[wp-trac] [WordPress Trac] #43492: Core Telemetry and Updates

[WordPress Trac]

#43492: Core Telemetry and Updates
------------------------------+------------------------------
 Reporter:  xkon              |       Owner:
     Type:  enhancement       |      Status:  new
 Priority:  normal            |   Milestone:  Awaiting Review
Component:  Upgrade/Install   |     Version:
 Severity:  normal            |  Resolution:
 Keywords:  gdpr 2nd-opinion  |     Focuses:
------------------------------+------------------------------

Comment (by robscott):

 Replying to [comment:34 DavidAnderson]:
 > @robscott
 >
 > > 3 If we do not store the data, I don't feel we need to obtain consent.
 (opinion!!).
 >
 > Well, the paragraph from the GDPR which you just quoted clearly states
 that "processing" is the boundary (and makes no reference to "storage").
 As such, "Using the data for the purposes of processing the transaction
 (ephemeral storage) is not storage" is not germane, because the GDPR
 doesn't divide at that point, and does specifically identify "processing".

 I'm using that in reference to consent. Consent cannot be opt out. It must
 be opt in. Its not related to my opion on storage - which is about WHY is
 the data being stored? The only way this data can be personal data is as a
 package. The IP address is what it hinges on. If you shed this element,
 you've anonymized it.

 I can dig out one on "suitably anonymized data" if you'd like.

 {{{
 GDPR doesn’t apply to suitably anonymised data [Article 6, 4(e), Article
 25, 1, Article 32, 1(a)].
 }}}

 I would argue that the removal of IP / domain (anything else deemed
 potentially personal data) would be necessary process to suitably
 anonymize the data. For which, no consent is necessary.

 Not really sure we need a semantic argument on this point. I just made it
 poorly?

--
Ticket URL: <https://core.trac.wordpress.org/ticket/43492#comment:35>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform