Content

Fryderyk Zoll, Personal Data as Remuneration in the Proposal for a Directive on Supply of Digital Content in:

Reiner Schulze, Dirk Staudenmayer, Sebastian Lohsse (Ed.)

Contracts for the Supply of Digital Content: Regulatory Challenges and Gaps, page 179 - 188

Münster Colloquia on EU Law and the Digital Economy II

1. Edition 2017, ISBN print: 978-3-8487-3799-4, ISBN online: 978-3-8452-8139-1, https://doi.org/10.5771/9783845281391-179

Bibliographic information
179 Personal Data as Remuneration in the Proposal for a Directive on Supply of Digital Content Fryderyk Zoll I. Introduction The proposal for a Digital Content Directive1 (‘DCD’) covers also such contracts on supply on digital content, in which the counter-performance of the consumer consists of personal data or other data.2 In this paper, I would like to confine my considerations on the performance to the personal data. The Digital Content Directive itself names in its Art 3 both categories of data, but different problems of contract law arise from these two categories.3 Personal data are much more protected then other data. The                                                              * This chapter has been prepared as part of the project ‘Made in Europe – The European Standards for the services’ financed by the Polish Narodowe Centrum Nauki (National Research Centre) No DEC-2012/04/A/HS5/00709. 1 European Commission, ‘Proposal for a Directive of the European Parliament and of the Council on certain aspects concerning contracts for the supply of digital content’ COM(2015) 635 final. The proposal has been already a subject of the numerous academic discussions – see eg L Beil, ‘Conference Report: ERA Conference, “New EU Rules for Digital Contracts”’ (2016) 2 EuCML 110; ‘Conference Report: New Rules for Contracts in the Digital Single Market. What’s in it for Consumers and Businesses in Europe? – Vienna, 21–22 January 2016’ (2016) 1 EuCML 68; T Schmitt/M Hönisch, ‘Conference Report: Ein neues Vertragsrecht für den digitalen Binnenmarkt? – Vienna, 11 March 2016’ (2016) 3 EuCML 147. 2 Art 3(1) DCD. 3 Personal data are defined in Art 4(1) GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [2016] OJ L119/1 as: ‘any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physio-   Fryderyk Zoll 180  affected person, who has delivered her or his personal data to the trader, retains however the control over these data and may withdraw the consent for the data to be used. The right to withdraw the consent has not been explicitly foreseen by the Data Protection Directive4, albeit in legal doctrine a right to withdraw the consent has been widely accepted.5 In the new General Data Protection Regulation (GDPR) there is a clear provision entitling the person to withdraw consent to the use and to the processing of the personal data.6 The right to withdraw the personal consent clashes with the idea expressed by the proposal of the Digital Content Directive. The aim of this paper is to clarify the scheme of the contractual relationship if one party fully or partially provide his or her data as remuneration for the digital content. The focus will be on the question of the withdrawal of the consent to use and process the data. It is to be verified, whether the obligation to provide the personal data may be treated as every other obligation to provide counter-performance. In particular, it should be examined whether the most fundamental rule on the synallagmatic contracts may work also where the counter-performance consists of data.7 This question is especially important where the consumer withdraws the consent to collect and process data – does it influence the trader’s obligation to deliver the digital content? ____________________  logical, genetic, mental, economic, cultural or social identity of that natural person’. 4 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31. 5 P Barta/P Litwiński, Ustawa o ochronie danych osobowych. Komentarz (CH Beck 2016) Art 23, [9]. See also J Byrski, ‘Odwołanie zgody na przetwarzanie danych osobowych. Wybrane zagadnienia’ (Appendix to the Monitor Prawniczy 3/2011) 1014–1015; J Barta/P Fajgielski/R Markiewicz, Ochrona danych osobowych. Komentarz (Wolters Kluwer 2011) 459. 6 Art 7(3) GDPR. 7 See also C Langhanke/M Schmidt-Kessel, Consumer Data as Consideration (2015) 6 EuCML 221. Personal Data as Remuneration 181 II. Data as Counter-Performance? Art 3(1) DCD determines the scope of the Directive’s application, stating that: This Directive shall apply to any contract where the supplier supplies digital content to the consumer or undertakes to do so and, in exchange, a price is to be paid or the consumer actively provides counter-performance other than money in the form of personal data or any other data. It means also that the Directive does not consider the contract, in which the consumer should provide the personal data, as a gratuitous contract. The language of this provision suggests that the remuneration consisting of data (including personal data) is equal to the payment of price.8 The proposal does not treat the data as a price. The ‘price’ in the sense of the Directive is defined in Art 2 No 6 as ‘money that is due in exchange for digital content supplied’. It could be discussed what exactly the notion of money means and whether some data, which may also constitute a digital content should not be perceived as ‘money’. It