The future (of data protection) is without consent: the new cookie walls of online newspapers
Some online newspapers are proposing access to their contents (usually paywalls) subject to consent to profiling treatments. Maria Vittoria La Rosa (Lawyer) and Marco Scialdone (Professor of Law and Management of Digital Content and Services, European University of Rome) focus on cookie walls
“ In a victorious military operation victory is secured first and then battle is fought. In a military operation doomed to defeat, battle is first fought, then victory is sought ”: this was what Su Tzu said in his Art of War. We do not know how much this maxim is appreciated today in the world of data protection scholars and operators: however, the unraveling of the latest events would seem to suggest a poor fortune, in the contemporary phase, of the fundamental Chinese military strategy treaty.
To reflect on the subject, the example of the recent initiatives of some editorial groups regarding user profiling is useful, for weeks at the center of the debate between privacy scholars and operators and recently the subject of an initiative by the Privacy Guarantor, aimed at verify the legitimacy of these practices. Basically, what has happened is that on the sites of some online newspapers a notice has appeared to those who access them according to which, in order to view the contents, it is necessary either to purchase a subscription, or to give one's consent to the installation of cookies and other personal data tracking tools. In essence, publishers have explicitly begun to ask for the payment of a "price" for access to their product, consisting either of a sum of money, or of the authorization to process certain data. Hence the scandal, which still inevitably arises when the concept of price is compared to that of data (personal or not, this distinction usually has little influence on the debate).
If, as mentioned, the Italian Personal Data Protection Authority decided to open an investigation in this regard (the results of which must be awaited), it must be said that a similar case has already passed the scrutiny unscathed of the homologous Austrian Authority in 2019 when it was stated that the so-called "pay or okay" is in principle lawful and paying for access to a website can be an alternative to consent. Moreover, this decision appears to be supported by recital 24 of Directive (EU) 2019/770 according to which "the supply of digital content or digital services often provides that, when he does not pay a price, the consumer provides personal data to the economic operator. Such business models are used in various forms in a considerable part of the market” .
After all, is it really surprising that an entrepreneurial subject (such as publishers) demands a remuneration for access to their product? Or wouldn't it be rather bizarre the other way around? And is it still realistic, in the digital context, to think that this remuneration does not go through an economic exploitation of the data?
A few decades of frequenting the web and its (formally) free services has perhaps made us lose familiarity with a concept which nonetheless remains fundamental in a market economy context, such as the one we live in: the organization of means aimed at the production of goods or services derives its raison d'être from the entrepreneur's desire to make a profit. No profit, no goods (or services). It is obvious that this activity must necessarily fit into a framework of rules (even of constitutional rank), but it is unthinkable that this basic concept is ignored. The attitude that leads to a battle launched without keeping this fact in mind takes away from the achievement of one's goal (however noble, such as that of protecting personal data), just as the ancient Chinese master teaches us. Not even the consumer perspective benefits from it.
Going back to the specific example of information, the crisis facing the sector is known. One can legitimately discuss the ways in which readers are or are not forced to undergo de facto profiling, but a debate that ignores the need for the sector to find its own economic sustainability is not destined to any concrete result: and it is probable that this sustainability cannot be guaranteed only by subscriptions but must necessarily pass, in a context of very low readers' propensity to spend, from the economic exploitation of data. Moreover, the amount of economic studies produced in recent years in Europe, Australia, the United States and elsewhere on the economic role that data (personal and otherwise) play in digital markets is now such as to make any consideration on the point superfluous: one can rather discuss how this should be implemented.
The issue, therefore, could perhaps be put in these terms: in an economic context such as the digital one, in which data is already the basis of economic dynamics, does it still make sense to debate whether a data can be considered a price? Couldn't it be more sensible to consider this – rather – as the basic assumption from which to start in order to identify the most correct ways of making a phenomenon that is here to stay?
The discussion focused exclusively on consent as a privileged legal basis (and, therefore, in cascade, having to question whether it can actually be said to be free in such a context) risks turning out to be sterile, when instead it would be necessary to think about the ways in which to guarantee the correct balance between freedom of enterprise and effective protection of the rights of other market players, starting with consumers.
This could pass, paradoxically, precisely from the overcoming of consent in favor of other legal bases, such as the contract or legitimate interest, which are better able to respond to the changed market context in which the synallagmatic relationship is represented by the exchange between personal data and digital service.
If this is true, it is necessary to ask the market operators, primarily the large platforms, to make an effort to redesign the digital ecosystem which, at the moment, is completely unbalanced, placing the user/consumer at the centre, not as the presumed beneficiary of services "free", but as a contractual counterparty.
Secondly, given this renewed approach, it is necessary to put an end to the season of bulimia of personal data, often not strictly functional to the provision of the service: the recognition of the economic value of personal data also means greater parsimony in their supply and use.
Thirdly, it is necessary to focus more on the objective of protection and reduce the types of offenses in order to avoid that the entire regulatory system on data protection is transformed into a huge multifunction (as seems to happen more and more).
A successful battle in the name of data protection should be based on these assumptions.
Alternatively, we can continue to launch "military" operations destined to have little effectiveness: in this case, let us not say that the ancient Chinese wisdom had not warned us.
This is a machine translation from Italian language of a post published on Start Magazine at the URL https://www.startmag.it/innovazione/il-futuro-della-data-protection-e-senza-consenso-i-nuovi-cookie-wall-dei-giornali-online/ on Thu, 17 Nov 2022 08:57:11 +0000.