Naar aanleiding van een klacht van noybheeft de gegevensbeschermingsautoriteit van Hamburg het gebruik van controversiële 'Pay or OK'-systemen geoorloofd verklaard. De procedure roept echter aanzienlijke vragen op: Hoewel de autoriteit actief in gesprek was met het tijdschrift DER SPIEGEL, heeft zij de betrokkene tijdens de procedure niet één keer gehoord. Veel relevante feiten zijn nooit onderzocht. In een parallelle zaak zou de autoriteit zelfs een bedrijf actief hebben gemotiveerd om geld te eisen voor het 'nee' zeggen tegen de cookiebanner. De betrokkene heeft daarom een rechtszaak tegen de gegevensbeschermingsautoriteit aangespannen bij de administratieve rechtbank in Hamburg. Het artikel gaat verder in het Engels.
Background to ‘Pay or OK’. In the summer of 2021, the complainant submitted a GDPR complaint against the ‘Pay or OK’ banner on the website of DER SPIEGEL. At the time, he (and all other users) had to decide whether to allow the news magazine to use personal data or take out a paid subscription. The authority then took almost three years to determine that it considered ‘Pay or OK’ to be permissible in principle. However, there is no serious discussion of the facts in the decision. There is no justification as to why users having to pay for their basic rights should constitute voluntary consent and genuine freedom of choice. It is known that more than 99.9% agree to tracking when confronted with ‘Pay or Okay’. Yet only 3-10% actually want personalised advertising. In the meantime, even the EU Commission has expressed considerable doubts about the legality of the model.
Max Schrems, Honorary Chairman of noyb: “The use of ‘Pay or Okay’ results in a consent rate of 99.9%. Not even the GDR achieved such a high level of fake consent. There can be no question of voluntary consent here. It just seems that the Hamburg authority don't want to know about such figures.”
Cheap legal advice for SPIEGEL. The Hamburg DPA was in close contact with SPIEGEL during the proceedings. Instead of investigating and deciding impartially, it also met with representatives of the company several times, invited them to its premises and provided feedback on the proposed changes. For the administrative costs of the procedure, the Hamburg authority charged SPIEGEL € 6,140. Another media company had previously even been proactively encouraged by the Hamburg authority to switch to ‘Pay or OK’. It can be assumed that the authority actively encourages companies to engage in problematic behaviour. Incidentally, the complainant was only informed of all this after the decision had been made. He was not heard by the authority. The majority of his messages to the authority were not even answered.
Dr Raphael Rohrmoser, lawyer for the complainant: “The Hamburg data protection authority has obviously provided SPIEGEL with legal advice. The administrative fee charged by the data protection authority is likely to be significantly lower than the fees charged by law firms providing legal advice. For SPIEGEL, the authority’s approach represents a win-win situation.”
Lawyer and judge at the same time. Considering that the Hamburg authority provided legal advice to SPIEGEL during the proceedings, it is unlikely to make a decision in future that contradicts itself. According to the GDPR, data protection authorities are supposed to ‘sensitise’ companies, but not advise them. Their task is to investigate complaints and make an impartial decision based on their investigations.
Max Schrems, Honorary Chairman of noyb: “Nobody should be a lawyer and a judge at the same time. However, the Hamburg data protection authority seems to see no problem in advising companies or even actively calling for the introduction of ‘Pay or OK’ instead of objectively investigating the facts. It is obvious that the authority will not consider the changes it has arranged as illegal.”
Lawsuit against the authority. The complainant has now filed a lawsuit with the Hamburg Administrative Court to have the DPA's decision overturned. If this action is successful, the authority would have to decide again on the complaint from 2021.
The complainant is represented by Dr Raphael Rohrmoser from AdvoAdvice.