could be the case of the internet-based currencies like bitcoins9. In case of ‘personal data’ there is not a fear of the confusion with money. The difference between the ‘price’ and other kinds of counterperformance plays a role in the system of the proposed Directive in the context of restitution after the termination of contract (Art 13(2)(a), (b) DCD) and naturally in case of the price reduction (Art 12(3) DCD), too. It is quite self-evident that it would be hardly imaginable to reduce the data delivered in exchange for the digital content. The problem arises should the lack of conformity not affect the main features of the contract (Art 12(5) DCD). Under such circumstance, the consumer would not be entitled to terminate the contract, since the lack of conformity is not sufficiently serious, but also would not be entitled to price reduction, since his or her obligation concerns data and not money. Probably in such case the                                                              8 F Graf von Westphalen/C Wendehorst, ‘Hergabe personenbezogener Daten für digitale Inhalte – Gegenleistung, bereitzustellendes Material oder Zwangsbeitrag zum Datenbinnenmarkt?’ (2016) BetriebsBerater 2179, 2180. 9 On bitcoins as data: J Fritsche in HG Bamberger/H Roth (eds), Beck'scher Online-Kommentar BGB (2016) § 90 [27]. On Blockchain technology see the contribution by N Guggenberger, ‘The Potential of Blockchain Tech-nology for the Conclusion of Contracts’, in this volume. Fryderyk Zoll 182  consumer would need to relay on damages based on the applicable national law (which is not however evidently clear due to the fully harmonised nature of the Directive, and doubts whether the remedy of damages may complete the list of the remedies of the consumer by the remedies arising from the national law10). III. Consent to the Processing of Digital Data The new General Data Protection Regulation (my analysis would be based on this act and not on the Directive on the Data Protection, which is to be replaced in the year 2018 by the regulation). Art 6 GDPR sets out the requirements for the lawfulness of the data processing. It requires the consent of the data subject (letter a). The discussed Article names also numerous exceptions from the general requirement of the consent. From the perspective of this paper the most important one is named in the Article 7(1)(b) GDPR. Following this exception, If the processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract. The essential question concerns the relation between the proposed directive and the GDPR and the requirement to consent to the personal data processing. One may argue that, if the obligation to provide personal data is a part of the contractual relationship between the parties, the rules on the consent arising from the GDPR do not apply or at least the exception to the requirements of the consent is applicable. One may consider whether Art 6(1)(b) GDPR would not be applicable, if the personal data are provided in performing the obligations by the consumer. Are the data ‘necessary for the performance of the contract’ in the sense of the quoted provision? The answer should be negative. The exception of Art 6(1)(b) applies to the situation, if the processing of data is necessary to perform the obligation of their recipient. It is not the case, if the data are rendered as the counter-performance. The exception arising from Art 6(1)(b) is based on the technical necessity to process the data as a prerequisite to perform the obligation and does not result from the legal rela-                                                              10 On the issue of damages see the contribution by P Machnikowski, ‘Regulation of Damages on National or European Level’, in this volume. Personal Data as Remuneration 183 tionships of the parties. Otherwise the general principle of the data subject’s consent would not have a real scope of application, in spite of the marginal situations of the unilateral acts of the data subject.11 The exclusion of this exception results also from the wording of Art 7(4) GDPR, which provides the criteria to be taken in to consideration when assessing whether the consent is freely given. This provision requires examination whether the performance of the contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of the contract. This provision states very clearly that also in the contractual relationship, if the consumer is obliged to provide his or her personal data as a counter-performance, the consent must be freely given.12 The consent is also not replaced by the declaration of intent (eg offer or acceptance),13 necessary to conclude the contract, but it must be provided separately (Art 7(2) GDPR).14 The consent to the processing of personal data has its source in fundamental rights.15 Nobody can renounce this right definitively. It means that the general requirement to the consent arising from the GDPR applies if the consumer uses his or her data as remuneration for the digital content provided by the trader. IV. Right to Withdraw Consent The most important consequence of conclusion is the data subject’s right to withdraw consent (Art 7(3) GDPR first sentence). The consumer, who has received the digital content in exchange for the personal data, may under this provision withdraw his or her consent at any time. This right has essential impact on the contractual relationships existing among the par-                                                              11 See also Langhanke/Schmidt-Kessel (n 7) 220 (with references to the Directive 95/46/EC). 