Recital 34*

Go to related Article 7

Commission proposal

(34) Consent should not provide a valid legal ground for the processing of personal data, where there is a clear imbalance between the data subject and the controller. This is especially the case where the data subject is in a situation of dependence from the controller, among others, where personal data are processed by the employer of employees’ personal data in the employment context. Where the controller is a public authority, there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given, taking into account the interest of the data subject.

EDRi’s Proposed amendment

(34) Consent should not provide a valid legal ground for the processing of personal data, where there is a clear imbalance between the data subject and the controller. This is especially the case where the data subject is in a situation of dependence from the controller, among others, where personal data are processed by the employer of employees’ personal data in the employment context, or where a controller has a substantial market power with respect to certain products or services and where these products or services are offered on condition of consent to the processing of personal data, or where a unilateral and non-essential change in terms of service gives a data subject no option other than accept the change or abandon an online resource in which they have invested significant time. Where the controller is a public authority, there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given, taking into account the interest of the data subject.

Justification
Many social media sites lead users to invest significant time and energy in developing online profiles. There would be a clear imbalance, in the sense of the Commission’s proposal, in any situation where the user was given the choice between accepting new and unnecessary data processing and abandoning the work they have already put into their profile. Another case of clear imbalance would be if the market for the service in question is monopolistic/oligopolistic, so that the data subject does not in fact have a real possibility to choose a privacy-respecting service provider . Data portability would not fully address this issue, as it does not resolve the loss of the network effects in larger social networks.

Advertisements
  • eu logo The launch and upkeep (until December 31, 2013) of this website received financial support from the EU's Fundamental Rights and Citizenship Programme.
%d bloggers like this: