Source: https://digitallawblog.net/
Timestamp: 2019-04-18 15:00:08+00:00

Document:
Things are so hectic in the data privacy world at the moment that it amazes me how any lawyers or privacy professionals are able to write any commentary or articles on top of their day jobs. That’s partly why my last post on this blog was from January.
However, so many clients and other people have asked about the scope and operation of the right to object to direct marketing (“including profiling“) under Art 21(2) GDPR that I thought it worth writing a short post about it.
The first point to note is that this is an “absolute” right and it doesn’t matter what legal basis any such direct marketing is being justified under.
This is different to the right to object under Art 21(1) which only applies to processing based on the “public interest” ground (Art 6(1)(e)) or “legitimate interests” (Art 6(1)(f)) and which is subject to the controller having the opportunity to demonstrate compelling legitimate grounds to continue processing etc. Under Art 21(2), there is no such qualification and, as per Art 21(3), when the individual objects to processing for direct marketing purposes, the processing has to stop.
It’s worth noting that, in practice generally only “consent” or “legitimate interests” under Arts 6(1)(a) or (f) respectively would be applicable as a legal basis for direct marketing – and there are various complexities and important considerations to the extent legitimate interests will be relied on for direct marketing – this is beyond the scope of this post (although see the DPN Legitimate Interests Guidance for advice on this area).
The second point to note is an area in which I’ve seen marketers get very confused. Lots of people I’ve met recently refer to the right under Art 21(2) as a “right to opt-out of being sent direct marketing“.
The above is obviously very wordy which is why the defined term “processing” is used instead. However, what it hopefully demonstrates is that the right to object to direct marketing, is not a right to opt-out of being sent direct marketing. Rather, it is a right to opt-out of absolutely anything being done with someone’s data whatsoever to the extent done for direct marketing purposes, irrespective of whether that involves actually sending direct marketing to the individual.
It’s also worth noting that this is broadly the current position anyway – as Art 14(b) of the 1995 Data Protection Directive also refers to the right to object the “processing” of personal data for direct marketing purposes.
An example of this could be segmentation – i.e. the act of classifying someone in a particular marketing category and storing data relating to them in say a data management platform (DMP) or a CRM database managing those segments (e.g. Male, Age 35-44, supports Tottenham) – this in and of itself would constitute “processing” for direct marketing purposes and is therefore subject to the absolute right to object.
Another related and slightly complex point is the example of using first party data for “Lookalike Audiences”. Broadly speaking this is a form of targeting (offered by many platforms, in particular social media) which enables an advertiser to target advertising to people who are likely to be interested in the advertiser’s business because they’re similar to the advertiser’s existing customers. In this case, the “existing customers” aren’t actually being sent any direct marketing, but it seems highly likely that the use of their data in order to build a lookalike audience (to then target other prospective customers) would constitute the processing of the existing customers’ personal data for direct marketing purposes.
“any automated processing to evaluate, analyse or predict people’s personal aspects (e.g. economic situation, interests, behaviour, or location“.
The above basically means segmentation (or marketing analytics). As you’ll see from the point above regarding the definition of “processing”, this type of activity would already constitute “processing” so would already be captured by the right to object (to the extent undertaken for direct marketing purposes) irrespective of whether it refers to “profiling” or not.
The reference to profiling is therefore a bit of a red herring because “profiling” is just “processing” (note that the definition of profiling specifically includes the word processing).
The final point to make is that direct marketing is not just mailshots. Much like the Data Protection Directive, the GDPR doesn’t actually define “direct marketing”.
In the UK, s.11(3) of the Data Protection Act 1998 does define “direct marketing” very broadly as (my emphasis added) “the communication (by whatever means) of any advertising or marketing material”. In the various pieces of ICO guidance (e.g. paras 33-36 of the ICO Direct Marketing guidance) it’s also clear that the ICO will interpret “direct marketing” broadly.
The clearest example of the breadth of what constitutes direct marketing comes from the various proposals of the forthcoming ePrivacy Regulation. In particular the definition of “direct marketing” in the last version of the ePrivacy Regulation (at the time of writing, this is the LIBE committee draft which was published at the end of October 2017) “direct marketing” is expressly defined in Art 4(3)(f) to include any form of advertising which is, amongst other things, “sent, served or presented“.
I interpret the above as an intention to specifically include targeted display ads within the scope of direct marketing – this is consistent with the various opinions that were published on the draft Regulation as it’s made its way through the European legislative process (e.g. the WP29 Opinion and the 2016 EDPS opinion). Although the eagle eyed among you will also notice that the obligation to obtain prior consent for direct marketing under Art 16(1) of the ePrivacy Regulation only applies to the “presenting or “sending” of direct marketing (and not the broader concept of “processing”) – however that’s another story!
So in summary, as per many aspects of the GDPR, whilst the drafting may not be the most eloquent, there is much more to it than meets the eye when you dig below the surface.
The position regarding whether ad blocker detection is caught by the consent requirements under the currently in force e-Privacy Directive has always been contentious.
The IAB wrote a helpful summary last summer 2016 available here. Broadly speaking, depending on how the ePrivacy Directive consent requirements and the exceptions are interpreted, and depending on the technical implementation used to implement ad blocker detection, it’s arguable (at least as far as the European Commission and the Art 29 Working Party are concerned) that ad blocker detection would require a user’s prior consent. This is because, in most cases, it constitutes the accessing of information from a user’s device (i.e. the information being whether the user has implemented an ad blocker).
However, when reading through the European Commission’s proposal for the new e-Privacy Regulation published recently on 10 January 2017 and due to come into force in May 2018 along with the GDPR, you’d be forgiven for being a bit confused (as I am) about the intended position under the new Regulation regarding ad blocker detection.
…in a proposed reform of the law on Tuesday, the commission attempted to clear up legal confusion by deciding that detection of an ad blocker would not break EU rules.
The above interpretations of the new Regulation seem to conflict. So what does the Commission and importantly the new Regulation actually say?
…the proposal allows website providers to check if the end-user’s device is able to receive their content, including advertisement, without obtaining the end-user’s consent. If a website provider notes that not all content can be received by the end-user, it is up to the website provider to respond appropriately, for example by asking end-users if they use an ad-blocker and would be willing to switch it off for the respective website.
The above seems pretty clear that the Commission sees the checking by publishers to see if a device can receive ads, as not requiring consent. I interpret this as meaning the Commission are saying that accessing information from an end user’s device for the purpose of ad blocker detection is an exception to the rule in the Regulation that any accessing of information from end user devices is prohibited unless prior consent (amongst other things) is given. This statement from the Commission probably formed the basis of the FT article referred to above.
So on the basis of the above, why the deep regret from the EMMA and ENPA in their press release? Well, whilst the position from the Commission seems to be clear, the actual drafting of the Regulation itself is unfortunately not so clear.
…the mere logging of the fact that the end-user’s device is unable to receive content requested by the end-user should not constitute access to such a device or use of the device processing capabilities.
On the face of it you might think that the above Recital sets out the same position as per the principle referred to above in the Commission’s Fact Sheet. However, it’s not very clear.
The Recital refers to “content requested by the end-user” and in the Commission’s Fact Sheet, the Commission includes “ads” within such content. However, when someone implements an ad-blocker, they are not requesting “ads”. The precise reason why they have implemented the ad blocker is because they only want editorial and specifically do not request advertising. The Recital therefore implies that the mere logging of the fact that the end-user’s device is technically unable to receive the editorial requested by the user won’t constitute access to the device. However, if a publisher logs the fact that the user’s device is unable to receive other content which the user has not requested (e.g. ads) and almost definitely doesn’t want (i.e. because they have an ad blocker installed) then perhaps that does constitute accessing the device?