12 See Art 3(7) DCD, which states: ‘If any provision of this Directive conflicts with a provision of another Union act governing a specific sector or subject matter, the provision of that other Union act shall take precedence over this Directive.’ See also, Graf von Westphalen/Wendehorst (n 8) 2181. 13 Langhanke/Schmidt-Kessel (n 7) 220. 14 Graf von Westphalen/Wendehorst (n 8) 2182–2183. 15 Art 8 Charter of Fundamental Rights of the European Union. See also ibid 2184. Fryderyk Zoll 184  ties.16 If the consumer is entitled to withdraw consent, irrespectively of his or her obligation to provide the personal data, the impact it has on the performance of the supplier of the digital content must be examined. The fact, that the consumer is entitled to withdraw its consent has also impact on the qualification of the obligations between the parties. It has also an impact on the qualification of the contract as such. Since the consent to the processing of the personal data may be withdrawn at any time, it means that is not the personal data per se that form the subject matter of the contract, but rather a duty of the consumer to tolerate the processing thereof. In such case, every contract where personal data is provided as counterperformance to the digital content must be regarded as long-term contract.17 The withdrawal of the consent to process the personal data should be regarded as termination of the contractual relationships between parties (or at least it produces also the effects of termination). The effects of the withdrawal of the consent, accordingly to Art 7(3) GDPR fits into the concept of the long-term contracts. It produces only effects for the future, without affecting the lawfulness of the processing based on consent before its withdrawal. V. Withdrawal of Consent as Termination of the Long-Term Contract Art 16 DCD contains rules on the termination of the long-term contracts in. According to the language of this provision, it concerns only these contracts where they provide for the supply of the digital content for indeterminate or the determinate period, exceeding at least 12 months. Hence it would not be directly applicable to the situation in which consent is with-                                                              16 Langhanke/Schmidt-Kessel (n 7) 220. 17 Langhanke/Schmidt-Kessel (n 7) consider at 221 various concept of reconciliation between the contractual obligation and consent. They develop a concept of the justified breach of contract in case withdrawal. Accordingly, the claim of the creditor may enforce the claim for digital data, unless the personal data subject withdraws its consent. This idea does not explain sufficiently the interconnection between the recipient of data own obligation. The here presented idea of the termination effect of the withdrawal and treatment the whole contract as the long – term relationship explains this relationship in easier way, protecting the interest of both parties without infringing the freedom to withdraw the consent. Personal Data as Remuneration 185 drawn if it would be equivalent to the consumer’s termination. The Commission has not foreseen the situation in which the content of the consumer’s obligation would make the relationship between parties to the longterm contract. Were the proposed Directive national law, it could be a clear case to apply reasoning by analogy. All consequences of the termination of the long term-contract are also reasonable in case of the termination by the consumer. The situations are sufficiently similar that the legislator following a coherent legislative plan should treat them in this same way. In the case of the Directive, the application of the analogy is much doubtful, having in mind that the European private law does not create a self-standing autonomous system of law. The question whether reasoning by analogy is allowed in European private law is disputed and depends very much on the nature of the legislation (whether it creates a microsystem concerning certain area of law or it completes only the national systems).18 In the case of such directive, as discussed here, it is difficult to accept the reasoning by the analogy because the existence of the gap could be examined only after implementation in the framework of the national legal system. The directive determines only the scope of the required implementation. The national law may deliver solutions, not covered by the directive. Since the Digital Content Directive is still only in the legislative process, the question of the analogy is pre-mature. This question should be clarified at this stage by the legislator. However, it cannot be denied that the rules arising from Art 16(2–4) are already applicable to the termination regime of the long-term contracts not covered by Art 16(1). Despite of the fact that the draft has not addressed explicitly the problem of termination of the long-term contract, it does not change the fact that the consequences of termination of the long-term contracts governed by the Art 16 are adjusted also to the case discussed here. The real question is whether the essential assumption concerning the consequences of the termination of the long-term contract in case of the