On 02 July 2018, with judgment no. 17278/2018, the Italian Supreme Court (Corte di Cassazione) took an important stand on the notion of consent to personal data processing for marketing purposes. Let’s see what the case is about and what are the main points of Supreme Court decision.
Background. A website required users to give their consent “to the data processing”, in order to enjoy newsletter service about tax, law and other matters just by ticking a check box. The privacy policy regulating the processing of users’ personal data was accessible by way of a link to an external page, and included marketing activities from third parties among the purposes of the processing. If the consent of the user was not sought, s/he could not access the newsletter service.
The Decision of the Supreme Court: (The Mirage of) Freedom of consent. In its decision, the Supreme Court takes into account the notion of consent set out in Article 2(1)(h) of the Directive 95/46/EC and Article 4(11) of the General Data Protection Regulation (the “GDPR“). The data protection-related notion of consent is different from the contract law one – that is to say, the consent given by a mentally-fit person when stipulating a valid agreement. In data protection law, user’s consent is for making up user’s status of information asymmetry compared to companies’ dominant position. Indeed, user’s consent alone is not enough: user must be appropriately informed, in order to protect his/her right of informational self-determination (as first used in the context of a landmark 1983 German constitutional ruling). The Supreme Court quotes the provisions of the GDPR and puts it this way: the consent should be “freely-given, i.e. fully aware and informed and not conditioned, and specific, that is to say unequivocally referred to any effect of the data processing“. Then, the Supreme Judges dwells on some of the features that qualify data protection consent.
The main point of the Supreme Court is the analysis of the tricky notion of freedom of consent, that finds a stricter regulation under the new data protection regime.
In particular, much focus is placed on the conditionality of consent set out in Article 7(4) of the GDPR, stating that “when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract“. According to the Supreme Judges, companies should carry out such assessment upon a case-by-case basis.
Further, the Supreme Court explains that generally consent is conditioned (i.e. not freely-given) when it is given to enjoy a service which is irreplaceable (infungibile) or indispensable (irrinunciabile). This does not happen when a free service may be replaced by a service against remuneration, “without burdensome sacrifice” of the user. In this scenario, companies are allowed to prevent users from subscribing free services if they do not give their consent to marketing communications. The obvious upshot is that the users can be compelled to give their consent for marketing purposes in many circumstances, since in the digital economy products and services are cheap and highly interchangeable.
Clearly, the position of the Supreme Court run counter to the EU approaches. As is well known among the practitioners, EU institutions have been tackling this practice of seeking “obliged consent” for quite some time. According to the current draft of the ePrivacy Regulation since broadband internet access is an essential service to all individuals, “consent for processing electronic communications data […] will not be valid if the end-user has no genuine and free choice” (Recital 18 of the ePrivacy Regulation). For its part, Article 29 Working Party Guidelines on consent under GDPR of April 2018 (recently endorsed by the brand new European Data Protection Board) roundly states that tying the provision of a service to a request for consent to process personal data that are not necessary for the performance of that contract or service, is considered highly undesirable.
Free Consent means Specific Consent. In the last part of the judgment, the Supreme Court takes into account the notion of “specific consent“, clarifying that it is deeply linked to the freedom of consent to the data processing. This time, the Supreme Judges do not add much to the provisions of the GDPR and the position of the Italian Supervisory Authority. Companies must seek a specific consent for each different purpose of the data processing. According to the Supreme Court, where the data processing concerns marketing purposes, companies should refer at least to the product markets (categorie merceologiche) or the kinds of services related to the marketing communications.
Conclusion. The judgment of the Italian Supreme Court may make difficult to distinguish whether services online is replaceable and not essential. Therefore, the relevant companies may construe the decision in their own favour, in order to seek users’ consent in any context an online service is provided, especially for pursuing marketing purposes.
At this stage, it is important to see if the Italian Supervisory Authority and lower courts will endorse this pivotal judgment of the Italian Supreme Court and how these institutions will balance the rights of the companies against the rights of the users.
If you would like to receive more information, please contact the authors elisa.rosati@dlapiper.com and tommaso.fia@dlapiper.com.