On November 19, 2018, the UK’s Register reported how even though the Washington Post was in technical violation of the GDPR, the UK’s privacy enforcement arm, the Information Commissioner’s Office, admitted in private emails that it was not likely going to seek extra-jurisdictionally any potential penalties.
According to the Register, the Washington Post’s online subscription options offers readers a free option (for a limited number of articles); a $6 a month option (for unlimited articles); and a $9 a month option that allows users to switch off tracking and cookies. With the free and $6 a month options, readers, however, must consent to the use of cookies, tracking and ads.
Acting on a complaint apparently ginned up by the Register, a Case Manager from the UK ICO reviewed these policies and purportedly decided they were in violation of applicable privacy law. (“I am of the view that the Washington Post has not complied with their Data Protection obligations. This is because they have not given users a genuine choice and control over how their data is used.”).
Pushing aside the fact the pricing model set forth in the article may be stale – the current pricing is apparently set at a higher rate, and the fact EU residents can apparently opt out of the WaPo’s terms that may be in violation of GDPR, the article still brings home a very important point, namely that consent cannot truly be “freely given” when it is given only in response to a threatened change in pricing.
By way of background, Article 7 (4) of the EU’s GDPR states: “When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.” By charging a different price for the same services based solely on whether consent is given, there is certainly technical violation of GDPR.
Moreover, under the recently enacted Section 1798.103 (“Right to Equal Service and Price”) of the California Consumer Privacy Act, this alleged violation is made even more stark: “A business shall be prohibited from discriminating against a consumer because the consumer requested information pursuant to sections 1798.100 or 1798.101, or because the consumer directed the business not to sell the consumer’s personal information pursuant to section 1798.102, or because the consumer exercised the consumer’s rights to enforce this Act, including but not limited to, by: (a) denying goods or services to the consumer; (b) charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties. . . .”
Whether by way of GDPR or CCPA – or other laws still not enacted, companies will eventually be tested on the adequacy of “freely given” consents. And, the extra-jurisdictional limitations of GDPR will certainly not curtail US enforcement under an even more direct CCPA. In other words, despite what others may suggest, marketers and others embedded in the digital ad ecosystem should likely get their consent proofs in order – especially as “big brands continue to redirect their ad spend and adapt their advertising practices to the GDPR.”
Between the recent 60 Minutes GDPR feature with Max Schrems – an educational piece that can only further draw consumer ire, or the actual four Complaints filed by Schrems that will likely resolve these issues, a Consent Armageddon is headed our way beginning in 2020 – the year CCPA also comes online and GDPR enforcement efforts will be more fully staffed. More importantly, with the proper mechanisms in place, sometime after 2020, data subjects will finally have the power to fully exert ownership and controlled use of their own data – a property class that should be treated no differently than gold or silver.