withdrawal of the consent, is correct. The quoted Art 3(1) DCD names the                                                              18 On the conditions for the admissibility of the reasoning by analogy see the decision of the CJEU in Joined Cases C–402/07/–432/07 Sturgeon/Böck [2009] ECR I–10923. On the role of this decision in determining the conditions for analogy in the European law see: J Neuner, ‘Die Rechtsfortbildung’ in K Riesenhuber (ed) Europäische Methodenlehre (3rd edn, de Gruyter 2015) § 12 [32]. Fryderyk Zoll 186  delivery of data as counter-performance. This language suggests a reciprocal connection of the two obligations – delivery of the digital content and the delivery of the data (including the personal data). The sense of the qualification of the obligation to deliver the data as counter-performance lies in the interconnection of the reciprocal obligations of the parties. The reason why the trader supplies the digital content is the supply of the data by the consumer. If the consumer withdraws her or his consent to process the data, the reason for the supply of the digital content to the consumer also disappears. In such situation there should be not an entitlement to retain the digital content. The consumer should not be entitled to the further use of this content. If the Directive were adopted in its present version, it would be an open question whether the restitution mechanism of Art 16(4) would be applicable in such situation. It brings back the problem, mentioned above, concerning the analogy. At this stage the best solution would be the improvement of the draft during the legislative process.19 VI. The Problem of the Mixed Contract Although there are in practice contracts where the digital content is provided only in exchange for the data, in the most typical situations the consumer pays a price and transfers his or her personal data to the supplier. In this latter case, the contractual relationship becomes complex. There is a mix of the obligation to pay money and to tolerate the use of the digital content. In such case, it would be extremely difficult to assess the extent to which the withdrawal of the consent would influence the supplier’s counter-performance in the form of the digital content. In the case of the personal data, it is very difficult to assess how important they are in the supplier’s calculation of the digital content. Art 16(4) DCD does not provide the clear answer to this question. Art 16(4)(a) imposed on the supplier a duty to refrain from the use of the counter-performance ‘other than money’ which consumer has provided in exchange of the digital content. It                                                              19 Langhanke/Schmidt-Kessel (n 7) argue at 222 that the withdrawal of the consent itself does not mean necessarily the termination of contract, since the consumer by this act does not show yet the intention to bring the contract to the end. In the light of the theory presented by the Authors the withdrawal of the consent may entitle the creditor to the termination of the contract. Personal Data as Remuneration 187 does not deal explicitly with the question, how the restitution should occur, if the consumer has provided in exchange for the counter-performance money and personal data. Since it is rather impossible to attribute in such case the supply of data to the separable part of the digital content, the withdrawal of the consent to process the data should then lead to the termination of the long-term contract as whole. If the European law-maker would like to distinguish different configurations of the relationship between parties regarding the effects of the termination, it should reflect it more specifically in the text of the proposal. VII. Contractual Restrictions on the Withdrawal of the Consent? The requirement of the consent and the right to its withdrawal are the emanation of the fundamental rights. Art 7 GDPR determines the requirements for the valid consent but only has sense as a mandatory rule which cannot be circumvented by any kind of the agreement between the parties;20 otherwise it would remain as an empty declaration. It would therefore also be illegal to introduce to the agreement between the supplier of digital content and the consumer any provisions seeking to prevent the consumer from exercising the right to withdraw the consent, as eg contractual penalties or other contractual measure exerting economic pressure on the consumer.21 VIII. Conclusions The personal data as remuneration for the supply of the digital content has a specific status. The subject of the personal data never loses completely the control over his or her data. The consumer may always withdraw the consent. If the personal data were provided as counter-performance in exchange of digital content, the withdrawal of the consent should produce                                                              20 See also Langhanke/Schmidt-Kessel (n 7) 220–221 (with references to the Data Protection Directive 95/46/EC). 21 ibid 221. The authors state correctly that withdrawal of the consent cannot be considered as a breach of contract. Fryderyk Zoll 188  the effect of the termination of the long-term contract. Art 16(1) DCD needs to be adjusted to clarify that also the situation of the termination launched by the withdrawal of the consent to process the personal data, is covered by it.

Chapter Preview

References

Abstract

The profound effect of the “Digital Revolution” is not limited to new technologies and products but also raises a number of legal issues, questions traditional legal concepts, and presents new legislative challenges. As part of the creation of a Digital Single Market, the European Commission’s 2015 proposal for a Directive on certain aspects concerning the supply of digital content represents a first step at European level to respond to challenges posed by digital content.

The contributions to this volume analyse the regulatory challenges and gaps in this proposal from the perspective of conclusion and performance of contract, remedies, copyright, and data protection. The authors are renowned experts in the field of European law and present key insights into problems in theory and practice, suggestions for improvements, and therefore make a valuable contribution to understanding and overcoming the legal challenges brought by the “Digital Revolution”.

Zusammenfassung

Die tiefgreifende Wirkung der „digitalen Revolution“ beschränkt sich nicht nur auf Technologien und Produkte, sondern wirft auch eine Reihe neuer Rechtsfragen auf, stellt traditionelle Rechtskonzepte infrage – und die Legislative vor neue Herausforderungen.

Der Vorschlag der Europäischen Kommission zur Schaffung eines digitalen Binnenmarkts (KOM (2015) 634 endg.) stellt einen ersten Schritt auf europäischer Ebene dar, um diesen Herausforderungen gerecht zu werden.

Die Beiträge des Bandes analysieren die Chancen und Lücken des Vorschlags aus der Perspektive des Vertragsrechts, der Rechtsbehelfe, des Urheberrechts und des Datenschutzes.

Die Autorinnen und Autoren sind renommierte Experten auf dem Gebiet des europäischen Rechts. Lösungsorientiert diskutieren sie Probleme in Theorie und Praxis und leisten damit einen wertvollen Beitrag zum rechtlichen Verständnis sowie der Bewältigung der „Digitalen Revolution“.

Mit Beiträgen von

Hugh Beale, Martine Behar-Touchais, Aurelia Colombi Ciacchi, Nikolas Guggenberger, Sebastian Lohsse, Marco Loos, Sebastian Martens, Piotr Machnikowski, Susana Navas Navarro, Esther van Schagen, Reiner Schulze, Gerald Spindler, Dirk Staudenmayer, Rolf H. Weber, Fryderyk Zoll.