Following a complaint by noyb, the Hamburg data protection authority declared the use of controversial ‘Pay or OK’ systems to be permissible. However, the procedure raises considerable questions: Although the authority was in active dialogue with news magazine DER SPIEGEL, it did not hear the person concerned once during the proceedings. Many relevant facts were never investigated. In a parallel case, the authority is even said to have actively motivated a company to demand money for saying ‘no’ to the cookie banner. The person concerned has therefore filed a lawsuit against the data protection authority with the Hamburg Administrative Court.
Background to ‘Pay or OK’. In the summer of 2021, the complainant submitted a GDPR complaint against the ‘Pay or OK’ banner on the website of DER SPIEGEL. At the time, he (and all other users) had to decide whether to allow the news magazine to use personal data or take out a paid subscription. The authority then took almost three years to determine that it considered ‘Pay or OK’ to be permissible in principle. However, there is no serious discussion of the facts in the decision. There is no justification as to why users having to pay for their basic rights should constitute voluntary consent and genuine freedom of choice. It is known that more than 99.9% agree to tracking when confronted with ‘Pay or Okay’. Yet only 3-10% actually want personalised advertising. In the meantime, even the EU Commission has expressed considerable doubts about the legality of the model.
Max Schrems, Honorary Chairman of noyb: “The use of ‘Pay or Okay’ results in a consent rate of 99.9%. Not even the GDR achieved such a high level of fake consent. There can be no question of voluntary consent here. It just seems that the Hamburg authority don't want to know about such figures.”
Cheap legal advice for SPIEGEL. The Hamburg DPA was in close contact with SPIEGEL during the proceedings. Instead of investigating and deciding impartially, it also met with representatives of the company several times, invited them to its premises and provided feedback on the proposed changes. For the administrative costs of the procedure, the Hamburg authority charged SPIEGEL € 6,140. Another media company had previously even been proactively encouraged by the Hamburg authority to switch to ‘Pay or OK’. It can be assumed that the authority actively encourages companies to engage in problematic behaviour. Incidentally, the complainant was only informed of all this after the decision had been made. He was not heard by the authority. The majority of his messages to the authority were not even answered.
Dr Raphael Rohrmoser, lawyer for the complainant: “The Hamburg data protection authority has obviously provided SPIEGEL with legal advice. The administrative fee charged by the data protection authority is likely to be significantly lower than the fees charged by law firms providing legal advice. For SPIEGEL, the authority’s approach represents a win-win situation.”
Lawyer and judge at the same time. Considering that the Hamburg authority provided legal advice to SPIEGEL during the proceedings, it is unlikely to make a decision in future that contradicts itself. According to the GDPR, data protection authorities are supposed to ‘sensitise’ companies, but not advise them. Their task is to investigate complaints and make an impartial decision based on their investigations.
Max Schrems, Honorary Chairman of noyb: “Nobody should be a lawyer and a judge at the same time. However, the Hamburg data protection authority seems to see no problem in advising companies or even actively calling for the introduction of ‘Pay or OK’ instead of objectively investigating the facts. It is obvious that the authority will not consider the changes it has arranged as illegal.”
Lawsuit against the authority. The complainant has now filed a lawsuit with the Hamburg Administrative Court to have the DPA's decision overturned. If this action is successful, the authority would have to decide again on the complaint from 2021.
The complainant is represented by Dr Raphael Rohrmoser from AdvoAdvice.