The other problem is that the point of Recitals is to provide guidance or background as to how the legislative provisions are to be interpreted. In most cases the Recitals also summarise the legislative provisions themselves. However, it’s not clear where the above principle is actually covered in the Regulations themselves.
The consent requirements for local data/device access are contained in Article 8. This states that the use of processing and storage capabilities and the collection of information from users’ devices is prohibited unless any of the grounds in Articles 8(1)(a)-(d) apply. Art 8(1)(b) provides for the user’s consent to be a valid ground. Art 8.1(d) gives “web audience measuring” (i.e. analytics) as another permitted ground. However, there does not appear to be an express ground permitting the collection of information from users’ devices to log the fact that the end-user’s device is unable to receive content requested by the end-user.
Perhaps this is because the Commission are not saying that this type of local access is expressly excluded from the prohibition by being a permissible “ground” (as per “consent” and “web audience measurement”) but rather that this type of local access doesn’t itself constitute local access at all. This doesn’t seem to make sense though because it does constitute local access – in which case why not just include it as an additional ground in Article 8(1)?
This is an abbreviated version of an article I recently wrote with my colleague Neelum Dass. The original version is available on the Bristows site here.
When the AVMS Directive came into force in early 2010, amongst other things, it relaxed the rules on product placement giving broadcasters new opportunities to earn revenue from advertising. In the UK, following implementation of the Directive, Ofcom amended the Broadcasting Code to address the new rules governing product placement. Under the amended Broadcasting Code, product placement has been permitted in UK television programmes since 28 February 2011 as long as it complies with the relevant conditions.
Products can’t be placed in news or children’s programmes or in religious or consumer advice programmes. Product placement is however allowed in films, TV series, entertainment shows and sports programmes subject to a number of conditions. A range of products can be placed but cigarettes and prescription medications can’t nor can alcoholic or food that is high in fat or sugar. Also, there must always be “editorial justification” for a product to be placed and importantly the broadcaster must always retain “editorial control” of the programme content. In other words, the programme can’t be distorted just to feature the product or an advertiser can’t have too much say into the editorial of the programme etc..
Whilst there’ve been various estimates, it’s quite difficult to quantify the value of product placement in the UK. However, it’s fair to say that product placement, at least in the UK, is still a relatively nascent market. Soon after the rules were relaxed, it was estimated that the value of product placement deals could be worth up to £150 million a year by 2016. However, some reports suggest that the figures are actually much lower than this. In 2011, product placement in UK TV was estimated to be worth £2m and in 2012 some reports suggested it was worth £5 – £10m.
However, notwithstanding the relative nascency of the market in the UK, the continued pressure on broadcasters to maintain advertising revenue streams (in particular given the proliferation of digital TV channels and online content) coupled with the positive economic turn-around in the last couple of years, we’ve noticed a significant increase in product placement and associated “ad-funded” programming deals in the UK.
While it’s arguable that, initially, product placement in British TV may not have had the impact that was initially envisaged or hoped, as mentioned above we’ve seen an increase in these types of deals over the past 2-3 years. In addition to this, significant developments in post-production technology have increasingly created new opportunities for content owners to generate revenue through “retrospective” digital product placement. Specifically, we’ve seen an emergence of products being retrospectively digitally placed into films and TV shows. For example, in 2012, PG Tips logos were digitally inserted on contestants’ previously blank mugs in the game show Deal or No Deal following a deal between Channel 4, Unilever UK and television production company Endemol. As far as I’m aware, this use of retrospective digital integration was one of the first to feature in a programme aired by a UK broadcaster.
