The Austrian Federal Administrative Court (BVwG) has ruled that the “Pay or Okay” model that was implemented by Austrian newspaper Der Standard violates the GDPR, confirming an earlier decision by the Austrian data protection authority, the DSB.
Der Standard was the first newspaper in Austria to introduce a “Pay or Okay’” business model when the General Data Protection Regulation (GDPR) came into effect in May 2018.
When visiting the website, users were offered the option to allow the site to process and share their personal data with hundreds of third parties for ad tracking, or to opt for a paid monthly subscription of €9.90 to have their privacy respected.
According to noyb, 99.9 percent of all users agreed to online tracking, while only one to seven percent actually want to be tracked for online advertisements if asked openly. The privacy advocacy group calls this “North Korean consent rates.”
The DSB argued that there’s no general issue with Pay or Okay, but at the same time held that Der Standard’s approach to this business model was implemented unlawfully because it only offers a global consent or rejection option, while European privacy law requires the option to consent to specific types of processing.
Der Standard appealed and argued that such a “granular” consent is impossible to implement in a Pay or Okay system. The newspaper claims that it should be able to track users in the non-paid version and collect statistics to sell advertisements.
The Austrian Federal Administrative Court has ruled that Der Standard did not have valid consent for the processing of users’ data, thereby dismissing the appeal. However, the judge does offer the option to appeal its ruling to the Supreme Administrative Court (VwGH).
“Instead of criticizing the overall approach and saying that consent rates of 99.9% show that consent was not ‘freely given,’ they ended up touching upon a minor issue. What we have here is a pure ‘fake choice’ that basically no one wants or uses, just to pretend that users would have an option,” noyb Chairman Max Schrems responded to the verdict.
He thinks it’s likely that the case will be decided at the Court of Justice of the European Union (CJEU).
Your email address will not be published. Required fields are markedmarked