|
|
|
|
|
|
by robin_reala
1482 days ago
|
|
|
That’s not nuanced enough. Information isn’t just information to a user, it’s information combined with purpose. A user would expect the USPS to use address data to deliver them mail. They would expect the USPS to sell their address data for the purpose of (gratuitous hyperbole) targeting a drone strike. In this case, I would doubt the user would expect their address data to be sold by the USPS for direct mail shots. This is the essence of GDPR really. The legal basis of “legitimate interest” means you don’t have to seek consent because of course a user would expect you to process that data in the course of the provided service. To go outside of that service you need to get explicit and informed opt-in consent. |
|
|