this post was submitted on 07 Jan 2024

61 points (93.0% liked)

Asklemmy

43945 readers

585 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

Open-ended question
Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
Not ad nauseam inducing: please make sure it is a question that would be new to most members
An actual topic of discussion

Looking for support?

Looking for a community?

Lemmyverse: community search
sub.rehab: maps old subreddits to fediverse options, marks official as such
!lemmy411@lemmy.ca: a community for finding communities

~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~

founded 5 years ago

MODERATORS

If there is no "Privacy Policy" and "Terms of Use" section on the site, what does it mean? (lemy.nl)

submitted 10 months ago by Sticker@lemy.nl to c/asklemmy@lemmy.ml

23 comments fedilink hide all child comments

I found a handy site for taking notes, but everything it says about the privacy of this one:

"Anonymous by default, no adverts. We offer a high level of privacy for both writers and readers. You don't need to create an account to post something. There are no adverts on the entire page and we don't use any social media scripts. You can rest assured that information about your activity on the site will not be used by advertising companies or social media."

This is in the "About" section.

There is no information about what information the site collects about the user.

you are viewing a single comment's thread
view the rest of the comments

[–] maynarkh@feddit.nl 33 points 10 months ago (20 children)

Legally, it should mean no personally identifiable information is collected, since they are not accurately described. In practice, I'd expect at least IPs to be logged, but not used meaningfully. This is of course if the site services the EU.

[–] Dirk@lemmy.ml 3 points 10 months ago (19 children)

If the site services the EU and does not have a privacy policy it’s downright illegal according to the GDPR.

Art. 14 GDPR, “Information to be provided where personal data have not been obtained from the data subject”:

Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information […] the identity and the contact details of the controller […] the purposes of the processing for which the personal data are intended […] where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation …

https://gdpr-info.eu/art-14-gdpr/

[–] PermanentlyJetlagged@lemmy.ml 15 points 10 months ago (2 children)

Is it just me or does this not make sense? It says you must declare the purposes of the processing for which personal data are intended, but this is under the section for when no personal data is collected. How does that work?

[–] sudneo@lemmy.world 3 points 10 months ago (2 children)

personal data have not been obtained from the data subject

Reads to me like data that I (data subject) did not provide myself, but that the processor collects. I guess an example could be IP address.

[–] Max_P@lemmy.max-p.me 4 points 10 months ago (1 children)

That's what we've been taught at work, and also my general understanding of it.

You don't need a policy or a banner if you don't need to inform and gather consent from the user. It's just that nearly everyone does, so nearly everyone needs one. And big companies can't even begin to imagine one would not collect any data at all. So Google and Apple both require a policy to publish an app, even if it just says "we don't collect anything".

It may reassure users however to be explicit that you don't collect anything, since now people assume the worst about everyone, especially when there's some form of company involved.

But if your site is just static HTML, there's no user accounts and you don't collect any statistics and have server logs turned off, you're not collecting or processing any personal data. So you're good. You can't be sued for processing data you don't have.

Companies also tend to prefer to side with caution: you're better off doing more than is strictly required than risk a lawsuit. The GDPR is pretty vague, so you might as well have one to cover your ass.

[–] Dirk@lemmy.ml 2 points 10 months ago (1 children)

IP addresses are seen as personal data. So if you're a sane person who does logging and analyzes the result, you need a privacy policy.

If you embed external fonts/scripts/images/etc. you also need one.

[–] CallumWells@lemmy.ml 1 points 10 months ago (1 children)

Are they? I would have thought that the IP address of someone accessing a site is public information.

[–] Dirk@lemmy.ml 2 points 10 months ago* (last edited 10 months ago) (1 children)

IP addresses are considered personal data.

The data subjects are identifiable if they can be directly or indirectly identified, especially by reference to an identifier [...]. Since the definition includes “any information,” one must assume that the term “personal data” should be as broadly interpreted as possible. This is also suggested in case law of the European Court of Justice, which also considers less explicit information, [such as] IP addresses.

https://gdpr-info.eu/issues/personal-data/

The whole article is a great read, btw.

"Personal data" (and thus the protection of it and how organizations servicing EU citizens have to handle them) is much, much, much, more than just your name.

[–] CallumWells@lemmy.ml 1 points 10 months ago

I kinda think that the IP address is public information when you go to a site still. Since it's needed to get data back to you and you're requesting to get data back. But maybe I'm just a bit too old and stuck in the thinking of the phone book and such.

[–] OhNoMoreLemmy@lemmy.ml 1 points 10 months ago (1 children)

More generally any personal data obtained from a third party. E.g. if you're generating a credit score you might contact someone else with a record of financial transactions.

[–] sudneo@lemmy.world 2 points 10 months ago

Yeah, that sounds even better.

load more comments (16 replies)