Landmark judgment
The judgment relates to an advertising campaign carried out in 2019 in which PZU Pomoc SA advertised the possibility for parents and legal guardians to benefit from an offer for free insurance for children during the holiday season. The promotional campaign, entitled “Wakacje z PZU Bezpieczne dziecko”, offered free insurance in exchange for the parent or legal guardian's consent to the processing of the minors' personal data for marketing purposes. The PZU group of companies, through the campaign and the data obtained, gained the ability to analyse the data, and at the same time, profile the needs and interests of its customers so as to be able to better tailor its offers in the future. However, those interested in the offer were not informed that they also had the option to take advantage of an analogous paid-for offer to insure their child if they did not wish to consent to the processing of their personal data for marketing purposes.
PZU, on the other hand, argued that customers had the possibility to conclude other insurances through an agent or at a PZU branch and, therefore, it was unnecessary to simultaneously inform the customers about such an alternative offer together with the presentation of the free insurance promotion. The President of the PDPO accepted these explanations and concluded that there was no violation of data protection laws.
What does this judgement mean in practice?
The judgment is not final which means that it can be amended or repealed by a higher court. However, it is now worth analysing the practices of personal data processing for marketing purposes in terms of:
- making changes to the terms and conditions of offers that relate to free services in exchange for consent to the processing of personal data by indicating an alternative paid offer;
- informing customers in advance of alternative options for an analogous service or benefits which would allow the consumer to take advantage of an offer, notwithstanding the lack of consent to the processing of personal data;
- make such offers so that the consumer giving consent to data processing is voluntary, and that the consumer has a genuine and free choice as to whether or not to give such consent.
Existing practice and case law
Entities operating on both the Polish and EU markets, especially in the digital environment, have for many years been providing services in exchange for personal data shared with them. Some insurance companies have, for example, offered discounts on insurance if personal data such as phone numbers and email addresses are provided and consent to marketing communications has been given.
Regulators has been investigating the practice of exchanging personal data for services and insufficiently informing customers on more than one occasion. It is worth mentioning here, for example, about the German Antitrust Authority's decision (Case B6-22/16, decision of 6 February 2019) concerning Facebook's practice of not informing users sufficiently about their profiling by using cookies and data collected via Facebook. In exchange for personal data, which is a form of "commodity" according to the German Antitrust Authority, Facebook offers the possibility of using their website free of charge. After the Federal Court of Justice finally considered the case, Facebook was obliged to amend its terms and conditions.
It should also be noted that Directive No. 2019/770 of 20 May 2019 on certain aspects concerning contracts for the supply of digital content and digital services which has not, as yet, been implemented in Poland, implies the possibility of introducing a model in which digital content or digital services are also supplied even if the consumer does not pay the price but provides the trader with personal data. This personal data can be provided to the trader at the time of the conclusion of the contract or at a later stage, e.g. when the consumer gives the trader its consent to use their personal data that the trader can transmit or produce in connection with the use of the digital content or digital service. However, the Directive indicates that personal data must not be treated as a commodity and the legislation should ensure that consumers, in the context of such business models, are entitled to contractual remedies.
