Do familiars reproduce? If 'yes', what kinds of offspring result?
Commutative algebras with modules of small complexity
Can a professor do an internship?
Average Two Letters
Subjonctive mood in Latin
Font size in pmatrix: Elegant Summation in big Vectors
Passing a block device to Qemu
Making sense of possessed dolls: how could they actually kill people?
How do soldiers of conquered states enlist into the army of their conqueror?
About an ambiguity that really prevents me from understanding the principle " the laws of physics are invariant in all inertial frames"
Difference between 说话 and 话说?
Using footnotes in fiction: children's book which can be enjoyed by adults
Meaning of "pulse duration" in transistor datasheets?
Paying to leave without notice in at-will employment state
Interview question: If correlation doesn't imply causation, how do you detect causation?
Is it okay to store user locations?
GDPR - Withdrawn user consentUser consent required under GDPROpt Out Consent under GDPRWhat provisions should I make regarding GDPR consent when users do not sign themselves up?Am I allowed to store data of EU citizens as an Indian company?Can companies use user data for App Store marketing screenshots?User consent required under GDPRGDPR - Withdrawn user consentGDPR - A mobile App that allows user to store media do we have to option user consent?GDPR - Can I store domain names?How can GDPR affect user generated content?Store browser width / screen size and browser type without user consent?Storing chat messages in a private database with user consent
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;
.everyonelovesstackoverflowposition:absolute;height:1px;width:1px;opacity:0;top:0;left:0;pointer-events:none;
I know it might sound quite bad. But here I explain the whole situation.
I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all different locations each user has been in. By location, I don't mean I would store coordinates, just all cities in which he/she has checked in (really no coordinate would be stored).
I've been told to be really cautious with this because of recent GDPR law.
But to be honest I know hardly anything about law and its interpretation.
So my question is if I can store this kind of information (as it is not really precise data) and if I should ask for user's explicit consent.
privacy gdpr data-storage
edited Apr 1 at 9:59
User37849012643
9755 silver badges30 bronze badges
asked Mar 28 at 16:27
Sergi MascaróSergi Mascaró
335 bronze badges
add a comment
|
I know it might sound quite bad. But here I explain the whole situation.
I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all different locations each user has been in. By location, I don't mean I would store coordinates, just all cities in which he/she has checked in (really no coordinate would be stored).
I've been told to be really cautious with this because of recent GDPR law.
But to be honest I know hardly anything about law and its interpretation.
So my question is if I can store this kind of information (as it is not really precise data) and if I should ask for user's explicit consent.
privacy gdpr data-storage
edited Apr 1 at 9:59
User37849012643
9755 silver badges30 bronze badges
asked Mar 28 at 16:27
Sergi MascaróSergi Mascaró
335 bronze badges
1
FWIW, you can read the actual law online, as well as the interpretations of the organization that created it!
– user253751
Mar 28 at 22:32
You are even allowed to be facebook under GDPR. :)
– Stefano Palazzo
Mar 29 at 11:13
add a comment
|
I know it might sound quite bad. But here I explain the whole situation.
I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all different locations each user has been in. By location, I don't mean I would store coordinates, just all cities in which he/she has checked in (really no coordinate would be stored).
I've been told to be really cautious with this because of recent GDPR law.
But to be honest I know hardly anything about law and its interpretation.
So my question is if I can store this kind of information (as it is not really precise data) and if I should ask for user's explicit consent.
privacy gdpr data-storage
edited Apr 1 at 9:59
User37849012643
9755 silver badges30 bronze badges
asked Mar 28 at 16:27
Sergi MascaróSergi Mascaró
335 bronze badges
I know it might sound quite bad. But here I explain the whole situation.
I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all different locations each user has been in. By location, I don't mean I would store coordinates, just all cities in which he/she has checked in (really no coordinate would be stored).
I've been told to be really cautious with this because of recent GDPR law.
But to be honest I know hardly anything about law and its interpretation.
