undefined | Better HN

0 pointsgervase7y ago0 comments

"In order to provide tagging service to our users, a key platform feature, we are required to maintain and process data about individuals with which Facebook, Inc. does not have a pre-existing business relationship ("Non-Users"). Failure to do so would cause substantive harm to our service, and should therefore be exempted from gathering consent from Non-Users under Article 21, Section 5 of the GDPR."

Something like that, I expect, although I'm not a lawyer either.

0 comments

zaarn7y ago

Processing without consent doesn't work for multiple parties.

You can't claim that because you need to provide service for someone else you need to process data of non-users.

The users of which you collect data is required to be part of the service or contract to fulfill unless you have a damn good reason not to and "we need to provide this service because we go belly up otherwise" won't fly, IMO. A legitimate interest would be stuff like "we will make backups of our data, ensuring that deletion requests are carried out upon restore, to continue providing service in case of disaster" or "we will log your IP temporarily because we need to provide essential network and information security"

[Laid out in https://gdpr-info.eu/recitals/no-40/]

j / k navigate · click thread line to collapse