Technology companies have already fallen foul of the General Data Protection Regulations (GDPR) that came into force in Europe on Friday (25 May).
Noyb.eu – European Center for Digital Rights has filed four complaints over “forced consent” against Google, Instagram, WhatsApp and Facebook.
The group argues that messages served to users giving them the option to consent to data usage or be switched off from a service are in contravention of the GDPR – and could carry a €7-billion penalty.
Max Schrems, chair of noyb.eu, commnts: “Facebook has even blocked accounts of users who have not given consent. In the end users only had the choice to delete the account or hit the “agree” button. That’s
not a free choice.”
Nyob.eu states that the GDPR prohibits such forced consent and any form of bundling a service with the requirement to consent. So access to services can no longer depend on whether a user gives consent to the use of data.
“Many users do not know yet that this annoying way of pushing people to consent is actually forbidden under GDPR in most cases,” Schrems says.
Putting an end of “forced consent” would not mean that companies can no longer use customer data, he adds. The GDPR explicitly allows any data processing that is strictly necessary for the service – but using the data additionally for advertisement or to sell it on needs the users’ free opt-in consent.
Schrems explains: “It’s simple: Anything strictly necessary for a service does not need consent boxes anymore. For everything else users must have a real choice to say ‘yes’ or ‘no’.”
If the complaints of noyb.eu are successful, they will also put an end to pop-ups which are used to claim a user’s consent.
“If companies realize that annoying pop-ups usually don’t lead to valid consent, we should also be free from this digital plague soon. GDPR is very pragmatic on this point: Whatever is really necessary for an app is legal without consent, the rest needs a free ‘yes’ or ‘no’ option.”