Have you noticed the latest development in the placement of behavioural advertising? You have basically a binary choice between consenting to the processing of a "complex" bundle of your personal data for behavioural advertising purposes or paying a fee. After paying the fee, you can use the platform without being targeted by behavioural advertising.
Data protection authorities across a number of European countries recently addressed the "pay or consent" model. As there is no consistent European approach, the European Data Protection Board ("EDPB") issued an official opinion addressing this issue. While the EDPB does not reject this method of giving consent, it has also set a number of conditions under which the consent is valid. The pay or consent model is used by social media platforms such as Facebook and Instagram and by information platforms such as Seznam.cz
The pay or consent model must follow all the principles set down by the GDPR. It emphasises whether consent is freely given, informed and specific. It also evaluates whether there is an imbalance of power between the user of the platform and the platform owner, i.e. the personal data controller.
It is further assessed whether:
- by refusing to pay a fee, the platform user will be denied access to a platform or service that plays a significant role in his professional or personal life;
- the platform user would be significantly harmed by denying him access to the platform;
- the required fee, or fear of not paying the fee, does not prevent the platform user from making a free choice;
- the processing of personal data based on the platform user's consent is necessary for the performance of the contract, emphasising the primary use of other reasons for personal data processing;
- consent is granted for a "specific purpose" only; it should not serve as comprehensive consent for all possible scenarios necessary for the platform user to target the advertising;
- personal data is processed only to the extent necessary for the given purpose;
- there is an imbalance of power between the platform user (data subject) and the platform owner (personal data controller);
- the platform user is offered a "third equivalent alternative" that does not entail the payment of a fee.
The EDPB further stresses the special protection of children, who should not face behavioural advertising at all and should not be confronted with the choice between paid and free use of the platform.
The controller should provide the platform user with the possibility to withdraw his consent in the same simple way it was granted. Consent should not be granted for an indefinite period, but should instead be renewed regularly, ideally every year.
If we look at the EDPB's opinion critically, it leaves quite a few legal issues open, requiring ad hoc assessment, and provides rather unspecific guidance. The following are subject to ad hoc assessment:
- whether a platform user suffers harm by denying him access to a platform; how to quantify such harm;
- the correct amount of the possible fee to access the platform, what is too much and what is too little;
- the correct equivalent alternative to access the platform;
- the length of time a platform user (data subject) must use the platform to be able to cite the lock-in or network effect (see below).
The EDPB's opinion assumes that a platform user has an absolute right to access the platform because he has already established a social network and other useful contacts, and orders good and services. This is known as the lock-in or network effect.
The EDPB's view recalls the competition doctrine of "essential facilities". But even access to the necessary infrastructure is not provided for free. What is the value of free enterprise? The EDPB points out that the right to personal data protection is protected by the Charter of Fundamental Rights of the European Union, but so is freedom to conduct a business. A platform founder spends plenty of time administering, running and improving his platform.
The EDPB's guidance should help national data protection authorities answer legal issues relating to pay or consent models. Additional answers may come from the Court of Justice of the European Union, which was asked to interpret the pay or consent model. It will show whether personal data protection is the first right among equals.
