Several large online services have begun to demand payment if you do not consent to your data being used for behavioural advertising. The data protection authorities of Norway, the Netherlands and Hamburg have asked the European Data Protection Board (EDPB) to issue an opinion on the matter.
An increasing amount of services have started to provide users with a choice: Consent to tracking and profiling for marketing purposes, or pay a fee instead. Failure to choose one or the other can lead to exclusion from the service.
At the same time, the GDPR requires that any consent to the use personal data must be freely given. The question is to what extent “consent or pay” models comply with this requirement.
While this is a matter of principle and general application, there is currently no harmonised approach on the European level. Therefore, the data protection authorities of Norway, the Netherlands and Hamburg have requested the EDPB to give an opinion on the issue under Article 64(2) GDPR. Such an opinion will inform enforcement of the GDPR throughout the EEA.
– This is a huge fork in the road. Is data protection a fundamental right for everyone, or is it a luxury reserved for the wealthy? The answer will shape the internet for years to come, says Tobias Judin, head of the international section at the Norwegian Data Protection Authority.
The EDPB should issue its opinion within eight weeks. However, if necessary, the deadline can be extended by another six weeks, potentially giving the EDPB 14 weeks in total to process the matter.
The GDPR aims to give individuals as much control over their personal data as possible. Therefore, in many cases, businesses need to ask for consent before tracking and profiling their users. As mentioned above, consent must be freely given. This means that users should not be pressured into consenting, and they should not experience detriment if consent is refused.
Some data protection authorities in Europe have allowed the charging of non-consenting users under certain circumstances, while other have not. The European Court of Justice has also mentioned this kind of model, but without elaborating under which circumstances it may be legal. At the same time, the European Court of Justice has emphasised the importance of consent being freely given.
– We need legal clarifications and a harmonised approach. The EDPB is the right forum to obtain this, says Judin.
The choice between consenting or paying may be particularly problematic when it comes to large and popular online services with many users. Users may feel dependent on such services, for example because all their friends or colleagues use them, or because that is where important information or popular content is shared. An important question is whether this type of circumstances implies a pressure to consent, or if withholding consenting leads to detriment, especially for low-income users.
Regardless of the clarifications to be provided by the EDPB, it will still be possible to engage in marketing as a source of income. That is because more data protection friendly forms of marketing may not require consent at all.
– Many companies believe that surveillance-based advertising generates higher income other forms of marketing. Therefore, many companies would prefer to continue with this type of advertising. However, this is not a question of generating an income, but rather about maximising profits, Judin adds.