# Recommended for You: “You Don’t Need No Thought Control”. An Analysis of News Personalisation in Light of Article 22 GDPR

Judith Vermeulen

► To cite this version:

Judith Vermeulen. Recommended for You: “You Don’t Need No Thought Control”. An Analysis of News Personalisation in Light of Article 22 GDPR. 14th IFIP International Summer School on Privacy and Identity Management (Privacy and Identity), Aug 2019, Windisch, Switzerland. pp.190-205, 10.1007/978-3-030-42504-3_13. hal-03378982

HAL Id: hal-03378982

https://inria.hal.science/hal-03378982

Submitted on 14 Oct 2021

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Recommended For You: “You Don’t Need No Thought Control”
## An Analysis of News Personalisation in light of Article 22 GDPR

Judith Vermeulen

Ghent University, Ghent, Belgium

**Abstract.** More and more often personalisation at news websites is being introduced. In order to be capable of providing suggestions, recommender systems create and maintain a user profile per individual consumer that captures the latter’s preferences over time. This requires the processing of personal data, and more specifically its collection and use for both profiling purposes and the eventual delivery of recommendations. In view of the fact that providing users with individualised news recommendations is usually realised by solely automated means and may in some cases violate people’s absolute and non-derogable rights to freedom of thought and freedom of opinion, it could be prohibited on the basis of Article 22(1) of the EU General Data Protection Regulation. Online newspapers ideally abstain from becoming personalisation-only forums and give users some form of control as regards the determination of their reading preferences and interests.

**Keywords:** News Personalisation, News Websites, Automated Individual Decision-making, Article 22 GDPR, Fundamental Rights, Freedom of Thought, Freedom of Opinion.

## 1 Introduction

A banner titled “your privacy” pops up when visiting the website of The Guardian: “We use cookies to improve your experience. To find out more, read our privacy and cookie policy” [1]. Such ‘improvement’, so a (rare) consultation of the latter reveals, includes amongst others “showing readers journalism that is relevant to them” [2]: a bespoke offer based on what you like. Which proportions said customisation takes on, how such impacts user interfaces, and to what extent items are still distributed to everyone in the same way, is not clarified.

The reinvention by this newspaper of its service of providing people with news as well as its way of announcing it appears to be no stand-alone example, on the contrary. Thus seemingly unnoticed – hardly anyone actually runs through those policies before pressing the prominent button “I’m OK with that” –, news *personalisation* by online news providers, both web-editions of traditional news outlets and digital-only news sites, appears to become commonplace. Simultaneously, the era of *mass* distribution of information and opinions by the press to all citizens alike may be coming to an end.
In what follows, first, the phenomenon of news personalisation at news websites will be described; second, it will be analysed whether this practice falls within the scope of Article 22 GDPR, which contains a general prohibition on automated individual decision-making having legal or similarly significant effects, and if so, what would be the consequences thereof; finally, there will be a conclusion.

## 2 News personalisation at news websites

Neil Thurman, Professor of Computational Journalism, has been studying the phenomenon of news 'personalisation', 'customisation' or 'individualisation' already since 2011 [3, 4]. He, together with Steve Stifferes, Professor of Financial Journalism, defines it as "a form of user-to-system interactivity that uses a set of technological features to adapt the content, delivery, and arrangement of a communication to individual users' explicitly registered and/or implicitly determined preferences" [5, 6]. They consider it to be the result of a set of "complex interactions that exist between computer algorithms and those behind their logic, data about individual and aggregated user behaviour, decisions on classification and indexing, explicit user choices, editorial and journalistic decisions, and user profiles, demographics and location" [6]. From their definition, it is moreover clear that these authors make a distinction between two different ways to determine user preferences: explicit and implicit personalisation [6]. In the former case, users actively register their interests [3, 6]. They could, for example, be allowed to select their favourite topics or columns and be enabled to always easily access them via a "My Page" or "My News Feed"-function [7]. The latter technique on the other hand covers situations in which user preferences are inferred "from data collected, for example, via a registration process or via the use of software that monitors user activity" [3, 6]. There, the goal could be to personalise what stories people see on the homepage [8].

Personalisation at news websites could also take the form of recommendations as to what to read next in a sidebar or below articles, a customised page besides a homepage, mobile editions or apps offering customisation options etc. [9, 10].

From a computer science perspective, research regarding news recommender systems has for the most part concerned either content-based filtering, collaborative filtering or hybrid approaches [11, 12]. The first-mentioned method consists in the analysis of a set of items by means of feature extraction techniques in order to represent their content in a form suitable for the next processing steps; the subsequent building of a model comprising a structured representation of user interests based on the features of the items 'rated' (see *infra*) by that user; and, finally, the recommendation of new interesting items using these profiles [13]. Collaborative filtering, on the other hand, relies on user-item responses or 'ratings' (see *infra*) of an individual user *u* as well as those of other users in the system [14]. Recommendations are made by finding correlations among users of a recommendation system [15]: "[t]he key idea is that the rating of *u* for a new item *i* is likely to be similar to that of another user *v* if *u* and *v* have rated other items in a similar way. Likewise, *u* is likely to rate two items *i* and *j* in a similar fashion, if other users have given similar ratings to these two items" [14]. User-item
ratings can, moreover, either be used directly to predict ratings for new items, or employed to learn a predictive model [14]. Hybrid systems combine several filtering techniques, such as the aforementioned ones, in order to further improve their results [16, 17].

