DISCLAIMER: same as on other blog posts. This isn't legal advice. This isn't even advice... Prior to GDPR’s going into force in May 2018, English football powerhouse Manchester United asked its fans to opt-in to Man United continuing to hold their email addresses and other personal details and using them to enable the fans to stay up to date with news and promotions. To make sure that fans were even more likely to consent, Man United offered those fans who opted in 20% off Adidas products by way of reward (ManU's sponsorship costs the German sports apparel company a cool £75M per season).
This promotion raises the question of whether consent to process an individual’s data that is attached to a tangible benefit, and conversely, non-consent leading to a loss of such benefit, can be considered a valid consent under GDPR?
Under GDPR Article 7 and Recital 42, in order for consent to be valid, it must be “freely given”. Specifically, the recital states that “consent should not be regarded as freely given if the data subject… is unable to refuse or withdraw consent without detriment.”
The Guidelines on Consent under Regulation 2016/679 by the Article 29 Data Protection Working Party – now the European Data Protection Board – provides that “‘free’ implies real choice and control for data subjects. As a general rule, the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid.”
As it relates to the Manchester United promotion, the question is essentially whether losing out on the ‘20% off Adidas products’ reward would be considered a ‘detriment’ and whether fans who do not opt in, and thus would not receive the discount, would endure ‘negative consequences’?
On the scope of ‘detriment’ Working Party 29 in the guidelines (Section 3.1.4) maintains that “the controller needs to prove that [refusing or] withdrawing consent does not lead to any costs for the data subject and thus no clear disadvantage for those [refusing or] withdrawing consent.”
The Supreme Court of Italy, in a 2018 case, gave considerable weight to the question of whether the service, to whom the data subject must consent to use her or his personal data, is unique in the sense that the data subject cannot obtain the same services somewhere else. The court concluded that only in such circumstances would it be justified to ban the bundling of consent with an incentive to those who consent.
On the face of the facts, it seems clear that fans who do not agree to Manchester United processing their personal data for marketing purposes will not be able to take advantage of the Adidas discount. However, framed differently, the promotion simply offers that providing one’s personal data is the ‘price’ of gaining access to the Adidas discount and that without opting in by permitting Man United to use one’s email address and other personal information, one has not ‘paid’ for privilege of buying Adidas products at a reduced cost.
Viewed this way, there is no inherent ‘right’ for a person to get a 20% discount on Adidas products that is being ‘withheld’ by the implementation of Manchester United’s reward offer to those who consent to the club using their personal information. Furthermore, there is no obligation on any person to buy Adidas products at all.
Therefore, it would be difficult to construe the losing out on the 20%-off reward as a true ‘detriment’ or ‘negative consequence’ to those who do not consent to Manchester United processing their personal data. Equally important, those who do opt in can be said to have ‘freely given’ their consent, thus rendering the football club’s campaign GDPR valid and simply a clever targeted incentive to attract their fans to allow the processing of their personal data.
The ICO has written that in its view “it may still be possible to incentivise consent to some extent. There will usually be some benefit to consenting to processing. For example, if joining the retailer’s loyalty scheme comes with access to money-off vouchers, there is clearly some incentive to consent to marketing. The fact that this benefit is unavailable to those who don’t sign up does not amount to a detriment for refusal. However, you must be careful not to cross the line and unfairly penalise those who refuse consent.”
In other words, incentivizing consent is OK, but there is a thin line between incentivizing consent and a detriment for refusal. Say, for example, if Man United would offer better seats only to fans who consented to data processing, that would likely be a detriment for refusal of consent and would render that consent not ‘freely given’.
Summary: When an organization wishes to rely on consent as the lawful basis for processing personal data of its consumers, it must ensure that such consent is obtained in a “freely given” manner. However, that does not preclude it from extending a benefit to those individuals who do provide consent, so long as those who refuse consent are not made to suffer a meaningful loss as a result. Simply not being able to take advantage of a reward would not meet the threshold of ‘detriment’ or ‘negative consequence’ being endured.