Number-or-be-tracked: Next triple step to the ECJ
Austrian Federal Administrative Court considers bundled consents to be inadmissible and provides two important notes on data protection supervisory authority.
(Image: Photo Kozyr/Shutterstock.com)
Are websites allowed to present their users with the binary choice of either consenting to extensive advertising and tracking purposes or alternatively paying for freedom from advertising and tracking? This "pay or consent" or "pay or okay" model is being considered by courts in various European countries - and particularly often by media sites. In Austria, the Federal Administrative Court has now ruled in the case of the online offering of the daily newspaper Der Standard – and is demanding significant improvements.
A user and the newspaper's publisher had both taken legal action against a decision by the Austrian data protection supervisory authority, which found the model to be permissible in abstract terms – but not in its concrete form. The user, who had originally initiated the proceedings with the data protection supervisory authority in 2018 and was represented by the data protection NGO Noyb, had argued, among other things, that he had not given his consent to any possible profiling. There was no option for "granular", i.e. finer, consent for processing purposes. The publisher, in turn, objected to the data protection supervisory authority's decision, according to which its model was inadmissible in the version in question. Noyb has also lodged similar complaints with the data protection supervisory authorities in other countries, including Germany, including against heise.de.
In its ruling, the Austrian Administrative Court has now followed the opinion of the data protection supervisory authority and decided that consent for several purposes also requires separate consents. However, such a bundling of different processing purposes would impair the freedom of decision and thus render the consent ineffective. "This granularity is closely related to the requirement that consent must be given for the specific purpose", according to the text of the ruling.
The court also clearly rejected the argument that advertisers only want advertising that can be analyzed: "No legal argument within the meaning of the General Data Protection Regulation," it said. The court did not find a close connection between web analysis for the operation and optimization of the provider's own offering and digital and personalized advertising measures plausible. And the provider was also jointly responsible for plug-ins integrated by the provider.
No media privilege for advertising tracking consent
The representatives of the media company also argued in the alternative and to distinguish themselves from players such as Meta that their form of "pay or okay" was also permitted, as Article 85 of the General Data Protection Regulation contains the so-called media privilege. The judges acknowledged that this was correct: the General Data Protection Regulation contains an exception for journalistic activities and this must be interpreted broadly. However, the processing challenged here could not be classified as a journalistic purpose – even if it indirectly served to finance journalism. The lack of granularity of the consent alone meant that it was ineffective.
Data protection supervisory authorities may change their minds
The judges also gave a special pointer to another piquant question. In 2018 and 2019, the data protection supervisory authority had taken the view that the model used by the standard was legally permissible – and only later changed its mind. The ruling states that "the data protection authority is not bound by a particular legal opinion that it has held in the past." In other words, companies remain responsible for complying with the law even if a data protection authority temporarily misinterprets it itself.
The judges also gave the Austrian data protection supervisory authority itself a clear warning: they had not responded appropriately to the original complainant's submissions. It is true that there is no right to a specific measure that a supervisory authority must take to remedy a breach of data protection law. However, the supervisory authority had not dealt with the complainant's arguments with due diligence and had thus itself broken the law.
Appeal on key issue could involve Luxembourg for clarification
Should the publisher appeal against the ruling, the issue could soon be referred to the European Court of Justice (ECJ). The Federal Administrative Court in Vienna did not consider it necessary to let the judges in Luxembourg clarify the open questions, despite the wish expressed by both sides. However, as it allowed an appeal to the Austrian Constitutional Court due to the fundamental importance of the question of the form of consent and its possible bundling, the judges there could in turn refer the question to the ECJ. This would mean that this long-standing point of contention would be a considerable step closer to a final European decision on the interpretation of data protection law.
Transparency note: heise online itself offers a pure subscription. Following a complaint, the content banner was revised in consultation with the State Commissioner for Data Protection of Lower Saxony.
(mki)
