The Digital Services Act package and other changes to the EU’s legal framework for digital markets will transform the grounds for targeted advertising, but the new laws risk restricting innovation.
In their desire to regulate use of data EU law makers must ensure the reforms do not overly restrict innovation in personalised offers and allow consumers who prefer to receive such offers instead of less relevant promotions to choose that path.
Personal data has become valuable to businesses. Online merchants and service providers rely on it to provide their customers with tailored offers, so-called targeted advertising.
Recently, the European Parliament adopted new proposals on how to regulate digital platforms. In October, MEPs approved a series of reports - including one from the Legal Affairs Committee - dealing with the future of platform regulation in general. Those reports cast a critical eye on how targeted advertising is performed currently and what shortcomings there are.
According to a statement published by the parliament, MEPs "want to provide users with more control over what they see online, including being able to opt out of content curation altogether, and to make them less dependent on algorithms". It also said: "Targeted advertising must be regulated more strictly in favour of less intrusive, contextualised forms of advertising that require less data and do not depend on previous user interaction with content. MEPs also call on the Commission to further assess options for regulating targeted advertising, including a phase-out leading to a ban."
The Digital Service Act (DSA) package will impose new rules on how online service providers may advertise and promote the goods and services offered through their digital platforms. The European Commission is set to publish its revised DSA package in early December. The parliament's recent intervention can be seen as an attempt to shape the upcoming proposals.
Data as means of payment
Personal data is vital to companies who want to advertise to people likely to be interested in their goods or services.
To be fair, not all tracking and targeting mechanisms are based on personal data. There are algorithms that allow for assumptions as to what a certain user might be interested in without reference to the user's personal data. But this type of algorithm still depends on some data, which remains at the heart of successful delivery of online advertising.
Many internet users are open to making what might be termed a 'data investment' so that their online experience is personalised to them. This is often referred to as 'paying with your data', and happens when service providers make use of their services conditional on accessing and generating data about the user.
This form of consideration is accounted for in EU law already. The EU’s Directive on certain aspects concerning contracts for the supply of digital content and digital services, which must be transposed into national law by the member states by July 2021, grants users who have provided data in exchange for a service the same rights as users who pay with money for such services.
As long as all this is sufficiently transparent, one might say that nothing is wrong with paying with your own personal data. However, there are complexities around transparency rooted in EU law.
GDPR and e-Privacy Regulation
Data privacy is governed by the General Data Protection Regulation (GDPR) and e-privacy regulations which are now being updated. Reforms particularly relevant to use of personal data for electronic marketing purposes have been proposed, but the planned new e-Privacy Regulation has stalled in the legislative process.
The underlying principle for use of personal data is that any type of processing of personal data requires adequate justification. Article 6 of the GDPR sets out the lawful bases that can be relied on for processing personal data. Obtaining the data subject's consent to data processing is one option , but the law also lists the fulfilment of contractual obligations or the controller's legitimate interest among the other lawful bases for processing.
If it is relying on consent as a basis for processing it is essential that an organisation provide adequate information to a data subject so they can take a balanced decision on consent. Transparency is essential.
In the world of digital advertising, transparency must be addressed at an early stage. The mechanics of how personalised adverts are served do not leave room for lengthy explanations, for balancing the pros and cons and for developing an informed opinion whether of not to give consent. This is because the ads are generated within milliseconds of users interacting with content, with an automated auction deciding which ad to display. It raises the issue of whether consent is the most suitable lawful basis to be relied upon in the context of targeted online advertising.
As regulators continue to adapt to the GDPR age, and with further legislative developments expected, a balanced approach is needed. Transparency is vital, no question, and so is the need to effectively allow individuals to control the use of their personal data.
However, there must also be recognition of the fact that targeted advertising is a phenomenon that users are generally already aware of. For many, it is a valued part of the vast online ecosystem and a useful shortcut through an otherwise unorganised resource to new products and services in areas of their interest. Therefore, we need a legal framework that allows those users who wish to be guided to actually receive such guidance in a way that is practical for businesses to comply with.
Written by
