Deconstructing the logical flaws in noyb’s automotive consent or pay allegory

Getting some serious “You wouldn’t steal a car”* vibes from NOYB’s “Imagine having to pay for privacy in your own car” consent-or-pay allegory.

I have been advising on the idea of “consent or pay” (or “pay or data”, “pay or OK” or however you wish to call it) for a few years now, and the discussion invariably revolves around three broad questions:
– Do the rights to privacy & data protection prevail over all else? (let’s not forget the GDPR lays down the rules for lawful interferences with the right to data protection – if you comply with the GDPR, that “fundamental right” argument is in effect irrelevant, so it shouldn’t be seen as – like campaigners have put it – a situation in which “users have to �purchase� their Fundamental Rights from controllers”)
– Is consent an appropriate legal ground (or is it simply required due to other legislation / case law / regulators’ positions)?
– Does the implementation of consent meet the GDPR requirements, and in particular, is it freely given? (lots to be said about this)

In reality, several EU-based data protection authorities have already publicly confirmed that this business model is lawful if certain conditions are met. No prohibition by default – instead, permission if there is genuine equivalence in terms of content and service (aside from the presence of ads and the payment aspect, obviously).

Just like NOYB and 27 other NGOs have worked together on a letter to the EDPB, urging them to take a particular position, some clients have reached out with their own concerns, and I am helping certain organisations in preparing comments for the EDPB. It might not come as a surprise that some organisations do not share the perspective of the aforementioned NGOs, so not all letters that the EDPB receives will be aligned with the NOYB-related one.

Reach out if you feel that your sector or your organisation specifically would benefit from making its voice heard on the topic and you think you could use a hand in getting your point across in a manner that takes into account the legal context and implications.

gdpr privacy eprivacy

* For anyone who doesn’t know or cannot remember those wonderful anti-piracy ads, here is the Wikipedia page: https://lnkd.in/esZwVPMF