I'm not sure the new form is GDPR compliant
Tetiana Kremnova
You did a step in the right direction by unchecking the "i have read and accept term of use" pre-checked chekbox but you did two step backwards with this "when you tap the button, all the checkboxes will be checked automatically".
According to GDPR "consent must be explicitly obtained" and checking automatically the checkboxes does not mean that the consent was given. If you want to be compliant the first checkbox should say "I have read and accept terms of use and privacy policy", the second field should be about getting communications from us.
That separation is NEEDED because you need one consent to process user's data to create the loyalty card and another one to communicate with the user.
Think about realy loyalty cards, the ones in the real world. User gives you his details to get the card but can also decide if he wants to receive emails from us.
I understand that communicating with the user is part of our proposition so if he doesn't opt in to receive communications from us you could refuse the service but AT LEAST you should remove the automatically check of checkboxes to be compliant.
Link to skool discussion: https://www.skool.com/boomerangme/im-not-sure-the-new-form-is-not-gdpr-compliant
Y
Yaroslav Luzin
We've faced the same issue. Adding the legal basis here, as support asked, so the legal team has everything in one place.
What happens: on the card install page, the "I agree that my personal data can be used and provided for direct marketing purposes" checkbox gets ticked automatically when the customer taps "Get the card", even if the customer unticked it and even if the business has switched it off in the card settings. The setting only controls whether the checkbox is shown, not whether it is ticked.
Why this is a problem in the EU/UK:
- Consent must be an active, unambiguous action. Pre-ticked boxes, or boxes ticked automatically on submit, are not valid consent: CJEU, Planet49 (C-673/17); GDPR Recital 32.
- Consent must be clearly distinguishable from other matters (GDPR Art. 7(2)) and freely given. It is not freely given if the service cannot be obtained without agreeing to marketing (Art. 7(4); EDPB Guidelines 05/2020 on consent). Overview: https://gdprhub.eu/Article_7_GDPR
- Email and SMS marketing to individuals requires prior consent under the ePrivacy Directive (Art. 13), with the soft opt-in for existing customers only if the person is given a clear chance to refuse when their details are collected. Auto-ticking removes that chance.
The liability sits with the businesses as controllers, and with the agencies that set the cards up for them. Fines for small businesses are often lower, but the ceiling for consent violations is €20M or 4% of global annual turnover, whichever is higher (GDPR Art. 83(5)). And a few complaints against one business could put the same flow under scrutiny for everyone using it in the EU and UK.
What would fix it (no change to the card or Wallet notifications):
- If a business switches the marketing checkbox off, it stays off and unticked, independent of the terms checkbox and the install button.
- Marketing consent is a separate, optional, unticked checkbox that the customer ticks themselves, and the choice is stored per card.
Chris
Tetiana Kremnova Have you heard any updates?
S
Sumolingo
Chris Hopefully BM team will reply here, i'm waiting for an update too!
Tetiana Kremnova
Chris not yet. I hope they will finally get this right. I'm talking about GDPR issues since years.
Chris
Mike Nosov
Is their an update on this?
Samantha
I am really concerned about this. I nearly signed someone today but this has put them off. (I’m uk based and some people seem really worried about it)
S
Sumolingo
Samantha you are not the only one concerned. If you try to do business with any company that's bigger than the usual mom shop and pop you'll be discarded because of this. What Tetiana suggests not only is correct but it's also very straightforward way to be compliant: you add "privacy policy" text in the first consent bunding the processing of personal informations with terms of use and you don't automatically check the boxes. That's it.