Should free services be provided for sharing personal data?

Hogan Lovells
Contact

Hogan Lovells

In the judgment dated 7 July 2022, the Voivodship Administrative Court in Warsaw repealed the decision of the President of the Personal Data Protection Office ("the President of the PDPO"), leaving the authority to reconsider whether the processing of personal data for marketing purposes in exchange for obtaining a free service should be deemed to be in compliance with the General Data Protection Regulation ("GDPR") if the customer, prior to consenting to the processing of said personal data, was not informed of an analogous, alternative, paid offer. One should note that, under the GDPR, it is possible to offer discounts or free services in exchange for providing personal data, so long as an alternative offer, that does not require consent, has been made available to the data subject.

Landmark judgment

The judgment relates to an advertising campaign carried out in 2019 in which PZU Pomoc SA advertised the possibility for parents and legal guardians to benefit from an offer for free insurance for children during the holiday season. The promotional campaign, entitled “Wakacje z PZU Bezpieczne dziecko”, offered free insurance in exchange for the parent or legal guardian's consent to the processing of the minors' personal data for marketing purposes. The PZU group of companies, through the campaign and the data obtained, gained the ability to analyse the data, and at the same time, profile the needs and interests of its customers so as to be able to better tailor its offers in the future. However, those interested in the offer were not informed that they also had the option to take advantage of an analogous paid-for offer to insure their child if they did not wish to consent to the processing of their personal data for marketing purposes.

PZU, on the other hand, argued that customers had the possibility to conclude other insurances through an agent or at a PZU branch and, therefore, it was unnecessary to simultaneously inform the customers about such an alternative offer together with the presentation of the free insurance promotion. The President of the PDPO accepted these explanations and concluded that there was no violation of data protection laws.

What does this judgement mean in practice?

The judgment is not final which means that it can be amended or repealed by a higher court. However, it is now worth analysing the practices of personal data processing for marketing purposes in terms of:

  • making changes to the terms and conditions of offers that relate to free services in exchange for consent to the processing of personal data by indicating an alternative paid offer;
  • informing customers in advance of alternative options for an analogous service or benefits which would allow the consumer to take advantage of an offer, notwithstanding the lack of consent to the processing of personal data;
  • make such offers so that the consumer giving consent to data processing is voluntary, and that the consumer has a genuine and free choice as to whether or not to give such consent.

Existing practice and case law

Entities operating on both the Polish and EU markets, especially in the digital environment, have for many years been providing services in exchange for personal data shared with them. Some insurance companies have, for example, offered discounts on insurance if personal data such as phone numbers and email addresses are provided and consent to marketing communications has been given.

Regulators has been investigating the practice of exchanging personal data for services and insufficiently informing customers on more than one occasion. It is worth mentioning here, for example, about the German Antitrust Authority's decision (Case B6-22/16, decision of 6 February 2019) concerning Facebook's practice of not informing users sufficiently about their profiling by using cookies and data collected via Facebook. In exchange for personal data, which is a form of "commodity" according to the German Antitrust Authority, Facebook offers the possibility of using their website free of charge. After the Federal Court of Justice finally considered the case, Facebook was obliged to amend its terms and conditions.

It should also be noted that Directive No. 2019/770 of 20 May 2019 on certain aspects concerning contracts for the supply of digital content and digital services which has not, as yet, been implemented in Poland, implies the possibility of introducing a model in which digital content or digital services are also supplied even if the consumer does not pay the price but provides the trader with personal data. This personal data can be provided to the trader at the time of the conclusion of the contract or at a later stage, e.g. when the consumer gives the trader its consent to use their personal data that the trader can transmit or produce in connection with the use of the digital content or digital service. However, the Directive indicates that personal data must not be treated as a commodity and the legislation should ensure that consumers, in the context of such business models, are entitled to contractual remedies.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Attorney Advertising.

© Hogan Lovells

Written by:

Hogan Lovells
Contact
more
less

PUBLISH YOUR CONTENT ON JD SUPRA NOW

  • Increased visibility
  • Actionable analytics
  • Ongoing guidance

Hogan Lovells on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide