Report on the IMKR Lecture “The Limits of Data Commercialization – Or: Is Facebook Allowed to Do That?” by Dr. Korch
On February 3, 2021, Dr. Stefan Korch, LL.M. (Harvard), a research fellow at the Max Planck Institute for Comparative and International Private Law in Hamburg, spoke at the IMKR on the topic “The Limits of Data Commercialization – Or: Is Facebook Allowed to Do That?” After opening remarks by Prof. Rösler, Dr. Korch first outlined the possibilities for data commercialization by companies with data-driven business models. These include, on the one hand, the sale of data to third parties and, on the other hand, the sale of advertising space for personalized advertising.
Dr. Korch then explained the extent to which Facebook collects data from its users through its services Instagram and WhatsApp. The data processed includes, for example, registration data, photos including metadata (location and date taken), contact information such as the address book or call log, device attributes such as the operating system used, device activity such as other open windows, and identifiers such as device IDs. In addition, Facebook collects further data with the help of partners. This occurs even if the data subject does not have a Facebook account or is not logged in.
Dr. Korch then assessed the lawfulness of this data processing by digital service providers in light of data protection law and contract law. Article 6(1) of the GDPR sets forth various grounds for lawfulness. For example, processing is lawful if the data subject has given consent (Article 6(1)(a) of the GDPR). However, consent must have been given voluntarily. In the case of Facebook, there are doubts regarding this in light of the prohibition on tying in Article 7(4) of the GDPR. In order to set up a user account, Facebook requires the user’s consent to the commercialization of their data, with no alternative available. Facebook’s analysis of user data with the aim of enabling data subjects to use the service in a personalized manner is necessary for the performance of the contract and is thus covered by Article 6(1)(b) of the GDPR. However, the commercialization of the data in the form of profiling for the sale of personalized advertising space or the data itself is not necessary for the performance of the contract.
For Facebook to have a legitimate interest in processing personal data, this interest must be balanced against the interests of the data subject (Article 6(1)(f) of the GDPR). Although the processing of personal data for the purpose of direct marketing may be regarded as serving a legitimate interest under Recital 47 of the GDPR, the creation of user profiles for personalized direct marketing goes too far and can no longer be justified by Facebook’s legitimate interest. In general, processing for the purpose of data commercialization cannot be regarded as a legitimate interest of the controller. The commercialization of data cannot be reconciled with the principle of necessity under Article 6(1)(f) of the GDPR. Since more restrained data processing – as a less intrusive measure – always results in lower revenue, the less intrusive measure can never be equally effective.
From a contract law perspective, the question arises as to the application of the law governing general terms and conditions (§§ 305 et seq. of the German Civil Code, BGB) alongside the GDPR. In Dr. Korch’s view, the GDPR takes precedence over the law governing standard terms and conditions. The GDPR aims to comprehensively regulate data protection in order to create a European level playing field. An increase in data protection standards by individual Member States through the law governing standard terms and conditions would run counter to this. Even if one were to assume the applicability of the law governing standard terms and conditions, there would still be no enforceable legal standard for assessing the adequacy of contractual clauses relating to data protection. In the ensuing discussion, Dr. Korch advocated for strengthening private enforcement to relieve the burden on the competent authorities and to better enforce data protection provisions.
