2.1.1Self-published Data

Internet users, particularly social network users, voluntarily disclose a plethora of personal information on the Internet.5 This information, which is often almost as good as publicly available, typically relates to information about the users’ public but also private life (e.g. addresses, dates of birth, credit card numbers, phone numbers, etc.) and to pictures disclosing further personal elements about the user.

2.1.2Monitoring Online Behaviour

The monitoring of consumers’ online activity primarily aims at collecting consumer data in order to improve existing online processes, deliver better services and provide a better user experience. Additionally, online monitoring is used for security reasons to protect consumers and service providers against malicious online activity. The activity of Internet users can be monitored by observing their digital footprints. Such footprints result e.g. from information voluntarily disclosed by users on websites, the Internet Protocol (IP) addresses of the devices used and further information gathered through the use of cookies and other tracking methods.

IP addresses: To be present online, individuals’ and businesses’ electronic devices need to have a specific, non-physical IP address, which is a numerical label assigned to each device that is connected to the Internet. IP addresses cannot be directly controlled by the users themselves since the allocation of such addresses is (directly or indirectly) derived from the Internet Address Registries. Online electronic devices “communicate” through the use of a traceable IP address, thereby leaving data tracks on visited websites. Monitoring mechanisms record the IP addresses used to automatically analyse the users’ origin, the nature of their requests and the average time spent on the Internet in general and on certain websites in particular6. In addition, these addresses enable the (at least temporary) assignment of data to certain users which can help to identify potentially illegal activities. The advertising industry, however, uses IP addresses to track individual users and to rate the value of an advertisement.7

Cookies and Other Applications: When a user requests a website, quite often, so-called “Internet cookies” are downloaded on the user’s electronic device. These small pieces of information can be used either by the website’s operator or the provider of an advertising banner implemented in such a website and may contain an identifier, typically a string of random letters and numbers.8 Cookies enable servers to identify users by assigning information logged on the server to individual users, thereby enabling advertisers to track users so that they can target them with personalised advertising.9 Further, so-called “web beacons” are used. Web beacons are graphics that are embedded in websites or e-mails pursuing the purpose of online tracking. They enable the originator to determine who accessed a website or read an e-mail, at what time and from which computer such activity took place, etc. In addition to Internet cookies and web beacons, so-called “device fingerprinting” is gaining in importance. For this fingerprinting process, various information about the user’s browser, operating system, system colours, installed plug-ins and typefaces is gathered which, combined, ultimately produces a digital fingerprint of a specific device. This process can be used to identify the user’s device when cookies are not available. In combination with other data, conclusions about the type of device used and the respective Internet user may be drawn.

As a reaction to these developments, numerous networking techniques have been developed in recent years that help avoid any kind of data recording and protect individuals’ privacy in the online world. These techniques include, e.g., privacy enhancing technologies (PET) and anonymizing networking techniques.10

2.1.3Data Theft

In addition to the personal information that users voluntarily disclose online and the information that is gathered through legally permissible monitoring techniques, personal data can also be obtained and gathered through illegal means. Recently, an increase of data theft has been reported as a result of intruders hacking into e-mail accounts, social media accounts or online bank accounts11.

In practice, there are many reasons why hackers choose to engage in data theft. Data, particularly personal data, is a source of great value12. This value is appealing for hackers who seek to gain financial advantages through illegal means13. Further, Internet activists, such as the “Chaos Computer Club” may seek to show technical vulnerabilities. Other activists, such as “Anonymous” or “the Impact Team” may use their technical knowhow for political goals, such as exposing alleged misconduct. One case in point was the breach of the commercial website Ashley Madison, which enabled extramarital affairs.14 In this highly publicised case, hackers penetrated the servers of the company, stole sensitive client information and published the information online15.

2.2.1E-Mail Marketing

Internet users disclose their personal information online with little hesitation, for instance when purchasing products online, in order to obtain a company’s newsletter or to participate in an online contest. Such information typically includes names, dates of birth, postal addresses, credit card numbers and e-mail addresses. Companies gather and store such information and use it to provide users with “traditional” as well as personalised advertisements.

2.2.2Personalised Advertising

The collected data is analysed in order to identify the interests of the Internet users. The knowledge thus acquired enables companies to anticipate which goods each individual customer might need or want. Thus, when such customers visit other websites, they are delivered advertisements that are tailored to their previously identified interests. Such personalised advertising is becoming exceedingly prevalent. In a sense, personalised advertising can be seen as an evolved technique of “retargeting”, whereby users are shown advertisements of products they previously viewed on a website but did not end up buying16, with an added personalisation/customisation dimension.17 The idea behind personalised advertising is that, by indirectly reminding customers of items they considered buying, companies increase the purchase likelihood of the respective customer.

2.2.3Data Vending

Given the nearly infinite possibilities of using personal information for business purposes, businesses consider and use personal data as tradable goods. In recent years, an independent business branch has emerged around the trading of Internet users’ personal information (data vending). Personal data vending, i.e. the sale by commercial data vendors of personal data as a commodity, has become a multibillion-dollar industry.18

3.3.1Processing of Personal Data

The application of data protection law is triggered by any processing of personal data. Both notions of “processing” and “personal data” are construed very broadly, which results in a very broad scope of application of data protection law.

The notion of personal data encompasses “any information relating to an identified or identifiable natural person”, the so called “data subject” (Art. 4 (1) GDPR). Processing refers to “any operation or set of operations which is performed upon personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction” (Art. 4 (2) GDPR).

The compliance of the data processing with the requirements of data protection law must be ascertained by the data controller, i.e. “the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data” (Art. 4 (7) GDPR).

3.3.2Substantive Guiding Principles

The processing of personal data is only legitimate if such processing complies with a number of general principles. According to the GDPR:

For the collection and use of information about consumers, the principles of transparency, purpose limitation and data minimisation are of utmost importance. Therefore, the use cases identified above will have to be assessed with regard to their compliance with these principles.

3.3.3Criteria for Making Data Processing Legitimate

Irrespective of whether or not it complies with the above general data protection principles, the processing of personal data is legitimate only if at least one out of six criteria is met. As such, the processing of personal data is legitimate if any of the below is given:

Both in general and with regard to the collection and use of information about consumers, the most important criterion for the legitimacy of data processing is that of consent. Given that advertising is usually just a first step on the sometimes long way to the conclusion of a contract, the criterion of necessity for the performance of a contract will hardly ever be met in the use cases that will be discussed below. The same holds true for the criterion of the legitimate interests pursued by the data controller since the interest of the consumers in the protection of their fundamental right to privacy will likely always be favoured over the interests of the data controller in targeting/customising its advertisements to an individual consumer.26 Accordingly, the following analysis of the use cases will focus on consent.

Failure to comply with the GDPR has important consequences. First, everyone who has suffered material or immaterial damage as a result of an infringement of the GDPR has a right to receive a compensation from the data controller for the damage suffered (Art. 82 (1) GDPR). In addition, heavy administrative fines can be imposed by the national supervisory authority which is responsible for monitoring the application of the GDPR (Art. 83 GDPR). Such fines, which must be “effective, proportionate and dissuasive” must take into account a number of factors, including whether the infringement was intentional and what action, if any, was taken to mitigate the damage.

3.4.1Self-published Data

The mere fact that data subjects voluntarily publish their personal information online, e.g. on a website or on social media platforms, does not release an advertiser from its duty to comply with the requirements of data protection law. Accordingly, the advertiser may only collect and use such personal information for advertising purposes if the consumer has given his or her consent. Such consent cannot be derived from the mere publication of the data by the consumer since, as mentioned above, consent must be “specific, informed and unambiguous”.27

Due to the consent requirement, it will hardly ever be lawful to use information published on a website by a consumer for advertising purposes. However, this assessment does not apply to the collection and use of information published on social media platforms, since the general Terms of Service (ToS) and the respective privacy policies of such platforms almost always contain provisions that authorise the social media platform providers to use the information published by their users for various purposes, including the display of personalised advertising.28 Plainly, particularly from an ethical perspective, the legitimacy of such behaviour appears to be at the very least doubtful.29 Even from a legal perspective, it is unclear to what extent the provisions of such platforms’ ToS and the respective privacy policies are valid, given that such ToS will be declared invalid in a trial if they cause a significant imbalance in the parties’ rights and obligations to the detriment of the consumer30.

3.4.2Monitoring Online Behaviour

As with the collection of self-published data, the collection of information about consumers through the monitoring of their online behaviour must comply with the requirements of data protection law. An important distinction to self-published data is that, in this scenario, consumers do not intentionally provide their personal information. Despite the public debate and the vast media coverage regarding the surveillance issue, particularly since the Snowden revelations, there are still consumers who appear to be unaware of the fact that their online behaviour is being monitored by Internet service providers, web publishers, social media operators and other online businesses. To make matters worse, even those who are aware of the ongoing monitoring activities do not have the means to know the exact extent to which data about them is being collected, what other data it will be combined with and for what purposes the data will be used.

Monitoring the online behaviour of consumers for advertising purposes is only lawful if the conditions of the GDPR are met. These conditions are twofold: First, the information must be collected in a transparent manner (i.e. an open and honest manner) and for specified, explicit and legitimate purposes and it must be limited to the minimum necessary in relation to these purposes.31 Second, the consumer must have given his or her informed consent to the processing of his or her personal data. As with self-published data, consumers are often required to consent by merely checking a box indicating their agreement with the ToS of a website or an Internet service provider and the respective privacy policy. However, the processing of data based on such consent is only lawful if the consumer has been informed about the collection and use of his or her personal data in a way that enables him or her to actually understand what the data is being collected and used for. Given that numerous privacy policies only provide very general and vague information about the use of personal data, the requirement of informed consent often fails to be fulfilled.

In addition to the general requirements of the GDPR, the EU Directive on Privacy and Electronic Communications 2002/58 (E-Privacy Directive)32 contains a specific provision regarding the use of cookies. According to this provision, the use of cookies is only allowed if the user concerned has given his or her consent after having been provided with clear and comprehensive information about the purpose of the processing of his or her personal data.33 Website providers most often attempt to fulfill this requirement through the use of a pop-up window that informs the Internet user about the intended use of cookies and requires the user to agree to such use by checking a box embedded in the pop-up window. In principle, if the user does not check the box, he or she is deemed not having given his or her consent to the use of cookies. However, even if the user does not, in effect, check the box accepting cookies, to the extent he or she is given a clear and unavoidable notice that cookies will be used and, on that basis, chooses to nevertheless access the website, website providers could, under certain circumstances, rely on so called “implied consent” in order to serve such user with cookies.

3.4.3Data and Identity Theft

The term data theft describes the illegal transfer and storage of any personal and confidential information such as passwords, social security numbers or credit card information from a business or an individual. Identity theft is the use of someone else’s identity by using another person’s personal data. Data and identity theft may constitute criminal offenses. In addition, such acts will often fail to comply with the requirements of data protection law, namely if stolen data is disclosed to third persons and/or used for commercial purposes.

3.5.1E-Mail Marketing

The e-mail addresses that advertisers require for the purpose of carrying out e-mail marketing can be collected from various sources.34 If the e-mail address consists of or contains the real name of an individual consumer or if the provider of the e-mail address otherwise allows the advertiser to identify the individual consumer, the acquiring of the e-mail address and the sending of an e-mail to this address qualifies as processing of personal data. If the e-mail address consists of a pseudonym, the sending of e-mails to such an address qualifies as processing of personal data only to the extent the owner of the email-account can be identified by other means, e.g. by using additional information that has been collected or is readily available. If a consumer can be identified, the sending of e-mails to this consumer must comply with the general requirements of the GDPR, namely the transparency principle and the requirement of informed consent. Accordingly, the consumer must be informed about the storing and use of his or her e-mail address for advertising purposes and he or she must consent to such use.

In addition to these general requirements, the E-Privacy Directive contains a specific provision to fight spam mail. According to this provision, the use of e-mail for the purpose of direct marketing is only allowed in respect of subscribers or users who have given their prior consent.35 If a business has obtained electronic contact details, such as an e-mail address of its customer, the business may use such contact details for the marketing of its similar products or services, provided the customer is given the opportunity to object to the use of his or her electronic contact details free of charge and easily.36 Accordingly, all e-mails sent to consumers for marketing purposes must include a button, a link, a reply-mechanism or the like that allows consumers to unsubscribe from the respective mailing list with only a few clicks.