<figure><img src="image_2.png" /><figcaption>**Figure 1.** Collaborative filtering and content-based filtering [18].</figcaption></figure>

In order to be capable of providing suggestions, recommender systems, in any event, need to create and maintain a user profile per individual consumer that captures the latter's preferences over time [11]. Each type of recommender system however has its own approach to learning user profiles as they use different kinds of data and represent information in a different manner [15]. Often, the content of read news items is used to deduct consumer interest (content-based filtering) and/or user features are being considered in comparison to those of others (collaborative filtering) [11]. Some approaches, in addition, consider people's demographic information, for example, to overcome the so-called cold-start problem, which refers to situations where either little is known about a user's preferences or an item has not sufficiently been viewed or rated [11, 19].

In as far as the provision of customised reading suggestions to consumers is based on ‘information relating to an identified or identifiable individual’ – thus leaving aside item-only data used in content-based filtering –, the data used qualifies as ‘personal data’ within the meaning of Article 4(1) of the EU’s General Data Protection Regulation (‘GDPR’) [20]. In terms of personal data ‘processing’, which the GDPR defines as “any operation or set of operations [that] is performed on personal data or on sets of personal data” [20 art 4(2)], news personalisation essentially evolves in three stages: collection, profiling and recommending [21].

First of all, news providers, gather several data points per reader. Hence, they keep record of information provided by users when creating an account (e.g.: gender, age, location) or for receiving newsletters (e.g.: email address), as well as of so-called user ‘ratings’ [22]. The latter take a variety of forms as they can be either scalar/numerical (e.g.: 1-5 stars), ordinal (e.g.: agree, neutral, disagree), binary (e.g.: like/dislike), or unary in case the interaction of a user with an item is implicitly captured (e.g.: time
spent browsing it). The amassing of the latter can take place through the use of cookies, which can be described as small pieces of data a site asks your browser to store on your computer, tablet or mobile phone [23]. They allow the recognition of your device upon return and remember, depending on their specific function, certain of your actions and preferences over time [23]. In a second step, the collected material is evaluated – where appropriate in combination with data relating to other users – using statistics and artificial intelligence, to predict a news consumer’s preferences or interests, and consequently, what news items are most suitable to recommend to him or her [16, 24]. This process coincides with the GDPR-definition of ‘profiling’ [20 art 4(4)]. Finally, users are offered recommendations – which can be reflected in user interfaces in several manners (see *supra*) – in relation to specific items when (re-)visiting news sites.

## 3 A prohibition based on Article 22 GDPR and freedom to form thoughts and opinions concerning matters of general interest

In view of the foregoing, the question arises whether Article 22 GDPR on ‘automated decision-making, including profiling’ applies to news personalisation as described and if so, what would be the implications thereof.

The first paragraph of said provision provides that:

> "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her".

According to the Article 29 Data Protection Working Party, the previous independent European advisory body on data protection and privacy and predecessor of the European Data Protection Board, Article 22(1) contains a general prohibition and is accordingly relevant regardless of whether a potentially affected individual takes any action [25]. Instead, its applicability depends on the fulfilment of two requirements: a decision involving a natural person must be made ‘solely’ as a result of automated processing, including profiling, *and* affect a data subject’s legal rights or produce an effect concerning him or her that is equivalent or similarly significant in its impact [25].

### 3.1 Generating news recommendations by solely automated means

As regards the first criterion, the Article 29 Group explains that “[a]n automated process produces what is in effect a recommendation concerning a data subject” [25]. As becomes clear from the descriptions above, in case of news personalisation, a set of operations is performed on personal (user), and in case of content-based filtering also non-personal (item), data which results in (a list of) recommended content [16]. For the purposes of Article 22, each individual suggestion can be considered a ‘decision’ based on the ‘processing’ of personal data, and more specifically, on its collection for learning user profiles and predicting individuals’ (lack of) interest in certain items, and use to eventually offer news consumers individualised suggestions [10]. Recommendations are moreover generated by ‘solely automated means’, which entails that an algorithm
decides which articles will be proposed and that their delivery to the reader happens automatically, without any prior meaningful assessment by a human [25]. Recommender systems, indeed, “provide *automated* and personalised suggestions [...] to consumers” (emphasis added) [14]. They “have evolved to fulfil the natural dual need of buyers and sellers by *automating* the generation of recommendations based on data analysis” (emphasis added) [26 at “Recommender Systems”].

## 3.2 Limitations on the basis of the freedom to form thoughts and opinions concerning matters of general interest

To fall within the scope of Article 22 GDPR, decision-making furthermore needs to produce either ‘legal’ or ‘similarly significant’ effects concerning the data subject [25]. We argue that news personalisation may potentially interfere with – and thus violate (see *infra*) – a person’s fundamental rights to freedom of thought and freedom of opinion and could therefore indeed affect his or her legal rights in breach of the prohibition laid down by said provision [25].

