Remember the EDPB draft opinion on Meta’s “consent or pay”? If not, read here my summary.
Well that one was published on 17 April, but I came across a court decision from 15 April, in Germany, also on “consent or pay”. Spoiler alert: the arguments don’t totally match, and the conclusion is entirely different! Here’s what you need to know:
In the case before the Regional Court of Regensburg (Germany), the plaintiff, a user of Facebook and Instagram, claimed damages, information, and deletion of personal data from Meta (the operator of Facebook and Instagram) for alleged violations of the GDPR. The court dismissed the action, ruling in favour of Meta.
Key findings:
- Right to Information: The court found that the defendant had fulfilled its obligations by providing sufficient information regarding the processing of personal data for advertising purposes.
- Non-material Damages: The court ruled that the plaintiff failed to prove concrete, noticeable harm as required under GDPR Article 82. General discomfort or increased spam were not considered sufficient to claim damages.
- Consent for Data Processing: The plaintiff had consented to data processing for advertising purposes, negating the claim for erasure of data under GDPR Article 17.
- Specificity of Claims: The court found the plaintiff’s claims, especially for injunctive relief, too vague and thus inadmissible.
Elements Going in the Same Direction as the EDPB Opinion:
- Consent Requirements: Both the EDPB opinion and the court decision emphasize the importance of valid consent. The court recognized that the defendant had informed users about data processing and had offered a choice to either consent to data use or opt for an ad-free subscription, which aligns with the EDPB’s emphasis on informed and unambiguous consent.
- No Negative Consequences for Not Consenting: The court’s acceptance of the consent mechanism provided by Facebook/Instagram, where users could choose an ad-free version for a fee, aligns with the EDPB’s requirement that users should not face negative consequences for withholding consent. This supports the idea of providing an equivalent alternative without coercive elements.
- Granular Information: The EDPB highlights the need for granular and specific information about data processing purposes. The court noted that the defendant had provided detailed information about data use, satisfying this requirement.
Elements Going in a Different Direction:
- Market Dominance and Power Imbalance: The EDPB’s opinion focuses heavily on the imbalance of power between large platforms and users, suggesting that valid consent in such contexts is challenging due to the platforms’ dominant positions. In contrast, the court did not find the plaintiff’s consent invalid despite the defendant’s significant market position, implying that the existence of an equivalent alternative (paid ad-free option) was sufficient to mitigate concerns about power imbalance.
- Material Harm Requirement: The court required a concrete demonstration of harm to award non-material damages, whereas the EDPB stresses the importance of protecting data subjects’ rights without necessarily requiring a high threshold of demonstrable harm. The EDPB opinion implies that the very structure of “consent or pay” models can undermine the fairness of consent, irrespective of demonstrable harm.
- Bundling of Consent: The EDPB opinion is strict about consent for behavioral advertising not being bundled with other services unless users actively select them. The court decision, however, seemed more lenient in accepting the overall consent framework provided by Facebook/Instagram without scrutinizing the bundling aspect deeply.
I am hoping that this will be used like the great opportunity that it is to raise a request for a preliminary ruling in appeal, so that the Court of Justice of the EU is called to unequivocally rule on this issue, sooner rather than later.