3.5.2Personalised Advertising

In order to target consumers and carry out personalised advertisements, advertisers must be in a position to distinguish individual consumers and identify their needs. In the offline world, such practices would generally require advertisers to identify individual consumers by their real name, e.g. in order to send personalised advertisements to their physical address. In the online world, however, consumers can be targeted with personalised advertisements if the advertiser is able to recognize an individual consumer as being the same consumer who engaged in a specific behaviour and/or expressed an interest in a specific product or service at an earlier stage, e.g. when visiting a website, searching for a product, or clicking on the link to an advertisement. As a consequence, personalised advertising is possible in an online environment without knowing the actual identity of an individual consumer.

From the perspective of data protection law, the fact that consumers can be recognized and retargeted in the online environment without knowing their real name or their physical appearance raises the fundamental question of how the notion of an “identified or identifiable natural person” is to be understood. Does this notion require that the natural person can be identified as a physical being, ultimately by knowing his or her real name? Or is it sufficient if an individual Internet user with individual characteristics can be distinguished from other Internet users without being able to actually link the profile of this individual Internet user to a physical being? Since this question is still being debated and since authorities tend to favour a broad understanding of the notion of identified or identifiable natural person,37 advertisers should ensure that personalised advertisements consistently comply with the general data protection principles, particularly the principles of transparency, purpose limitation and data minimisation, and that personalised advertising campaigns are based on consumers’ informed consent.

3.5.3Data Vending

The sale of personal data consists of at least two aspects. First, a sales contract is concluded pursuant to which the seller undertakes to transfer personal data to the buyer and the buyer undertakes to pay the agreed sales price. Second, the seller transfers the personal data and the buyer pays the agreed sales price. While the conclusion of a sales contract is irrelevant from the perspective of data protection law, the actual transfer of personal data or the granting of access to such data qualifies as data processing. More specifically, such acts qualify as a “disclosure by transmission” or a “making available” of personal data.38

As a consequence, the sale of information regarding consumers must comply with the general data protection principles and be based on the consumers’ informed consent. Such consent is usually granted by way of having consumers agree to privacy policies that typically allow the data controller to transfer the data to third parties. If consumers have generally agreed to such transfer, the data controller is not required to obtain additional consent from the consumer when undertaking the actual sale and transfer of the data. In addition, since consumers do not “own” their personal data, they are not entitled to any share of the sales price that the buyer pays to the seller in consideration for the acquisition of the consumers’ personal data.

4.4.1Collecting Personal Information

With regard to ethical or moral considerations, it is not possible to refer to specific regulations. At first glance, it could seem that the automatic collection of self-published data and the monitoring of Internet users’ online behaviour do not raise any ethical issues. This may be true in particular if the collection of (the intentionally/voluntarily and unintentionally provided) data serves a valid purpose, such as the protection of other Internet users or even the democratic order. But, the average consumer is not necessarily well-informed about the fact that any data that he or she provides or generates online, including his or her personal information such as physical addresses, pictures or IP-addresses, will potentially be stored “somewhere”. Therefore, the stance taken here is that entities collecting such data should be required to take measures to sufficiently protect such data against data breach and theft.

Where data is collected primarily for advertising purposes, transparency is particularly crucial. Transparency requires that Internet users be informed in advance about the fact that their data is being collected so that they may use the Internet with full awareness of the consequences. The collection of (personal) data without appropriate prior information/disclosure to Internet users and particularly the use of cookies and other tracking mechanisms allowing the establishment of a user’s profile (browsing and purchasing habits, demographic data, and statistical information, etc.) is ethically questionable.

4.4.2Using Personal Information

While the issues raised by the collection of personal data may appear to be relatively contained, the use of such data inevitably raises difficult questions. The establishment of data profiles allowing corporations to provide data subjects with personalised advertising serves no other goal than that of financial gain. The pursuit of financial gain does not in itself raise ethical problems as long as the Internet user is duly informed about both the collection and the processing of his or her data. In this context, ethical behaviour requires transparency during the entire process, from the provision of adequate information regarding the storage of (personal) data through the compliance with the right of Internet users to be informed about the storage of their data to their right to object to the storage and transfer of their data.

From an ethical point of view, data vending deserves special attention. Indeed, trading Internet users’ personal data inevitably raises numerous ethical questions, such as: Is the Internet user aware of the fact that his or her data is being traded, does he or she know what data is being traded, who obtains the data, is the data duly protected against data breaches, etc.? In addition, consent to store personal data does not automatically include the right to “sell” such data. More importantly, the largely uncontrolled proliferation of data to a large extent undermines the right of Internet users to decide how their data shall or shall not be published.