So my question is if I can store this kind of information (as it is not really precise data) and if I should ask for user's explicit consent.
privacy gdpr data-storage
privacy gdpr data-storage
edited Apr 1 at 9:59
User37849012643
9755 silver badges30 bronze badges
asked Mar 28 at 16:27
Sergi MascaróSergi Mascaró
335 bronze badges
edited Apr 1 at 9:59
User37849012643
9755 silver badges30 bronze badges
asked Mar 28 at 16:27
Sergi MascaróSergi Mascaró
335 bronze badges
edited Apr 1 at 9:59
User37849012643
9755 silver badges30 bronze badges
edited Apr 1 at 9:59
User37849012643
9755 silver badges30 bronze badges
edited Apr 1 at 9:59
User37849012643
9755 silver badges30 bronze badges
9755 silver badges30 bronze badges
asked Mar 28 at 16:27
Sergi MascaróSergi Mascaró
335 bronze badges
asked Mar 28 at 16:27
Sergi MascaróSergi Mascaró
335 bronze badges
asked Mar 28 at 16:27
Sergi MascaróSergi Mascaró
335 bronze badges
335 bronze badges
1
FWIW, you can read the actual law online, as well as the interpretations of the organization that created it!
– user253751
Mar 28 at 22:32
You are even allowed to be facebook under GDPR. :)
– Stefano Palazzo
Mar 29 at 11:13
add a comment
|
1
FWIW, you can read the actual law online, as well as the interpretations of the organization that created it!
– user253751
Mar 28 at 22:32
You are even allowed to be facebook under GDPR. :)
– Stefano Palazzo
Mar 29 at 11:13
1
1
FWIW, you can read the actual law online, as well as the interpretations of the organization that created it!
– user253751
Mar 28 at 22:32
FWIW, you can read the actual law online, as well as the interpretations of the organization that created it!
– user253751
Mar 28 at 22:32
You are even allowed to be facebook under GDPR. :)
– Stefano Palazzo
Mar 29 at 11:13
You are even allowed to be facebook under GDPR. :)
– Stefano Palazzo
Mar 29 at 11:13
add a comment
|
1 Answer
1
active
oldest
votes
It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR)
The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person.
There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability.
To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used.
You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent.
So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear.
Some previous questions and answers here on law.se dealing with GDPR consent that seem possibly relevant:
User consent required under GDPR
What provisions should I make regarding GDPR consent when users do not sign themselves up?
GDPR - Withdrawn user consent
Opt Out Consent under GDPR
answered Mar 28 at 16:40
David SiegelDavid Siegel
28.2k2 gold badges47 silver badges99 bronze badges
1
So, to make things clear as water, if the user gives consent I can store his/her locations, right? And I guess I should also let them revoke the consent given and erase all their data. Thanks! (After this response I'll accept your answer)
– Sergi Mascaró
Mar 28 at 17:11
3
@Sergi Mascaró Right. See my edit above. There can be valid reasons to retain data even if consent is revoked under the GDPR, but if you don't need to retain it, allowing deletion is probably simplest. Otherwise you wiull have to determine if some other lawful basis applies
– David Siegel
Mar 28 at 17:29
What do you mean with "in a manner that complies with the GDPR"?
– Sergi Mascaró
Mar 28 at 23:40
2
@Sergi: David gave an example of a way of seeking consent that does not comply with the GDPR: a pre-checked consent box, like "I agree to having my location stored" next to a box that already has a tick in it before the user does anything. The GDPR itself explains compliance, but this probably is not the place to dump the entire legislation.
– Steve Jessop
Mar 28 at 23:52
2
The main principles IIRC are that the user must take an action specifically to give consent; it must be as easy to withdraw consent later as it was to grant it initially; and consent cannot be demanded as a condition for something that doesn't require the data being consented to. So for example, you cannot stream music to someone in exchange for permission to store their location. You can, as a requirement to enable location-based services, require consent to store location data that's needed to supply those services.
– Steve Jessop
Mar 28 at 23:54
|
show 3 more comments
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "617"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2flaw.stackexchange.com%2fquestions%2f38533%2fis-it-okay-to-store-user-locations%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR)
The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person.
