Include a section about Mauritian DPA article 24 #71
Conversation
Mauritius DPA was inspired by the GDPR but has some ambiguities.
There was a problem hiding this comment.
Thank you, @loganaden!
As GPC is intended to convey a generate request that data controllers limit the sale or sharing of the person's personal data to other data controllers, ...
Do you mean "general request"? Otherwise, what do you mean by "generate"?
Mauritian regulators may deem GPC to constitute a legally binding invocation of Article 24 rights. However, there might be ambiguities as there is no explicit mention of global opt-out mechanism winning over a direct consent to a specific sharing request on a specific site.
Is it possible to make this statement a bit more specific as to which cases GPC applies to and for which there is ambiguity? For example, would the following be an accurate description:
Mauritian regulators may deem GPC to constitute a legally binding invocation of Article 24 rights. That would be the case if people's GPC opt out preferences are their only known opt out preferences or their GPC opt out preferences are in line with any other opt out preferences they invoked. However, in case of conflicts there might be ambiguities as there is no explicit mention of global opt-out mechanism winning over a direct consent to a specific sharing request on a specific site.
We are trying to make this as actionable as possible. Feel free to write as you see fit (if it can be made more precise).
My bad. Fixing this.
Agreed.
|
| @@ -104,6 +104,8 @@ Virginia and Utah have privacy laws that grant people the right to opt out but d | |||
|
|
|||
| The European Union and European Economic Area have the General Data Protection Regulation (GDPR). This law provides for a number of bases for data processing, including consent and the "legitimate interest" of the data controller. For processing pursuant to a company’s "legitimate interest," Article 21 of the GDPR offers people an ability to object, or opt out, of such processing. As GPC is intended to convey a general request that data controllers limit the sale or sharing of the person's personal data to other data controllers, European regulators may deem GPC to constitute a legally binding invocation of Article 21 rights. To date, no European regulator has explicitly made this case, though some commentators have argued that [GPC has legal effect under the GDPR](https://berjon.com/gpc-under-the-gdpr/). | |||
|
|
|||
| Mauritius, an African country, has the Data Protection Act (DPA). The DPA was inspired by the GDPR. The law provides for a number of bases for data processing, including consent and the "legitimate interest" of the data controller. For processing pursuant to a company's "legitimate interest", Article 24 of the DPA offers people an ability to opt out of such processing. As GPC is intended to convey a general request that data controllers limit the sale or sharing of the person's personal data to other data controllers, Mauritian regulators may deem GPC to constitute a legally binding invocation of Article 24 rights. That would be the case if people's GPC opt out preferences are their only known opt out preferences or their GPC opt out preferences are in line with any other opt out preferences they invoked. However, in case of conflicts there might be ambiguities as there is no explicit mention of global opt-out mechanism winning over a direct consent to a specific sharing request on a specific site. | |||
There was a problem hiding this comment.
This looks clear enough w.r.t. my worry in #68.
Mauritius DPA was inspired by the GDPR but has some ambiguities as mentioned by Jeffrey Yasskin:
"This is closer to being about opt-outs, but it doesn't say that a globally-configured opt-out wins over a direct consent to a specific sharing request on a specific site. Without that statement, a controller can pretty easily prove that the data subject consented to their particular processing even if they told their browser to object in general. ("We saw a Sec-GPC: 1 header, and then we asked if they wanted to override that for our site, and they said yes, and they never clicked this other button on our site withdrawing that consent.") At best, this winds up saying that if the user turns on GPC after some sites had gotten consent, those sites need to re-request consent. (Yay, more consent banners.)"