Freedom of thought and freedom of opinion are respectively contained in two consequent provisions of the European Convention on Human Rights (‘ECHR’) [27]. More specifically, Article 9(1) ECHR provides that “everyone has the right to freedom of thought” – as well as of “conscience and religion” –, while Article 10(1) ECHR, on freedom of expression, grants individuals “freedom to hold opinions”. According to the majority opinion in legal doctrine, these two freedoms essentially overlap in scope [28, 29], which is why we consider them as one and the same for the purposes of the analysis in this contribution. Statements concerning either one of them will therefore also be considered true in relation to the other. These freedoms involve the area often referred to as the *forum internum* [30]. It is crucial to note that they are absolute and unconditional and can therefore not be restricted or interfered with without being violated [28, 31, 32]. Indeed, Article 9(2) ECHR only allows limitations in relation to the freedom to *manifest* one’s religion or beliefs. Whereas Article 10(2) ECHR, on the other hand, in general terms provides that the exercise of the freedoms listed in its first paragraph (see *infra*) may be subject to restrictions, the Council of Europe’s Committee of Ministers has stated that allowing any in relation to the freedom to hold opinions “will be inconsistent with the nature of a democratic society” [33].

The right to freedom of thought and opinion, apart from freedom to *have* and *hold* thoughts and opinions (first dimension), also guarantees freedom to *form* and *develop* them (second dimension) [31, 34]. This latter liberty in particular constitutes the subject of further analysis in the context of this contribution. In the past, States have not found it difficult to allow people freedom to think [35]. Some even considered it impossible to restrict this freedom as it protects the realm of the mind (*forum internum*) [29]. This may explain the lack of case-law specifically dealing with the freedoms of thought and opinion up to now. In view of the emergence of new technologies such as those described above, their value may nonetheless become more tangible [36–39]. Importantly, the guarantee of the right to freely form and develop thoughts and opinions depends on the right to receive information and ideas. Indeed, the free formation of thoughts and opinions is only possible when one is properly informed [29]. People are *influenced* by
the information they are presented with [40]. When such influencing reaches an unacceptable level, the right to freedom of thought and opinion will however be considered *interfered with* [28, 41–43]. The freedom of opinion formation, in turn, constitutes a prerequisite for the realisation of a person’s right to freely *express* his or her thoughts and opinions, for these have to be conceived before the can be voiced [31]. This latter right as well as the freedoms to receive and impart information and ideas are also encompassed in Article 10(1) ECHR. It may be pointed out that these, unlike the freedom of thought and opinion, *can* justifiably be restricted, provided that the conditions thereto laid down by Article 10(2) ECHR in that regard are fulfilled [29].

At this point, it is important to note that the freedom of expression rights serve a dual purpose. More specifically, they are directed at both the *individual* and the *citizen* [29]. In the first place, freedom of expression, as other liberal rights, enables *individuals* to ward off interferences by the State [28]. As such it delineates a sphere of *freedom* or autonomy for their personal development [29]. People are *free to form* inner – purely private – *thoughts and opinions* as well as *to express them* publicly in the “market place of ideas” without fear of repression [28]. While the latter takes place in public, it is nonetheless considered an essential component of the individual’s privacy being the externalization of one’s personality [28, 29]. Next to ‘liberté-autonomie’, the freedom of expression is also conceived as ‘liberté-participation’ [28]. As such, it aims at the social integration of a person in society rather than at warding off interferences [28]. In accordance with settled case-law of the European Court of Human Rights (‘ECtHR’), *citizens* have, more specifically, the right to *express their opinions* on political matters as well as regarding issues of public interest more generally and, accordingly, to take part in public debate [44, 45]. The Court considers, more generally, that “freedom of political debate” – to be understood as including debate on all matters of public interest [46] – “is at the very core of the concept of a democratic society which prevails throughout the Convention” [47]. Accordingly, it ruled on several occasions that it requires “very strong reasons for justifying restrictions on such debate” [45, 48]. The twofold function of Article 10 of the European Convention was famously underscored by the ECtHR for the first time in its *Handyside v. the UK* judgment where it stated that “[f]reedom of expression constitutes one of the essential foundations of [a democratic] society, one of the basic conditions for its progress and for the development of every man” [49]. Both purposes are moreover complementary. Whereas ‘uninfluenced’ – in as far as that is possible – *opinions of individuals* form the basis of democratic debate, taking part therein as a *citizen* constitutes the best method to safeguard the autonomous sphere [29].

Importantly, the Court in Strasbourg views the press as the most important enabler for the realisation of the public debate freedom [50]. This explains both why this actor is attributed special protection (which will however not be the subject of further discussion here) and assigned certain responsibilities under Article 10 of the Convention [50]. In *Leander v. Sweden*, it was decided that a person, in general, has a right to receive information and ideas that others wish or may be willing to impart to him or her [51]. However, in cases such as *Lingens v. Austria* and *Şener v. Turkey*, the Court held that the press has the *task* of imparting information and ideas on political issues just as on those in other areas of general interest and that the public has a right to receive them
[47, 52]. This was explained by the fact that freedom of the press affords the *public* one of the best means of discovering and forming an opinion [47, 52]. In the case of *Khursid Mustafa v. Sweden*, which concerned a conflict between two private parties, the Court confirmed that also *individual applicants* are free to receive “political and social news” or “reports on events of public concern” as they constitute “the most important information protected by Article 10” [53]. The freedom to receive information and ideas can thus be considered dependent on the freedom to impart information and ideas [33].

Freedom to receive information and ideas moreover entails that people are free to consume available content and undertake the necessary steps to inform themselves [29]. They may gather information through all possible lawful sources [33]. As such, everyone has the right to buy books, magazines or newspapers [29]. Whereas *publishing* can be considered to take place in the public sphere, *reading* on the other hand is in essence a private activity [50]. In that regard, it can be noted that the EU High-Level Expert Group on Artificial Intelligence identified ‘respect for human autonomy’ as the first of four ethical principles which should be respected in order to ensure that AI systems are developed, deployed and used in a trustworthy way [54]. Rooted in human rights theory, this norm puts forward that “humans interacting with AI systems must be able to keep full and effective self-determination over themselves, and be able to partake in democratic process” [54]. As explained above, the participation of citizens in society indeed necessitates individual autonomy (and vice versa) [29].

<table><caption>**Figure 2.** Freedom of expression as a participatory right.</caption><thead><tr><th></th><th colspan="2">Private sphere</th><th colspan="2">Public sphere</th></tr></thead><tbody><tr><th>Citizen</th><td>Freedom of thought and opinion concerning matters of public interest<br>(thinking)</td><td>Right to receive information and ideas of public interest<br>(consuming; reading)</td><td>Right to receive information and ideas of public interest<br>(possibility to receive)</td><td>Freedom to express one's opinion concerning matters of public interest<br>(participating in public debate)</td></tr><tr><th colspan="5">Role of the press (press freedom – duties and responsibilities)</th></tr><tr><th colspan="5">Freedom of public debate</th></tr></tbody></table>

The right to freedom of thought and opinion – in its second dimension – is however only *interfered with* when one's thoughts and opinions are being influenced to an extent their free formation could be corrupted and such thus exceeds a certain threshold [28, 41–43]. The question is, therefore, whether the (lack of) information one receives as a result of the customisation of his or her online news offer at a news website can reasonably be considered to have a ‘sufficiently’ significant effect on the formation or development of one’s inner ideas concerning matters of general interest. Rather than evaluating the (in)existence or dangers of filter bubbles [55, 56], the aim is thus to assess
whether news personalisation could impede citizens from being adequately informed and, as a consequence thereof, from forming their opinions. In view of the fact that establishing the actual impact of phenomena such as news personalisation – in all its forms – requires extensive and continuously updated empirical findings [57], this contribution presents a theoretical framework for analysis and is based on legal research.

It can be noted that the media, irrespective of their intentions with respect to personalisation, presume an important gatekeeper role [50]. They function as intermediaries between speakers and sources of information on the one hand, and the public on the other [50]. However, as explained, the ECtHR expects the press to at least inform people on events of interest [28, 47, 52]. In Lingens v. Austria, the Court added that it could not accept the opinion of the Austrian domestic authorities “to the effect that the task of the press was to impart information, the interpretation of which had to be left primarily to the reader” [47]. The Court, in the case of Stoll v. Switzerland, in a similar vein, pointed to the influence wielded by the media in contemporary society: “not only do they inform, they can also suggest by the way in which they present the information how it is to be assessed” [58]. Provided that journalists “are acting in good faith and on an accurate factual basis and provide “reliable and precise” information in accordance with the ethics of journalism” [58], it is thus accepted for media outlets to be influencing their audience by means of *how* they report on issues of public concern. Manfred Nowak, Professor of International Human Rights [59], considered, however, that “[i]t is not easy to delineate between the (impermissible) interference with freedom of opinion and (permissible) daily influencing of the formation of our opinions [...] by all the news, commentary and information disseminated by the mass media in our communications and information society” [28]. This seems to suggest that the latter, distributing news items to every consumer alike, are nonetheless at the limits of what can be considered *acceptable influence*. Therefore, and having regard to the freedom to consume published information – particularly relating to matters of public interest –, the individualisation of people’s feeds might go too far. In that regard, it may be interesting to note that according to the New York Times even its most active users only read a handful of the 200 news stories it puts out each day [8].

Moreover, in line with what David Kaye, the current Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, stated in his 2018 Annual Report, online content curation by means of technology may negatively impact an individual's capacity to form opinions in view of the fact that algorithmic ranking may induce users to believe that items recommended to them are particularly worth reading at a given moment in time [43 point 24-25]. He noted moreover that “media outlets elevate particular stories to the front page with the intention of shaping and influencing individual knowledge about significant news of the day” [60 point 24]. Having regard to the case-law of the ECtHR referred to above, this seems indeed what the structuring or placement of articles by news media, both print and electronic, first and foremost should lead to.

Therefore, we argue that news personalisation at news websites, to the extent it would impede people from having the possibility of being informed (1a) and/or informing themselves about matters of public concern (1b), and/or impair their intellectual
capacity to assess the general importance of the news items they are being recom-
mended (2), surpasses the limits of influencing acceptable in light of the freedom of
thought and opinion.

When online newspapers offer recommendations only *in addition* and next to the main news items of the day, provided that the latter can be distinguished from the former, are bundled together and displayed in order of importance, neither of these issues (1a, 1b and 2) seem to be present. In such circumstances, readers wishing to be informed concerning matters of interest to accordingly form their opinions are not hindered in that respect (1) and are enabled to assess the respective public interest value of the items (2). Personalisation would as such not negatively affect public debate. News providers could for example maintain a general page and as a supplementary service offer their audience personalised reading suggestions – by means of sidebars, below articles, via an additional personal page etc. Considering personalisation in such circumstances only concerns articles lacking public interest value, the fact whether or not a user has an explicit say regarding the determination of his or her preferences (see *supra*) is of secondary importance in the context of this analysis. The same cannot be said in case news personalisation at news websites takes the form of a *personalised page* without there being available a designated section regarding important items. Instead, such articles would be shown more or less prominently depending on the individual profile of the reader concerned. If generated recommendations would moreover be based on one’s *implicitly inferred interests*, a reader might not only miss out on articles concerning issues of general interest (1a), but would at the same time be deprived of the freedom to consume the news items amongst those of importance which they themselves consider the most relevant (1b). Considering people, in case of implicit personalisation, would be offered a list of recommendations in accordance with their presumed preferences, it can moreover be assumed that their ability to assess their respective societal weightiness would be affected as well (2). Explicit personalisation on the contrary empowers (1b) users to a certain extent as it allows them to ban certain types of content from their feed while giving them the opportunity to ‘adjust’ their preferences and perhaps even ‘select all’ (1a) available predetermined topics, events, etc. In the latter case they should however again somehow be enabled to distinguish between information of general interest and other news (2).

<table><caption>Figure 3. Permissibility of Personalisation at News Websites.</caption><thead><tr><th>Personalisation</th><th>Additional</th><th>-only</th></tr></thead><tbody><tr><td>Explicit</td><td>1a, 1b, 2</td><td>1a(?), 1b, 2(?)</td></tr><tr><td>Implicit</td><td>1a, 1b, 2</td><td>x</td></tr></tbody></table>

In order to put this analysis into perspective, the potential effects of news personali-
sation can be compared to those of (political) micro-targeting practices, which are also
considered to violate people's freedom of opinion in some case [36, 38]. As explained,
the former could influence the formation of one's thoughts on issues of general interest
in view of the fact that it may impede a person from receiving information about such
matters and from assessing the respective importance of the articles he or she is recom-
mended. The latter, on the other hand, is problematic when it amounts to manipulation
and affects our cognitive autonomy [36]. A manipulator seeks to insinuate himself in a
target’s decision-making process and thus deprives the individual of the authorship over
his or her ideas [57]. Whereas micro-targeting could hinder the free development of
thoughts (second dimension), it might also affect the freedom to have a personal opin-
ion as its purpose is to have people adopt another point of view (first dimension).

3.3 Explicit consent as an exception

Considering the fact that Article 22(1) GDPR sets out a general prohibition, online newspapers should in principle not engage in a type of news individualisation that could violate Articles 9 and 10 ECHR [25]. However, Article 22(2) contains three exceptions to this rule. Considering its problematic nature, the following analysis will in that respect focus on implicit personalisation-only news websites. First of all, point (a) of Article 22(2) sets out that paragraph 1 shall not apply if the decision “is necessary for entering into, or performance of, a contract between the data subject and a data controller”. The EDPB recently, in version 2.0 of its guidelines on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, acknowledged that “personalisation of content may (but does not always) constitute an intrinsic and expected element of certain online services, and therefore may be regarded as necessary for the performance of the contract with the service user in some cases” [61]. In the draft text, it stated that online news aggregator websites, whose services consist of “providing users with tailored content from multiple online sources through a single interface”, may rely on contract as a legal basis for processing “because the function of the service directly relates to personalised content” [62]. In view of the fact that the press itself – meaning (online) news providers (see *supra*) – carries a great responsibility in informing the public so as to facilitate public debate, it cannot be accepted that their primary purpose could also be to customise their readers’ news offer in accordance with the latter’s preferences. The example concerning news aggregators has moreover been deleted in the second version of the EDPB guidelines.

Therefore, we consider that online newspapers may not use Article 22(2)(a) GDPR to deploy a personalisation-only news service that relies on implicit profiling techniques. Secondly, point (b) provides that automated individual decision-making would be permissible in case its use “is authorised by Union or Member State law”. As such is not the case for news personalisation, this exception too is not relevant here.

Of particular importance in this context however is third one – point (c) –, which stipulates that the prohibition does not apply if the decision-making “is based on the data subject’s explicit consent”. To be validly expressed, consent must (amongst others) be ‘informed’ [20 art 4(11)]. According to recital 42 GDPR, this entails that the data subject should be aware of the purposes of the processing for which the personal data are intended. Article 29 Working Party has explained in that regard that “where the processing involves profiling-based decision making” it must be made clear to the person concerned “that the processing is for the purposes of both (a) profiling and (b) making a decision based on the profile generated” [25]. Moreover, data subjects must “understand exactly what they are consenting to” and “have enough relevant information about the envisaged use and consequences of the processing to ensure that any
consent they provide represents an informed choice” [25]. In view of the analysis above, this means that online news providers engaging in implicit personalisation-only type of services should explain to potential consumers that the articles in their future news feed will be ranked in accordance with their own preferences rather than taking into account the societal interest of the items. The GDPR also requires a data subject’s consent regarding the processing of his or her personal data to be ‘freely given’ [20 art 4(11)]. As stated in recital 42 of the GDPR, such is not the case “if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment”. It has been argued that this requirement inherently conflicts with so-called “take it or leave it”-practices [63] which lead to the *de facto* exclusion of data subjects from being provided with the service concerned in case they do not consent. Indeed, forcing users to accept the placement of so-called tracking cookies, which are used to collect user behaviour information (see *supra*), due to the fact that a refusal entails that a website simply cannot be accessed, is therefore often considered unlawful [64–66]. This would imply that news personalisation at a specific news website should in fact never be mandatory, though, in contrast, always ought to be optional. In this context consent must moreover be ‘explicit’ and therefore manifested by means of an *express* statement [67]. When processing entails significant risks, a high level of control over personal data is thus deemed appropriate [25]. In the digital or online context, the Article 29 Working Party explains that “a data subject may be able to issue the required statement by filling in an electronic form, by sending an email, by uploading a scanned document carrying the signature of the data subject, or by using an electronic signature” [67]. A two stage verification of consent, whereby a person is requested to reply to an email in which is asked for consent by “I agree” and subsequently receives a verification link or code that must be clicked to confirm agreement, can also suffice [67]. In such circumstances, consenting through cookie banners (see *supra*) cannot be allowed.

In the context of their transparency obligations, Article 13(2)(f) GDPR moreover requires controllers [20 art 4(7)], at the time when personal data are obtained from the data subject – as we assume in this paper they would be –, to provide them with specific information in case they engage in processing activities as referred to in Article 22 GDPR. They must, first of all, inform readers about the fact that they do so, which in case the processing is based on consent they already should have (see *supra*). Secondly, and “at least in those cases, meaningful information about the logic involved” must be provided. According to the Article 29 Working Party this requires finding “simple ways to tell the data subject about the rationale behind, or the criteria relied on in reaching the decision” [25]. Finally, controllers should explain “the significance and the envisaged consequences of [the] processing”. This requirement comes down to clarifying “how the automated decision-making might affect the data subject” [25]. As explained above, also this information should normally be obtained by the latter also earlier on and namely prior to agreeing to the processing.

Article 22(3) GDPR, in addition, states that “in the case [...] referred to in point [...] (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms”, in *casu* being his or her right to freedom of thought and opinion. At the least, a person should be granted the right to obtain human intervention on the part of the controller, to express his or her point of view and to
contest the decision [20 art 22(3)]. While in case of news personalisation the implica-
tions of these assurances are, admittedly, not straightforward, some ideas may nonethe-
less be posited in that respect. Considering that the Working Party put forward that any
review must be carried out by someone who has the capability to *change* the decision,
data subjects might be able to request the adjustment of their profile – and with that the
recommendations based thereon – in case they feel impeded from receiving information
and ideas of general importance. However, bearing in mind that user preferences are
determined by algorithmic means (see *supra*) and therefore not readily adaptable by
human beings, the only practical solution might be to completely reset a user profile –
something which is said to be also possible on the basis of the right to erasure ('right to
be forgotten') laid down in Article 17 of the GDPR [10]. The relevance of being able
to express one's opinion and to contest the decision might be similar.

Lastly, it can be noted that Article 22(4) GDPR in principle prohibits decisions re-
ferred to in paragraph 2 to be based on special categories of personal data unless “the
data subject has given explicit consent to the processing of those personal data for one
or more specified purposes” or “processing is necessary for reasons of substantial pub-
lic interest, on the basis of Union or Member State law” [20 art 22(4), 9(1), 9(2)(a),(g)].
Article 9(1) GDPR specifies that such categories (amongst others) include data reveal-
ing political opinions and philosophical beliefs. Therefore, if a news consumer would,
as a result of implicit personalisation, be recommended more articles concerning either
left or right-wing political parties or touching upon topics associated with progressive
rather than conservative convictions or vice versa, this could be problematic. In the
context of this analysis, we consider moreover that only the first-mentioned exception
can be applied.

4 Conclusion

More and more often, personalisation at news websites is being introduced. It can be
done on the basis of explicitly registered or implicitly inferred user preferences, take
several forms and rely on different types of (implicit) filtering techniques. Customising
consumers’ news offer, however, requires the processing of personal data, and more
specifically its collection as well as use for profiling and the eventual delivery of rec-
ommendations. In view of the fact that providing users with individualised news rec-
ommendations is usually realised by solely automated means and has the potential to
violate people’s absolute and non-derogable rights to freedom of thought and freedom
of opinion, it could be prohibited on the basis of Article 22(1) of the EU General Data
Protection Regulation. The adaptation of news feeds according to implicitly inferred
user profiles without there being available a designated section regarding important
news does, in any event, not appear acceptable. However, news consumers could, as
foreseen by Article 22(2) GDPR, nonetheless explicitly agree to such employment of
their personal information, though only provided that they would be offered an in-
formed and genuine choice in that regard. In such circumstances, online newspapers
must also provide their readers with simple and meaningful information concerning the
rationale behind the algorithm used and the recommendations it generates. The latter
can moreover only be based on a person's political opinions or philosophical beliefs in case he or she gave its explicitly consented thereto.

Ideally, online newspapers abstain from becoming personalisation-only forums and give users some form of control as regards the determination of their reading preferences and interests.

## 5 References

1. News, sport and opinion from the Guardian's global edition, https://www.theguardian.com/international, last accessed 2019/05/06.

2. Cookies on the Guardian website, https://www.theguardian.com/info/cookies, (2018).

3. Thurman, N.: Making ‘The Daily Me’: Technology, economics and habit in the mainstream assimilation of personalized news. Journalism. 12, 395–415 (2011). https://doi.org/10.1177/1464884910388228.

4. Website of Dr Neil Thurman, Professor of Communication, LMU Munich., https://neilthurman.com/, last accessed 2019/07/31.

5. Professor Steve Schifferes, https://www.city.ac.uk/people/academics/steveschifferes, last accessed 2019/08/01.

6. Thurman, N., Schifferes, S.: The Paradox of Personalization: The Social and Reflexive Turn of Adaptive News. In: The Handbook of Global Online Journalism. pp. 373–391. John Wiley & Sons, Ltd (2012). https://doi.org/10.1002/9781118313978.ch20.

7. Mis niets over uw favoriete thema's via "Mijn dS," https://www.standdaard.be/cnt/dmf20190304_04229666, last accessed 2019/08/09.

8. Slefo, G.P.: "New York Times" plans to invest heavily in AI, https://www.crainsnewyork.com/technology/new-york-times-plans-invest-heavy-ily-ai, (2018).

9. Kunert, J., Thurman, N.: The Form of Content Personalisation at Mainstream, Transatlantic News Outlets: 2010–2016. Journalism Practice. 13, 759–780 (2019). https://doi.org/10.1080/17512786.2019.1567271.

10. Eskens, S.: A right to reset your user profile and more: GDPR-rights for personalized news consumers. International Data Privacy Law. https://doi.org/10.1093/idpl/ipz007.

11. Karimi, M., Jannach, D., Jugovac, M.: News recommender systems – Survey and roads ahead. Information Processing & Management. 54, 1203–1227 (2018). https://doi.org/10.1016/j.ipm.2018.04.008.

12. Moreira, G. de S.P., Ferreira, F., da Cunha, A.M.: News Session-Based Recommendations using Deep Neural Networks. Proceedings of the 3rd Workshop on Deep Learning for Recommender Systems - DLRS 2018. 15–23 (2018). https://doi.org/10.1145/3270323.3270328.

13. Lops, P., de Gemmis, M., Semeraro, G.: Content-based Recommender Systems: State of the Art and Trends. In: Recommender Systems Handbook. pp. 73–105. Springer (2011).
14. Desrosiers, C., Karypis, G.: A Comprehensive Survey of Neighborhood-based Recommendation Methods. In: Recommender Systems Handbook. pp. 107–144. Springer (2011).

15. Pazzani, M.J.: A Framework for Collaborative, Content-Based and Demographic Filtering. Artificial Intelligence Review. 13, 393–408 (1999).

16. Ricci, F., Rokach, L., Shapira, B., Kantor, P.B. eds: Recommender Systems Handbook. Springer (2010).

17. Vozalis, M., Margaritis, K.G.: Collaborative filtering enhanced by demographic correlation. In: Proceedings of the AIAI Symposium on Professional Practice in AI, part of the 18th World Computer Congress. pp. 293–402 (2004).

18. Mohamed, M.H., Khafagy, M.H., Ibrahim, M.H.: Recommender Systems Challenges and Solutions Survey. In: 2019 International Conference on Innovative Trends in Computer Engineering (ITCE). pp. 149–155 (2019). https://doi.org/10.1109/ITCE.2019.8646645.

19. Lika, B., Kolomvatsos, K., Hadjiefthymiades, S.: Facing the cold start problem in recommender systems. Expert Systems with Applications. 41, 2065–2073 (2014). https://doi.org/10.1016/j.eswa.2013.09.005.

20. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance). (2016).

21. Verdoodt, V., Lievens, E.: Targeting children with personalised advertising: how to reconcile the (best) interests of children and advertisers. In: Data protection and privacy under pressure: transatlantic tensions, EU surveillance, and big data. pp. 313–341. Maklu (2017).

22. Overeenkomst voor gegevensgebruik ('agreement for data use') Mediahuis, https://www.mediahuis.be/overeenkomst-voor-gegevensgebruik/, last accessed 2019/05/24.

23. European Commission: Cookies, http://ec.europa.eu/ipg/basics/legal/cookies/in-dex_en.htm#section_2, last accessed 2019/05/09.

24. European Data Protection Supervisor: Towards a new digital ethics. Data, dignity and technology.

25. Article 29 Data Protection Working Party: Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679.

26. Sammut, C., Webb, G.I. eds: Encyclopedia of Machine Learning | SpringerLink. Springer, Boston, MA (2011).

27. European Convention for the Protection of Human Rights and Fundamental Freedoms. (1950).

28. Nowak, M.: U.N. Covenant on Civil and Political Rights: CCPR commentary. N.P. Engel, Kehl, Germany; Arlington, Va., USA (2005).