There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability.
To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used.
You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent.
So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear.
Some previous questions and answers here on law.se dealing with GDPR consent that seem possibly relevant:
User consent required under GDPR
What provisions should I make regarding GDPR consent when users do not sign themselves up?
GDPR - Withdrawn user consent
Opt Out Consent under GDPR
answered Mar 28 at 16:40
David SiegelDavid Siegel
28.2k2 gold badges47 silver badges99 bronze badges
1
So, to make things clear as water, if the user gives consent I can store his/her locations, right? And I guess I should also let them revoke the consent given and erase all their data. Thanks! (After this response I'll accept your answer)
– Sergi Mascaró
Mar 28 at 17:11
3
@Sergi Mascaró Right. See my edit above. There can be valid reasons to retain data even if consent is revoked under the GDPR, but if you don't need to retain it, allowing deletion is probably simplest. Otherwise you wiull have to determine if some other lawful basis applies
– David Siegel
Mar 28 at 17:29
What do you mean with "in a manner that complies with the GDPR"?
– Sergi Mascaró
Mar 28 at 23:40
2
@Sergi: David gave an example of a way of seeking consent that does not comply with the GDPR: a pre-checked consent box, like "I agree to having my location stored" next to a box that already has a tick in it before the user does anything. The GDPR itself explains compliance, but this probably is not the place to dump the entire legislation.
– Steve Jessop
Mar 28 at 23:52
2
The main principles IIRC are that the user must take an action specifically to give consent; it must be as easy to withdraw consent later as it was to grant it initially; and consent cannot be demanded as a condition for something that doesn't require the data being consented to. So for example, you cannot stream music to someone in exchange for permission to store their location. You can, as a requirement to enable location-based services, require consent to store location data that's needed to supply those services.
– Steve Jessop
Mar 28 at 23:54
|
show 3 more comments
It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR)
The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person.
There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability.
To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used.
You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent.
So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear.
Some previous questions and answers here on law.se dealing with GDPR consent that seem possibly relevant:
User consent required under GDPR
What provisions should I make regarding GDPR consent when users do not sign themselves up?
GDPR - Withdrawn user consent
Opt Out Consent under GDPR
answered Mar 28 at 16:40
David SiegelDavid Siegel
28.2k2 gold badges47 silver badges99 bronze badges
1
So, to make things clear as water, if the user gives consent I can store his/her locations, right? And I guess I should also let them revoke the consent given and erase all their data. Thanks! (After this response I'll accept your answer)
– Sergi Mascaró
Mar 28 at 17:11
3
@Sergi Mascaró Right. See my edit above. There can be valid reasons to retain data even if consent is revoked under the GDPR, but if you don't need to retain it, allowing deletion is probably simplest. Otherwise you wiull have to determine if some other lawful basis applies
– David Siegel
Mar 28 at 17:29
What do you mean with "in a manner that complies with the GDPR"?
– Sergi Mascaró
Mar 28 at 23:40
2
@Sergi: David gave an example of a way of seeking consent that does not comply with the GDPR: a pre-checked consent box, like "I agree to having my location stored" next to a box that already has a tick in it before the user does anything. The GDPR itself explains compliance, but this probably is not the place to dump the entire legislation.
– Steve Jessop
Mar 28 at 23:52
2
The main principles IIRC are that the user must take an action specifically to give consent; it must be as easy to withdraw consent later as it was to grant it initially; and consent cannot be demanded as a condition for something that doesn't require the data being consented to. So for example, you cannot stream music to someone in exchange for permission to store their location. You can, as a requirement to enable location-based services, require consent to store location data that's needed to supply those services.
– Steve Jessop
Mar 28 at 23:54
|
show 3 more comments
It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR)
The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person.
There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability.
To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used.
You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent.
So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear.
Some previous questions and answers here on law.se dealing with GDPR consent that seem possibly relevant:
User consent required under GDPR
What provisions should I make regarding GDPR consent when users do not sign themselves up?
GDPR - Withdrawn user consent
Opt Out Consent under GDPR
answered Mar 28 at 16:40
David SiegelDavid Siegel
28.2k2 gold badges47 silver badges99 bronze badges
It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if you are locates in the EU, or if your users are. My understanding is that it is location at the time the app is accessed that matters, not a user's citizenship. I am not totally sure about that, however. Unless your app is limited to non-EU access, it it probably safest to comply with the GDPR)
The degree of precision of your location data will not matter -- a specific city is quite enough to make it personal data if it can be tied to a specific person.
There are various lawful bases that may be relied on for processing and storage, but explicit consent is probably the one with the widest applicability.
To use consent as the lawful basis, you must present an OPT-IN decision to the user, and record the results. If the user does nothing, the result must record lack of consent. You may not use a pre-checked consent box or another mechanism that has the effect of an opt-out choice. You should be clear about what information will be stored, and how it will or might be used.
You will also need to consider how your app will function for those who do not consent, and how to handle requests to withdraw consent.
So if an app obtains user consent to store location data in a manner that complies with the GDPR, it may store user location data. The consent should make the possible uses of the data clear. If the data is to be shared, the consent should make the possible extent of sharing clear.
Some previous questions and answers here on law.se dealing with GDPR consent that seem possibly relevant:
User consent required under GDPR
What provisions should I make regarding GDPR consent when users do not sign themselves up?
GDPR - Withdrawn user consent
Opt Out Consent under GDPR
answered Mar 28 at 16:40
David SiegelDavid Siegel
28.2k2 gold badges47 silver badges99 bronze badges
edited Mar 29 at 0:09
answered Mar 28 at 16:40
David SiegelDavid Siegel
28.2k2 gold badges47 silver badges99 bronze badges
answered Mar 28 at 16:40
David SiegelDavid Siegel
28.2k2 gold badges47 silver badges99 bronze badges
answered Mar 28 at 16:40
David SiegelDavid Siegel
28.2k2 gold badges47 silver badges99 bronze badges
28.2k2 gold badges47 silver badges99 bronze badges
1
So, to make things clear as water, if the user gives consent I can store his/her locations, right? And I guess I should also let them revoke the consent given and erase all their data. Thanks! (After this response I'll accept your answer)
– Sergi Mascaró
Mar 28 at 17:11
3
@Sergi Mascaró Right. See my edit above. There can be valid reasons to retain data even if consent is revoked under the GDPR, but if you don't need to retain it, allowing deletion is probably simplest. Otherwise you wiull have to determine if some other lawful basis applies
– David Siegel
Mar 28 at 17:29
What do you mean with "in a manner that complies with the GDPR"?
– Sergi Mascaró
Mar 28 at 23:40
2
@Sergi: David gave an example of a way of seeking consent that does not comply with the GDPR: a pre-checked consent box, like "I agree to having my location stored" next to a box that already has a tick in it before the user does anything. The GDPR itself explains compliance, but this probably is not the place to dump the entire legislation.
– Steve Jessop
Mar 28 at 23:52
2
The main principles IIRC are that the user must take an action specifically to give consent; it must be as easy to withdraw consent later as it was to grant it initially; and consent cannot be demanded as a condition for something that doesn't require the data being consented to. So for example, you cannot stream music to someone in exchange for permission to store their location. You can, as a requirement to enable location-based services, require consent to store location data that's needed to supply those services.
– Steve Jessop
Mar 28 at 23:54
|
show 3 more comments
1
So, to make things clear as water, if the user gives consent I can store his/her locations, right? And I guess I should also let them revoke the consent given and erase all their data. Thanks! (After this response I'll accept your answer)
– Sergi Mascaró
Mar 28 at 17:11
3
@Sergi Mascaró Right. See my edit above. There can be valid reasons to retain data even if consent is revoked under the GDPR, but if you don't need to retain it, allowing deletion is probably simplest. Otherwise you wiull have to determine if some other lawful basis applies
– David Siegel
Mar 28 at 17:29
What do you mean with "in a manner that complies with the GDPR"?
