Dutch Public Broadcasting (NPO) seems to be in the spotlight again when it comes to collecting personal data, and not in a positive sense. This time it's about the app NPO Start. Last week, a notice appeared in the app stating that users must agree to the possibility that information about viewing behavior will be passed on to advertisers. The data gives advertisers a better picture of users. Users must agree to this, otherwise they cannot use the app, the successor to Uitzending Gemist.
In early 2013, Parliamentary questions were asked and answered about the use of cookies on NPO websites. In response, the Personal Data Authority ("AP"), then the Dutch Data Protection Authority ("CBP"), issued a letter explaining the applicable legal framework. The CBP noted that the NPO may not deny visitors access if they do not consent to having their browsing behavior tracked:
"The NPO offers visitors no choice but to consent (at once) to all types of cookies, including tracking cookies. Anyone who refuses this permission is denied access to the information and broadcasts - distributed with public money - of the public broadcasters. However, there is no (digital) alternative available, so it can be argued that NPO has a situational monopoly position. By enforcing consent for tracking cookies, visitors actually pay with their personal data every time they visit. There is therefore no question of freely given, legally valid consent."
Following this, the AP investigated the NPO's processing of personal data with cookies in 2014. As a result, the AP concluded that the NP is breaking the law by using so-called tracking cookies to collect personal data from website visitors without their unambiguous consent. These tracking cookies allow the NPO to track the surfing behavior of visitors to various broadcasting websites. Tracking surfing behavior via cookies without adequate information and prior consent of the website visitor is not allowed:
"Surfing behavior data is sensitive data that can give a penetrating picture of a person's (communication) behavior and interest. Internet users have the right to know who is collecting what personal data from them and for what purpose. The NPO collects data from its website visitors, among other things, to measure audience reach, to show personalized ads and to enable sharing via social media. NPO's information to visitors falls short on several counts. Website visitors should first be given information about the different types of cookies and which of their personal data are used for what so they know exactly what they are consenting to."
In 2015, the AP announced that the NP had taken steps to end the violations of the law it had identified. The NPO no longer placed and processed tracking cookies without a visitor's unambiguous consent.
The definition of consent in the Personal Data Protection Act, and soon in the General Data Protection Regulation, requires that there be a free expression of will.
Not being able to use the website requested by the visitor, or only being able to do so for a fee, is not in itself sufficient to assume that the visitor cannot make a free choice whether or not to consent to the use of cookies. For example, there are providers who, in order to comply with the cookie provision, use a cookie wall: a pop-up asks for permission to place and read cookies, but if permission is not given, the visitor cannot visit the site.
The explanation of the cookie law recognizes that there are many websites that rely on the use of tracking cookies for revenue in order to display targeted advertising. Such websites sometimes choose to deny access to the site to visitors who do not consent to the use of cookies:
"However, it may be the case that the revenue model of a free website is based on the income that the website owner generates with advertising on his site. Without tracking cookies, the website owner receives less advertising revenue, because he then cannot offer advertisements that are targeted (based on the interests of the visitor as revealed by his surfing behavior), but has to make do with less targeted advertisements. This can be a reason for him not to allow visitors who do not give permission for the use of tracking cookies to use his site. The cookie provision only dictates that he cannot set cookies without consent. Therefore, a cookie wall is generally a lawful way to satisfy the consent requirement in the cookie provision. Even though this is not the most user-friendly way and is also never technically necessary, the website owner is in principle free to decide whether or not to allow a visitor who does not consent to the use of cookies to access his website."
It is not possible to give an exhaustive list of circumstances in which the consequence of not giving permission is so severe that it undermines the freedom of choice. In any case, this is the case when not giving permission is linked to the consequence that the user cannot exercise a legal right: "The fact that the information and services offered via the visited website are part of a public task will generally also lead to the fact that these must be offered even if the visitor does not give permission for privacy-sensitive cookies."
Users who do not agree to the terms will be denied access to the app. The fuss has arisen because there is as yet no option to disallow certain cookies. However, in the notification you get on your smartphone or tablet, via the ' more information' button, you can see that there is an option to adjust the cookie settings. Users thus initially seem to be able to disable the placement of the infamous advertising cookies, but after saving the changed settings an error message is displayed. In any case, the NPO does seem to recognize that a cookie wall cannot pass muster in this case and reports that it is in the process of providing a choice about ads.
More articles by SOLV Lawyers
