karuvapatta:

holomasque:

Wow tumblr, ya really fucked up implementing the GDPR. We’re supposed to be able to ‘opt-in’ to allowing our data to be used, not have to deselect three hundred and twenty something “partners” that we don’t want using our data, and then going into the privacy settings and finding out that Cookie Consent MUST  be enabled in order for you to be able to use tumblr, with no way to turn it off and that if you turn it off it leads you back to the page where you have to deselect the “partners” all over again because they turned them back on!

UPDATE:

I got a response to a complaint I sent in about it. Apparently it’s a bug. Do I believe that? Not really. If they don’t sort this shit out in the next day or two , I’m just going to report them to the Data Protection Commission (DPC).

Some choice quotes if you do 😀

(32) Consent should be  given by  a  clear  affirmative act  establishing a  freely given, specific,  informed  and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box  when  visiting an  internet  website, choosing technical settings for  information society services  or  another statement or  conduct which  clearly indicates in  this  context  the  data  subject’s acceptance  of  the  proposed processing of  his  or  her  personal data.  Silence, pre-ticked  boxes  or  inactivity should not  therefore  constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

And Article 7
“Conditions for consent”

:

 
1.  Where processing is  based on  consent, the  controller shall  be  able  to  demonstrate that  the  data  subject has consented to processing of his or her personal data.

2.  If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for  consent shall  be  presented  in  a  manner which is  clearly distinguishable from  the  other  matters,  in  an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.

3.  The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

4.  When assessing whether consent is  freely given, utmost account shall  be  taken  of  whether, inter alia,    the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.