A recent opinion published by the European Data Protection Supervisor (“EDPS”) has raised concerns regarding the “commoditisation” of personal data and questioned the uncertainty that could arise from consumers treating their personal data as a currency or as “counter performance” for the receipt of goods, services or other digital content.

As part of the wider EU Digital Single Market program, the proposed EU Directive on certain aspects concerning contracts for the supply of digital content (2015/0287 (COD)) (the “Directive”) is currently winding its way through the EU legislative process. The Directive’s key aim is to establish a single set of rules across the EU governing contracts for the sale and rental of digital content and contracts for digital services. The scope of the Directive covers the supply of digital goods for a price, or crucially, where a consumer actively provides “personal data or other data as counter-performance” – for example where services are provided “for free” on this basis. This may often be the case when a consumer downloads a “free” app by providing certain of their personal data to the app’s developers for example.

The Directive aims to keep pace with the way technology has developed and to reflect the reality of the way consumers are sourcing and “purchasing” digital content. However, in its Opinion published on 15 March 2017, the EDPS has expressed concerns over potential overlapping regulation between the Directive and the impending General Data Protection Regulation (“GDPR”). In the accompanying press release the EDPS, stated, “the proposed directive should avoid unintentional interference with the data protection rights and obligations set down by the EU last year in the GDPR. Individuals should not be required to disclose personal data in ‘payment’ for an online service. Rather, their rights and interests should be safeguarded by coherent application of up-to-date rules in the consumer and data protection area.”

The key point being made by the EDPS is that consumers are likely to become confused if on the one hand EU law is treating personal data as a mere commodity, while on the other hand protecting it as a fundamental right. Issues regarding freely-given consent for data processing and the existing strict conditions under which processing is permitted (under the GDPR, in effect from May 2018) could, the EDPS argues, be inadvertently interfered with by the wording of the Directive. By way of an example, the GDPR expressly states that consent to data processing will not be valid if it is a condition of a contract, where the processing is not necessary for the performance of that contract. Allowing data to be used as counter performance may mean taking a broad interpretation of the concept of “necessary for the performance of a contract”, to extend to the processing being necessary for the contract to be commercially viable for the provider.

In light of some of this potential conflict, the EDPS believes the undefined term “data as counter performance” is one which is problematic and should ideally be removed from the draft Directive. The Opinion also suggests the Directive should contain an explicit statement that such commoditised data must still be used in accordance with the EU data protection framework.

Despite these concerns, the EDPS’ Opinion did also highlight the positive opportunity to “harness synergies” between increasing consumer protection in tandem with data protection, all in the best interests of the individual.

The text of the Directive is yet to finalised and the view of the likes of the EDPS will no doubt be taken into account when amendments are considered. While the aims of the Directive are clearly admirable, the EU legislators will need to achieve a delicate balance to ensure harmony with not only the GDPR but also the future ePrivacy Regulation whilst accurately reflecting and legislating for the way personal data is currently used to engage with and “purchase” online digital content. As the EDPS points out, unamended the text of the Directive could raise further regulatory headaches for businesses operating in the online digital content marketplace.

To read the EDPS’ Opinion in full click here.