This is a real problem. What's the alternative? The TOS does need to express the desired purpose and to hold up in court if required. Some licenses are much simpler than others, but some are necessarily complex. The GPL is much shorter than most click-through TOSs, but an average user still isn't going to read it.
German law requires to use opt-in, i.e. the default setting of agreements to transfer data to other parties must be 'no' (or the checkbox must be empty). That way, it is very easy to make sure there is explicit consent to transfer of data, and the service provider can't hide it in the TOS. Of course, the service provider is also free to limit or close its services to users that do not consent.
That is actually what the German data protection watchdog refers to: the WhatsApp setting that controls if the data is transmitted is by default enabled (opt-out), but should be disabled (opt-in).
I don't think this is very useful in most cases. Suppose a service requires data transmission to operate, either intrinsically, or it just chooses to require it. It displays a checkbox, unchecked by default, and unless the user checks it, the service isn't going to work; checking the checkbox is functionally equivalent to the "I Agree" TOS button. I expect users will check the checkbox without reading any explanations, just as today they click "I Agree" without reading anything.
And if this is a legal requirement, then service providers are greatly incentivized to require data transmission as a condition of using the service. If it's optional, then very few users will go into settings and enable it. If it's mandatory, then all users are going to agree, in order to use the service.
> Suppose a service requires data transmission to operate, either intrinsically, or it just chooses to require it
No services really requires data transmission. It's just the owners have decided to run it that way.
> I expect users will check the checkbox without reading any explanations, just as today they click "I Agree" without reading anything.
Within EU Data Protection law, you have to get "freely given, informed consent" for things. And a checkbox which links to 30 pages of legalese does not necessarily count as informed consent. Just because your users clicked a checkbox/clickthrough, that doesn't mean you're in the clear legally.
> if this is a legal requirement, then service providers are greatly incentivized to require data transmission as a condition of using the service
Unrestricted data transmission (and processing) is not legal in the EU. EU fundamental rights law specifies that. So you can't necessarily create a service which from the start requires that sort of agreement.
Oauth popups is a good example of how to give consent. They are opt in and usually say exactly to whom you share information and what kind of information they will get.
German data law is very strict, so yes, it is useful:
- You can only take as much as you need
- You cannot ask for data for one thing and use it for another
- You have to clearly state what data you will use for what purpose
- The opt-in has to be distinct from other opt-ins (so, 100 pages of EULA and then a checkbox "I accept" doesn't cut it)
The only problem here is that the penalities for breaking the data protection laws aren't very high .. I'd like to see percentages of a companies revenue.
Technically this law is European-wide, not just Germany. It's from the EU, and the Charter of Fundamental Rights of the European Union (Basically the EU's Bill of Rights). Article 8 lists your personal data rights.
The EU/US Safe Harbour was invalidated by the Court of Justice of the EU, after an Austrian person took a case against Facebook in Ireland.
> The only problem here is that the penalities for breaking the data protection laws aren't very high ..
DPAs have the authority to force companies to stop doing things. They might not be able to fine Facebook a meaningful amount, but they can get a court order to stop them doing it.
> I'd like to see percentages of a companies revenue.
> The TOS does need to express the desired purpose and to hold up in court if required
Why? What if the "desired purpose" (desired by the company) is illegal? Then such a ToS/contract is not, and should not be legal. What the Data Protection agency is doing here, is saying that what WhatsApp/Facebook are doing is illegal.
> The GPL is much shorter than most click-through TOSs
The GPL is a copyright licence so doesn't require consent. It's a different type of "licence" from most ToS's.
> Why? What if the "desired purpose" (desired by the company) is illegal?
My comment was badly worded. What I meant was that, if the license's meaning was disputed in court, the court should agree that it meant what the company intended for it to mean. And that is one purpose of unclear legalese in TOS. (Deliberate obfuscation, and increasing lawyers' fees, are also purposes, but not the only ones.)
> What the Data Protection agency is doing here, is saying that what WhatsApp/Facebook are doing is illegal.
It's saying WhatsApp didn't get the user's consent in a legal way. It is not saying that what WhatsApp wanted consent to is itself inherently illegal. My comment was about the general problem of meaningful agreement to online click-through contracts.
> The GPL is a copyright licence so doesn't require consent. It's a different type of "licence" from most ToS's.
It's the same in the relevant respect: that to use the GPLed software in certain ways, e.g. to install copies of it on many computers (which counts as copying), you have to do certain things outlined in the license. And since copyright law by default forbids such actions, the user has to read the license to know they can do it.
> What I meant was that, if the license's meaning was disputed in court, the court should agree that it meant what the company intended for it to mean.
And my point is that sometimes what the company intends/wants is illegal. And the courts should
For example, a company might want employees to sign away rights to minimum wage. We can clearly see what the company intends in that contract, but the courts will not agree with it.
"Contracts are sacred and unbreakable" is an ethical/legal stance associated with libertarianism, and it is not what many countries follow.
Yes, of course, some things are illegal and cannot be agreed to in contracts. I'm not saying contracts should be sacred. I'm saying the contract's meaning should be as clear as possible so courts will agree the license meant what the company intended it to mean. The court can still say the license is illegal or unenforceable, but there should not be a dispute whether it means one thing, which is legal, or another, which isn't.
