Legally protesting places requiring you to use an app (personal data, restaurants etc)

[Idontwanttoffs]

I'm intending to complain about somewhere we've been staying (big holiday place) where you couldn't do ANYTHING without using an app and providing your phone number, email etc etc etc.

I don't fucking want to give you my personal details every time I buy a coffee. Why should I use a QR code that opens your phone to scammers, gives them your cookies to sell to advertisers etc. I just want to pay for my coffee!

I've scanned the GDPR guidance and so far I'm going to protest that:

• They don't make it clear why they're asking for personal data or how they're using it
• They're not only collecting the personal data they need
• I wasn’t given the right to object
• My right to prevent automated processing and profiling wasn't respected
• Querying what data is collected (eg cookies, my phone’s advertising IDD number, and device fingerprinting))
• Protesting that, with privacy threats, equity concerns, and security risks of QR codes, no business should require anyone to scan a QR code or make it difficult for people to continue to use a physical menu if they want one.

Anything else I could add? Would appreciate your help in making it a scary email that I will undoubtedly raise with the ICO following an inevitable fluff response.

Bump!

Did you have a good holiday? Bet it was lovely with the amazing weather we've been having.

Discriminating against people who are unable to use a smart phone, e.g. due to cognitive issues or physical disability.

Totally with you on this, OP.

Thanks, @Antarcticant! Good point. Will add and you're very right

We did, thank you @Cloverforever . But the app thing genuinely marred eating out because it was so bloody difficult and trying to work it out on top of looking after small children - in the heat! - was pretty unpleasant.

Plus it's the principle of the thing!

Is this in England?

what would happen if you arrived and didn't have a suitable device? My phone is too old for QR codes, I think.

i presume they don't warn in advance or you'd not go and they'd lose lots of business generally?

PS maybe contact Big Brother Watch who will be interested to hear it.

A QR code does not give them cookies to sell to advertisers, nor does it open your phone to scammers unless it takes your phone to a malicious website, which is not going to be the case here, particularly if you are using their app to scan the QR codes. If you have to use their app to scan the QR code, it simply contains some data for the app to use.

An app does not have any visibility of your fingerprint or other biometrics - that is handled entirely by the operating system (Android or iOS).

You have no evidence that they are doing anything that falls under the automated decision making and/or profiling headings. Simply fulfilling orders you place through their app does not qualify.

You do not have the right to object if they are using your data to fulfil their contract with you. The right only applies if they are using your data for direct marketing, or their basis for processing is legitimate interests or public task.

If they have a privacy statement on their website and the app (or its listing in the relevant app store) includes a link to that statement, they have fulfilled their obligations in terms of informing you of what data they are collecting and how they will use it.

You don't say what you mean by "etc, etc, etc", but phone number and email for fulfilling a contract is perfectly acceptable. What data are they collecting that you think they don't need?

I'm afraid that, if your "scary email" is similar to your post, the only effect it will have is to raise a laugh for their data protection team. Unless you have something a lot more substantial than this, the ICO will not be interested.

Prh47bridge "If you have to use their app to scan the QR code, it simply contains some data for the app to use."

how does that work please? What data do these things exchange?

Also those with learning needs. My DC can use a smart phone - much better than me - but wouldnt have a clue as to what the privacy notice, or indeed any privacy notice, was telling them. Their English language comprehension is at/above minimum adult literacy level (about 8 1/2 years) but most adult privacy notices are clearly set much higher. So do look at the privacy notices particularly including engagement for under-18s.

@prh47bridge That's all helpful, thanks and will help with framing as there were specific circumstances I can add (e.g. when I asked why they wanted my room number, staff said for marketing purposes and were arsey about my refusing to give it). I can't see anything on the website about that

A QR code is just a way of storing an URL to make it machine-readable. (In this usage anyway.)

All it does is give your phone an URL to go to a site where you can place an order.

A QR code, like any other barcode, simply contains some encoded text - up to 4,000 characters. There are some standard text formats that are instructions to the phone to do something. For example, if the QR code contained:

WIFI:S:guestnetwork;P:p@ssw0rd

your phone would interpret that as telling it to join the wifi network "guestnetwork" using the password "p@ssw0rd". Similarly, there are standard ways for a barcode to tell a phone to go to a website or download an app.

If a holiday camp, for example, builds an app to allow you to order things from a menu, they could put a QR code by each item containing, say, a description of the item and its cost along with something that makes it clear it is one of their barcodes - something like:

"holidayapp"{"item":"beans on toast","cost":"5.00"}

This would tell the app that this is one of its QR codes (holidayapp) and that the customer wanted to order beans on toast at a cost of £5.

If the app scanned any QR code that wasn't for it (e.g. the QR code above), it would ignore it as it didn't contain the "holidayapp" tag. Because the app was scanning the QR code, the phone won't do anything with it either - the phone will only react to QR codes scanned with the camera app or with a special QR code reader.

There are apps available that will scan any barcode and show you the text it contains.

I struggle to see how your room number is useful for marketing purposes. I suspect the staff you spoke to may not know exactly how the app works or why they need your room number. The most obvious reasons for wanting your room number would be to make sure you are billed correctly (if the stuff you order gets added to your room bill, or if they automatically use the credit card you used to pay for the room), and/or to make sure anything you order goes to the right place. However, I've no idea where you were staying or what their app does, so I accept that I am guessing.

Thank you
so, given that I don't connect to a network without checking first, it already sounds like a bad idea.

the simple reality is that many of us don't want to use something we don't understand, especially when the alternatives are so easy.

i really hope we can fight off this.

OP you might be interested in reading Stolen Focus by Johann Hari. In spite of the marketing, it looks at these problems a lot.

Even though it has 4,000 characters, a QR code can only carry a single message. It can't invite your phone to join a network and do something else at the same time. A QR code can only invite you to join a wifi network if you scan it with your camera app or a QR code reader. If the QR code is designed to be scanned by a specific app, it cannot invite you to join a wifi network as well.

Note my repeated use of the word "invite" in that. Your phone will not automatically join a wifi network just because you scan a QR code, nor will it automatically follow any link in the QR code. It will always ask you first.

I would not trust anything written by Johann Hari. Stolen Focus contains claims that are not supported by any evidence. misrepresents the results of some studies and presents mainstream psychological concepts as niche ideas that he has discovered.

You say that you couldn't do "anything" without an app.

Were any of those "anything's" mandatory in order to be able to stay on the location or were they all optional that you could opt in and out of if you didn't agree to their method of service?

Thanks prh
the problem is, I can't check any of this myself IYSWIM

I don't think he's arguing that he's "discovered" anything but I'm not sure what is faux naïveté

I just mention it to OP because it did give me some hope that this crap can be beaten.