DPA of North Rhine-Westphalia: Linking sweepstakes with newsletters possible under Art. 6 (1) b GDPR but not possible with participants consent

The data protection authority (DPA) of the state North Rhine-Westphalia just recently published its activity report for the year 2020. One very interesting topic covered in there (under 4.2 starting on page 40) deals with companies combining participations in online sweepstake with a newsletter subscription. The authority writes that companies often base the data processing relating to such newsletters on consent and that such a practice is a violation of Art. 4 No. 11 GDPR. It is argued that, as a general rule, such a consent is not freely given and besides that is a violation of Art. 7 (4) GDPR. Interestingly, the DPA states that, under certain conditions, Art. 6 (1) b GDPR is an adequate legal basis for such data processing.

The following translated extract explains the reasoning regarding consent as legal basis. ?The lack of a freely given consent in such cases results from the fact that it is to be considered a disadvantage in the sense of recital 42 (at the end) GDPR that users cannot participate in the sweepstake in case of a refusal of the newsletter subscription. Since the consent of users to email advertising is usually not necessary for the implementation of the sweepstakes (an online sweepstakes can regularly be implemented without sending email advertising), a violation of Art. 7 (4) GDPR is also assumed.”

The DPA's reasoning is generally relevant in practice when companies want to link consent for promotional communications to a contract or service.

In the context of Art. 7 (4) GDPR there is a debate on what the implications of this provision are. One opinion argues that any form of “take it or leave it” is a violation of this provision. Another opinion stresses that Art. 7 (4) GDPR only emphasizes that consent must be freely given and therefore does not go beyond what is already necessary for any consent in accordance with Art. 4 No. 11 GDPR. This is reflected by the wording “assessing whether consent is freely given, utmost account shall be taken”.

The DPA states that Art. 6 (1) b GDPR can generally be an alternative suitable legal basis and explains under which conditions this is the case. “It is contractually agreed between users and website operators that users can participate in the sweepstakes and agree to subscribe to the email newsletter in return. It must be taken into account that the obligation of users to allow the use of their email address for newsletters is reciprocal to the obligation of providers to allow users to participate in the sweepstake. The service of the providers is therefore linked to the data provision by the data subject. The requirement is that this exchange is made transparent to the users. For example, the sweepstake may not be offered "free of charge", but must be openly offered as a two-sided contract "chance to win in exchange for data to receive the newsletter", in which the essential contractual modalities are disclosed to the users”.

Given the fact that obtaining consent in the context of newsletter subscriptions part of participating in an online sweepstake is a quite common practice, the statements made by the DPA are surprising. One could argue that the provision of data for receiving the newsletter would not objectively be necessary for conducting the sweepstake and therefore cannot be justified under Art. 6 (1) b GDPR. However, if the “core” of the specific contract is on one hand the provision of data by participants for receiving the newsletter and on the other hand the possibility to participate in the sweepstake offered by the provider, one could argue that the provision of data is necessary for exercising the specific contract and could therefore be based on Art. 6 (1) b GDPR.

The authority further highlights the need for transparency towards users and the role of tracking of newsletter usage involving multiple companies. “Transparency is likely to be doubtful, for example, if extensive tracking, which is not disclosed to users, is used in exchange for the offer of a web service, which involves the transfer of data to countless other companies. In such cases, it is difficult for users to understand who is processing the data they provide and for what purposes. Subscriptions to a newsletter that can be cancelled at any time, on the other hand, should be assessed differently, provided that the email addresses are not passed on to third parties and are used exclusively for the purpose of sending the newsletter. In our view, this can usually be transparently presented without further problems.”

One point not addressed by the DPA is that email newsletters are a form of advertising and are as such subject to provisions in competition law too. In Germany, Sec. 7 (2) No. 3 UWG?regulates that email advertising is prohibited if there is no consent given by a user and if the conditions of Sec. 7 (3) UWG are not fulfilled. In practice, this often results in the need to use consent for sending newsletters. There are judgments of courts of final instance that have repeatedly emphasized that often consent is needed under competition law. Even an email where a company request customers to give them a rating on a platform is a form of advertisement according to the judgement of the Federal Court of Justice from the 10th of July 2018 in case VI ZR 225/17. Since the data protection authority is not competent in the field of competition law, it might be reasonable that this point was not touched upon in the activity report.

This also brings up the question on the relationship of the legal basis under the GDPR and the requirements in competition law. Even though from a legal perspective, there is no lex specialis relationship (competition law as lex specialis) and therefore both fields of law apply separately, from a practical point of view, one often wants to use the same legal basis for both areas of law. Otherwise, companies would have to obtain consent under competition law and use Art. 6 (1) b GDPR for the data processing under the GDPR. This would also bring up questions dealing with transparency towards data subjects as they would probably often assume that they did not only consent under competition law but also under data protection law.