Data Protection Day: Concerns about "digital only" and forced digitization

Contents

The call for a "digital only" strategy from the government of Federal Digital Minister Volker Wissing (FDP) has been met with opposition. Such an approach would "lead to unconstitutionality", criticized Heribert Prantl, columnist for the Süddeutsche Zeitung, at a symposium of the German Federal and State Data Protection Conference (DSK) in Berlin on Tuesday to mark European Data Protection Day. Considering the increasing digital constraints that are burdening "everyday life, big and small", Prantl called for the prohibition of discrimination standardized in Article [3] of the German Basic Law to be extended to a fundamental right to analogue access to services of general interest.

The responsible citizen must have the right to use essential services without a smartphone, Prantl explained. The latter constituted a "surveillance architecture" and acted as a pocket spy. Anyone who does not want to submit to the data transfer regime of Google, Amazon, Meta, Apple and Microsoft is not an enemy of technology, but a connoisseur of the matter. Many apps pass on information to tracking companies. This makes it easy to track down "trade unionists, peace activists or homosexuals". The evaluation of location data feeds movement profiles.

If democracy is being completely distorted, it is time to return to the core of protecting people in the digital world, the author postulated. In this sense, data protection is the "basic fundamental right in the information society". After all, data "is an expression of personality, not waste". It should not simply be reused and recycled in digital commercial recycling centers.

DB gives in on saver price tickets

Jutta Gurkmann from the German Federation of Consumer Organisations (vzbv) cited BahnCard, ticket and appointment bookings and the elimination of cash payment options as examples of forced digitization. In existential areas such as healthcare, mobility and finance, there must be analog alternatives. Digitalization can promote participation and make services more widely available. However, there is a growing gap to those "who are left behind" or who deliberately decide against digital solutions for reasons of data protection. This threatens "digital exclusion".

With DHL packing stations that do not work without a smartphone, semester and Germany tickets via smartphone, Congstar bills only via app and menus only via QR code, Rena Tangens from Digitalcourage lamented a creeping process of forced digitalization. Digitalcourage has already put a digital constraint detector online in 2021. The organization is receiving more and more complaints from citizens who feel compelled to hand over data and constantly carry and maintain a mobile device. To use official apps, you have to register with Apple or Google. Free app store alternatives are generally not permitted. This is often accompanied by the requirement to deal with "poorly programmed software".

Alexander Roßnagel, the Hessian Data Protection Commissioner, appealed to digital-only advocates to show consideration for all those "who cannot or do not want to go along". An app requirement with the obligation to disclose personal information is not compatible with the General Data Protection Regulation (GDPR). However, the practitioner sees no ideal solution for implementing this requirement, as the question of proportionality always arises. For example, it is reasonable for a doctor to answer the phone for at least two hours a day. Making appointments via an AI chatbot, on the other hand, makes him cringe, as all data is collected and transferred to countries such as the USA. With good arguments, his office was able to get Deutsche Bahn to sell saver fare tickets again without providing an email address.

Data protectionists see a challenge for legislators

Shortly before Christmas, the DSK adopted a resolution in which it urged that human-centric digitalization be ensured in the provision of services of general interest. It states: If the use of central services, for example in the areas of transport, energy and water supply or culture, required the use of electronic communication channels such as the internet, an app or the opening of a digital account. This could lead to certain people being excluded. This would affect anyone who is unable to use digital technology due to physical or mental impairment, age, lack of technology or lack of resources. Or who does not want to disclose their data to exercise their fundamental right to informational self-determination.

In addition, it should be noted that only the processing of personal data necessary for the performance of a contract is permitted in accordance with Article [6] GDPR. This relates to the main object of such an agreement – Data processing must therefore be essential for the use of the service of general interest. Appropriate measures for data minimization by privacy by design must be taken as early as the planning stage of digitization projects – and during their implementation –. The DSK appeals to federal and state legislators to examine accompanying measures in the area of services of general interest.

Economy: No entitlement to duplicate structures

Giessen-based constitutional law expert Steffen Augsberg was skeptical about a fundamental rights approach. He said that collective legal positions such as freedom of competition, openness to innovation and administrative efficiency should also be considered. In the case of companies, there is "no fundamental normative obligation to participate". Even in the case of monopoly-like structures, they could deliberately exclude potential customers, the lawyer emphasized. Facebook, for example, is not forced to set up an analog platform model. The situation is different for core state tasks such as conducting elections. But even there, a push towards digital is often not a compulsion in the legal sense.

"Redundant infrastructures are always very, very expensive", said Nico Lüdemann from the German Association of Small and Medium-Sized Enterprises (BVMW), referring to analog and digital processes. This is especially true when one is only used very little, as the use of mobile devices is standard. A ticket, for example, would then realistically quickly cost 20 euros more, which could topple the entire model. The consultant therefore advocates reconciling the entrepreneurial drive to bring innovations to market with the GDPR, which is "great" in principle, from the outset. Pools with anonymized data should be defined for big data analyses, for example. At the same time, the GDPR must be interpreted uniformly across the EU.

(ds)