– Sergi Mascaró
Mar 28 at 23:40
2
@Sergi: David gave an example of a way of seeking consent that does not comply with the GDPR: a pre-checked consent box, like "I agree to having my location stored" next to a box that already has a tick in it before the user does anything. The GDPR itself explains compliance, but this probably is not the place to dump the entire legislation.
– Steve Jessop
Mar 28 at 23:52
2
The main principles IIRC are that the user must take an action specifically to give consent; it must be as easy to withdraw consent later as it was to grant it initially; and consent cannot be demanded as a condition for something that doesn't require the data being consented to. So for example, you cannot stream music to someone in exchange for permission to store their location. You can, as a requirement to enable location-based services, require consent to store location data that's needed to supply those services.
– Steve Jessop
Mar 28 at 23:54
1
1
So, to make things clear as water, if the user gives consent I can store his/her locations, right? And I guess I should also let them revoke the consent given and erase all their data. Thanks! (After this response I'll accept your answer)
– Sergi Mascaró
Mar 28 at 17:11
So, to make things clear as water, if the user gives consent I can store his/her locations, right? And I guess I should also let them revoke the consent given and erase all their data. Thanks! (After this response I'll accept your answer)
– Sergi Mascaró
Mar 28 at 17:11
3
3
@Sergi Mascaró Right. See my edit above. There can be valid reasons to retain data even if consent is revoked under the GDPR, but if you don't need to retain it, allowing deletion is probably simplest. Otherwise you wiull have to determine if some other lawful basis applies
– David Siegel
Mar 28 at 17:29
@Sergi Mascaró Right. See my edit above. There can be valid reasons to retain data even if consent is revoked under the GDPR, but if you don't need to retain it, allowing deletion is probably simplest. Otherwise you wiull have to determine if some other lawful basis applies
– David Siegel
Mar 28 at 17:29
What do you mean with "in a manner that complies with the GDPR"?
– Sergi Mascaró
Mar 28 at 23:40
What do you mean with "in a manner that complies with the GDPR"?
– Sergi Mascaró
Mar 28 at 23:40
2
2
@Sergi: David gave an example of a way of seeking consent that does not comply with the GDPR: a pre-checked consent box, like "I agree to having my location stored" next to a box that already has a tick in it before the user does anything. The GDPR itself explains compliance, but this probably is not the place to dump the entire legislation.
– Steve Jessop
Mar 28 at 23:52
@Sergi: David gave an example of a way of seeking consent that does not comply with the GDPR: a pre-checked consent box, like "I agree to having my location stored" next to a box that already has a tick in it before the user does anything. The GDPR itself explains compliance, but this probably is not the place to dump the entire legislation.
– Steve Jessop
Mar 28 at 23:52
2
2
The main principles IIRC are that the user must take an action specifically to give consent; it must be as easy to withdraw consent later as it was to grant it initially; and consent cannot be demanded as a condition for something that doesn't require the data being consented to. So for example, you cannot stream music to someone in exchange for permission to store their location. You can, as a requirement to enable location-based services, require consent to store location data that's needed to supply those services.
– Steve Jessop
Mar 28 at 23:54
The main principles IIRC are that the user must take an action specifically to give consent; it must be as easy to withdraw consent later as it was to grant it initially; and consent cannot be demanded as a condition for something that doesn't require the data being consented to. So for example, you cannot stream music to someone in exchange for permission to store their location. You can, as a requirement to enable location-based services, require consent to store location data that's needed to supply those services.
– Steve Jessop
Mar 28 at 23:54
|
show 3 more comments
Thanks for contributing an answer to Law Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2flaw.stackexchange.com%2fquestions%2f38533%2fis-it-okay-to-store-user-locations%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
FWIW, you can read the actual law online, as well as the interpretations of the organization that created it!
– user253751
Mar 28 at 22:32
You are even allowed to be facebook under GDPR. :)
– Stefano Palazzo
Mar 29 at 11:13