Italian Supreme Court: No prohibition of linking the processing of personal data to the supply of a certain service
When discussing consent under the GDPR one of the most controversial questions is the interpretation of Art 7 para 4 and whether there is a strict tying restriction. The data protection authorities maintain that any tying of consent to a contract leads to the invalidity of the given consent.
However the language of the paragraph shows that whether or not the consent is conditional on the performance of a contract shall only be taken into utmost account. Thus the decisive question is whether the consent was freely given. If users want to take part in a prize draw or download a whitepaper and have to give their consent to do so this remains a free decision. As long as the tie is transparent there is no doubt that consent was voluntarily.
This view is now supported by a decision of the Italian Supreme Court. Pasquale Distefano of D&P Legal summarizes the court decision:
Italian Supreme Court: no strict tying restriction
The Italian Supreme Court (the Corte di Cassazione), with the decision no. 17278 of July 2nd , expressed its opinion on the issue of granting consent for the processing of personal data, offering an interpretation that in the light of the new Data Protection Regulation (EU) 2016/679 (GDPR) raises concerns.
In a nutshell, the Court stated that in certain cases the provision of an IT service may be conditional to provision of consent to the processing of personal data for promotional purposes.
In other words, the website operator can deny a service to those who do not want to receive promotional messages, provided that it is a fungible service (such as, for example, a newsletter) and that it does not jeopardise the user that refuses consent and the relevant services.
Facts: Subscription to financial information tied to marketing opt-in
In this case, the website operator offered a newsletter service on topics regarding finance, tax, labour law.
To access the newsletter, the user was required to enter his email address and, at the bottom of the data collection form, there was a checkbox with which the user could express consent to the processing of his/her personal data. However, to know in detail the use of such data he/she had to click on a link to a different web page where it was generally specified that the data collected would have been used not only for the provision of that service, but also for commercial communications also from third parties. In the absence of subscription, the service was not provided. So clicking on subscription button implied also a consent on data processing for marketing purposes.
Italian DPA: Non-compliance with GDPR
The Italian Data Protection Authority has considered that activity to be non-compliant, because the company had carried out a processing of personal data for commercial purposes without having collected a valid consent of the data subjects.
The Court of first instance upheld the opposition presented by the company sanctioned, arguing that the law does not impose an obligation for the website operator to offer its services, regardless of the consent to the processing of personal data provided by the data subjects. In addition, the Court of first instance has considered that the service in question was provided to users who freely and voluntarily had opted to join.
Against the judgement of the court of first instance, the Data Protection Authority appealed in before the Supreme Court.
The Supreme Court first dealt with the notion of consent, under the Italian Data Protection Code (Legislative Decree no. 196 of 30 June 2003 and the GDPR, stating that it must be free, informed and specific, i.e. unequivocally referred to each particular effect of the processing.
As already mentioned, the controversial point of the judgment in question concerns the assumption whereby the offer of a certain service by a website operator is conditional to the grant of consent for sending commercial communications.
Supreme Court: free service can be tied to opt-in in commercial communication
The Supreme Court expressly refers to paragraph 4 of Article 7 of Regulation (EU) 2016/679, according to which: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional upon consent to the processing of personal data that is not necessary for the performance of that contract”.
The Supreme Court has stated that there is not one sole answer to the question, and that the concept of conditioning is not obvious, but that it depends on the concrete need for data subjects to have access to the service: in other words, it could be considered that there was a conditioning if the service offered by the website operator was not replaceable and necessary for the data subjects.
But in the opposite case, such as that in the this case where the operator offered a news feed service, by publishing information that could easily be acquired by other means, the data subjects could turn down that service (considered fungible) without heavy burden.
Indeed, according to the Supreme Court, nothing prevents the website operator - in a case such as the one at issue, concerning a service that can be waived at any time and replaced with another, such as a newsletter - from denying the service offered to those who do not want to receive commercial messages, provided that the consent is given individually and unambiguously in respect to this point, which also entails the need, at least, to indicate the product sectors or services to which the commercial messages will be referred.
In a nutshell, it is the opinion of the Supreme Court, that the law, under specific conditions, does not prohibit to link the processing of personal data to the supply of a certain service, but requires, however, that such activity is the result of a wilful consent, not given under constraint.
The Italian Data Protection Authority contradicts the interpretation of Art 7 para 4 GDPR by the Court. Thus an extensive application of this exception to the free consent rule might raise concerns with the authorities and lead to measures taken. Whether or not consent is freely given will always have to be lookedat closely. The Data Protection Authority is not subject to any binding precedent rule, and will go forward against a too strict tying.