Unpacking the economic future of the GDPR at the EDPB stakeholder event

Some thoughts on today’s EDPB “Pay or Consent” stakeholder event – in practice one about the future of GDPR enforcement, consent, adtech and even the future of the Internet:
– At times, things got heated in our breakout room between two camps, typically privacy rights campaigners + contextual ad solution providers on the one hand and trade associations, publishers and random lawyers like me on the other hand

– Not everyone has properly understood the consequences of the EDPB’s Art. 5(3) ePrivacy Guidelines, as I heard repeatedly contextual ad solution providers claiming that the provision doesn’t apply to them despite the clearly expansive scope of those guidelines (see my recent post: https://lnkd.in/eJUkKmSK and listen to a 1h podcast notably on that: https://lnkd.in/eZyFG-nD)

The following points were made by the second camp:

1/ Is consent “detriment”-free?
Payment as such isn’t a “detriment”, there are other concerns. One point repeatedly highlighted was a competitive space. The average user as well as broader societal impacts should be taken into account when assessing detriment, plus e.g. the issue of public services.
Also, EU legislation *does* already recognise the provision of digital services in exchange for personal data.
(Plus, Art. 16 EU Charter vs right to protection of personal data was discussed too)

2/ Consequences of a “free alternative without behavioural advertising” (FAWBA)?
First, there may be a cost – not everyone already has the technical infrastructure and personnel to support a subscription approach. It’s not necessarily a simple click.
Next, it’s important to know what *is* meant by behavioural advertising, due to various gradations, and what would be a FAWBA.
In addition, see point about re ePrivacy – if consent is needed anyway for contextual ads, what gives?
Finally, a FAWBA might require different or more ads. That cannot be considered unlawful.

3/ *Equivalent* alternative if necessary for an appropriate fee?
“Equivalent” doesn’t mean “identical”. If you don’t have a user management system for ad-based content, you will need one for the subscription version.

4/ Equivalent alternative “if necessary for an appropriate fee”?
First, “if necessary” = “where appropriate” if you read the FR & DE versions of the Bundeskartellamt judgment.
Next, “appropriateness” is an economic question- for the controller alone, not for the EDPB. It’s not a direct compensation for ads, because of the other structural consequences in terms of cost + profitability. It’s not a data protection issue but a market & competition one.

5/ Broader issues?
First, what is the scope of the upcoming Guidelines? What is a “large online platform”, and what isn’t? (Comparison with the “Consent or Pay” Opinion – see commentary here: https://lnkd.in/eddQ4yW8 )
Next, it’s critical to take into account consistency with other national guidance.

***

Any questions on next steps or how to anticipate future Guidelines for your business? Reach out!