Share This Article
Marketing privacy consent could be still free according to the Italian Supreme Court, even if it’s a compulsory requirement in the offering of a free service.This is an interesting article initially published on IPTItaly from my colleagues Elisa Rosati and Tommaso Fia on a decision issued on 2 July 2018 by the Italian Supreme Court (Corte di Cassazione) as to the notion of consent to the processing of personal data processing for marketing purposes. Let’s see what the case is about and what the main points of Supreme Court decision are.
What had happened?
A website required users to give their consent “to the data processing”, in order to enjoy a newsletter service about tax, law and other matters just by ticking a check box. The privacy policy regulating the processing of users’ personal data was accessible by way of a link to an external page, and included marketing activities from third parties among the purposes of the processing. If the consent of the user was not obtained, he/she could not access the newsletter service, but granting such consent users were forced to also consent to the delivery of marketing communications.
Free privacy consent according to the Italian Supreme Court
In its decision, the Supreme Court takes into account the notion of privacy consent set out in Article 2(1)(h) of the Directive 95/46/EC and Article 4(11) of the General Data Protection Regulation (the “GDPR“) holding that
- The data protection-related notion of consent is different from the one under contract law – that is to say, the consent given by a mentally-fit person when stipulating a valid agreement;
- Under data protection laws, user’s privacy consent is for making up user’s status of information asymmetry compared to companies’ dominant position. Indeed, user’s consent alone is not enough: users must be appropriately informed, in order to protect his/her right of informational self-determination. In particular, according to the the Italian Supreme Court, privacy consent should be “freely-given, i.e. fully aware and informed and not conditioned, and specific, that is to say unequivocally referred to any effect of the data processing“;
- In relation to the conditionality of consent set out in Article 7(4) of the GDPR, “when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract“ which is an assessment that, according to the Supreme Court, companies should carry out such assessment upon a case-by-case basis;
- Consent is conditioned (i.e. not freely-given) when it is given to enjoy a service which is irreplaceable (infungibile) or indispensable (irrinunciabile). This does not happen when a free service may be replaced by a service against remuneration, “without burdensome sacrifice” of the user. In this scenario, companies are allowed to prevent users from subscribing free services, if they do not give their consent to marketing communications.
Can free privacy consent be tied?
The obvious upshot is that, following the position of the Italian Supreme Court, users can be compelled to give their consent for marketing purposes in many circumstances, since in the digital economy products and services are cheap and highly interchangeable.
However, the question is whether the position of the Italian Supreme Court in line with the GDPR as interpreted by European data protection authorities which in some instances tackled this practice as an “obliged consent”. Also, according to Article 29 Working Party Guidelines on consent under the GDPR of April 2018 (recently endorsed by the brand new European Data Protection Board), tying the provision of a service to a request for consent to process personal data that are not necessary for the performance of that contract or service, is considered highly undesirable.
Free privacy consent means specific consent
In the last part of the judgment, the Supreme Court takes into account the notion of “specific consent“, clarifying that it is deeply linked to the freedom of consent to the data processing. This time, the Supreme Judges do not add much to the provisions of the GDPR and the position of the Italian Data Protection Authority. Companies must seek a specific consent for each different purpose of the data processing. According to the Supreme Court, where the data processing concerns marketing purposes, companies should refer at least to the product markets (categorie merceologiche) or the kinds of services related to the marketing communications.
What shall be done now?
The judgment of the Italian Supreme Court may make difficult to distinguish whether online services are replaceable and not essential. Therefore, following the position of the Italian Supreme Court, the relevant companies may construe the decision in their own favour, in order to seek users’ consent in any context an online service is provided, especially for pursuing marketing purposes.
At this stage, it is important to see if the Italian Supervisory Authority and lower courts will endorse this pivotal judgment of the Italian Supreme Court and how these institutions will balance the rights of the companies against the rights of the users.
Please register to our newsletter ✉️