29. Velaers, J.: De beperkingen van de vrijheid van meningsuiting. Maklu Uitgevers, Antwerpen (1991).
30. Murdoch, J.: Freedom of thought, conscience and religion. A guide to the imple-
mentation of Article 9 of the European Convention on Human Rights. Council of
Europe, Belgium (2007).

31. Schabas, W.A.: The Universal Declaration of Human Rights: the Travaux Prépa-
ratoires. Cambridge University Press, Cambridge (2013).

32. UN Human Rights Committee (HRC): General comment no. 34, Article 19, Free-
doms of opinion and expression. (2011).

33. Macovei, M.: Freedom of expression. A guide to the implementation of Article 10 of the European Convention on Human Rights. Council of Europe (2004).

34. Murdoch, J.: Protecting the right to freedom of thought, conscience and religion under the European Convention on Human Rights. Council of Europe, Strasbourg (2012).

35. Martin Scheinin: Article 18. In: Asbjørn Eide, Gudmundur Alfredsson, Göran Me-
lander, Lars Adam Rehof, and Allan Rosas with the collaboration of Theresa
Swinehart (eds.) The Universal Declaration of Human Rights: a commentary.
Scandinavian University Press ; Distributed world-wide excluding Scandinavia by
Oxford University Press, Oslo : Oxford ; New York (1992).

36. Committee of Ministers: Declaration on the manipulative capabilities of algorithm-
mic processes. (2019).

37. European Data Protection Supervisor: Online manipulation and personal data.

38. European Data Protection Board: The use of personal data in the course of political campaigns.

39. Amnesty International: Surveillance giants: how the business model of google and facebook threatens human rights. (2019).

40. Bowman v. the United Kingdom. (1998).

41. Bossuyt, M.J.: Guide to the “travaux Préparatoires” of the International Covenant on Civil and Political Rights. Martinus Nijhoff Publishers (1987).

42. Vermeulen, J.: Permissibility of news personalisation in view of the freedoms of thought and opinion. Presented at the BILETA Belfast: Back to the futures? (2019).

43. Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression: Report on the nature and scope of the right to freedom of opinion and expression, and restrictions and limitations to the right to freedom of expression. (1994).

44. Feldek v. Slovakia. (2001).

45. Sürek v. Turkey (No. 1). (1999).

46. Mendel, T.: Freedom of Expression: A Guide to the Interpretation and Meaning of Article 10 of the European Convention on Human Rights. Centre for Law and Democracy.

47. Lingens v. Austria. (1986).

48. Savva Terentyev v. Russia. (2018).

49. Handyside v. the United Kingdom. (1976).

50. van Hoboken, J.V.J.: Search engine freedom: on the implications of the right to freedom of expression for the legal governance of Web search engines, https://dare.uva.nl/search?metis.record.id=392066, (2012).
51. Leander v. Sweden. (1987).

52. Şener v. Turkey. (2000).

53. Khursid Mustafa and Tarzibachi v. Sweden. (2008).

54. High-Level Expert Group on Artificial Intelligence: Ethics Guidelines for Trustworthy AI. European Commission (2019).

55. Borgesius, F.J.Z., Trilling, D., Möller, J., Bodó, B., Vreese, C.H. de, Helberger, N.: Should we worry about filter bubbles? Internet Policy Review. (2016).

56. Möller, J., Helberger, N., Makhortkh, M., van Dooremalen, S.: Filterbubbels in Nederland (2019). Commissariaat voor de media (2019).

57. Susser, D., Roessler, B., Nissenbaum, H.: Online Manipulation: Hidden Influences in a Digital World. Social Science Research Network, Rochester, NY (2018).

58. Stoll v. Switzerland. (2007).

59. Professor Manfred Nowak, https://www.chr.up.ac.za/world-moot-currently-confirmed-judges-in-the-final-round/95-moot-courts/world-moot-court/judges/1648-professor-manfred-nowak, last accessed 2019/08/08.

60. Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression: Report on Artificial Intelligence technologies and implications for the information environment.

61. European Data Protection Board (EDPB): Guidelines on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects (Version 2.0). (2019).

62. European Data Protection Board (EDPB): Guidelines on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects (Version for public consultation). (2019).

63. GDPR: noyb.eu filed four complaints over “forced consent” against Google, Instagram, WhatsApp and Facebook, https://noyb.eu/4complaints/?lang=nl, https://noyb.eu/4complaints/, last accessed 2019/03/25.

64. Commission nationale de l'informatique et des libertés (CNIL): The CNIL's restricted committee imposes a financial penalty of 50 Million euros against GOOGLE LLC, https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against.google-llc, last accessed 2019/08/09.

65. Autoriteit Persoonsgegevens: Websites moeten toegankelijk blijven bij weigeren tracking cookies, https://www.autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moeten-toegankelijk-blijven-bij-weigeren-tracking-cookies, last accessed 2019/08/09.

66. Autoriteit Persoonsgegevens: Normuitleg AP over cookiewalls. (2019).

67. Article 29 Data Protection Working Party: Guidelines on consent under Regulation 2016/679.