The opportunities for retrospective product placement are potentially far-reaching for advertisers, particularly as consumers’ attention is increasingly being divided between competing digital content services, and the widespread use of catch-up and on-demand technology and services means that, despite certain broadcasters’ best efforts, viewers may often have the ability to “fast forward” through content and thereby avoid advertising. Now, a drinks brand for example has the option, instead of purchasing a traditional TV ad spot, to enter into a product placement deal whereby the product could be digitally inserted into fridges in re-runs of TV shows which are proven to rate well. Another example could be where an ad for a particular product might appear on a street billboard as a character walks down the street in a TV programme. Retrospective digital placement also allows for the placed products to be tailored for different markets, e.g. the same character may wear one brand of trainers in the UK version of a show and a local brand of trainers in the same scene of the show aired on Brazilian TV.
According to Mirriad, it’s on a mission to “revolutionise advertising for the skip generation”, referring to the fact that viewers increasingly “skip” through ads.
While retrospective digital product placement creates exciting new opportunities for broadcasters, it also generates some interesting regulatory challenges. In particular, the Broadcasting Code prohibits “surreptitious” advertising in UK programmes and there is a transparency obligation to clearly signal product placement by displaying a special “P” logo (see below) which lets viewers know that the TV channel or the programme maker has been paid to include products in the programme.
According to the transparency rules referred to above, any programme produced under UK jurisdiction that is commissioned to be shown on an Ofcom licensed channel must include the product placement logo where necessary. However, broadly speaking, broadcasters do not have to display the P logo on programmes that were originally broadcast outside the UK, for example, a US drama series that is then shown in the UK.
Additionally, when a broadcaster acquires a programme containing product placement (but does not produce or commission it), then, again broadly speaking, there is no signalling requirement. In this case, the broadcaster is not deemed to have directly benefited from any product placement arrangements and therefore references to products that appear in the programme are generally not treated under the UK regime as commercial product placement.
However, if a broadcaster acquires a programme on the condition that product placement within the programme will remain within the programme when it’s transmitted, the broadcaster will need to make it clear that the reference to the product serves as advertising by including the P logo.
Importantly, in the context of the type of retrospective digital product placement referred to above, if a broadcaster acquires a non-UK programme or programme which doesn’t include any product placement, and subsequently edits it to contain product placement, then this would likely trigger the transparency requirements. Even though the programme may be from abroad, the UK broadcaster would still be subject to the signalling rules if it has benefitted from the product placement in any way.
Retrospective digital product placement appears to be on the rise in the UK. Broadcasters and production companies that employ one of these innovative agencies to retrospectively product place must ensure that they remain compliant, particularly to avoid engaging in surreptitious advertising. Adequate disclosures must be made even in the case of broadcasters who have acquired content and were not responsible for the original commission.
There is uncertainty over whether the value of product placement in UK TV programmes will ever reach the levels that have been previously suggested. In the meantime, however, it will be interesting to see how digital companies develop new and creative ways for advertisers to incorporate their products into UK TV shows which were originally aired months, years or even decades ago.
One of the biggest challenges for regulation is to keep up with the complexities of the digital ecosystem. A good example of this is dealing with a “mixed” digital contract under the Consumer Rights Directive.
A key aspect of the Directive is the distinction between (a) contracts for the supply of goods (“sales contracts”), (b) contracts for the supply of services (“service contracts”) and (c) contracts for the supply of online digital content (“digital content contracts”).
The distinction is important because, under the Directive, different rules apply regarding consumers’ withdrawal rights when they enter into any of these contracts “at a distance” (e.g. buying something online or via an app etc). Broadly speaking, for sales contracts, consumers have 14 days from receipt of the goods, to change their mind and withdraw and can receive a refund for the goods. For service contracts, consumers can withdraw within 14 days from conclusion of the contract, but the trader is now entitled to pro-rate the consumer’s refund to take account of any services performed during the 14 day withdrawal period. For digital content contracts, the trader is able to exclude the consumer’s cancellation right completely from the point when supply (e.g. download or streaming) of the digital content starts (provided certain information requirements and formalities are met).
The question therefore arises as to what happens if the contract involves the provision of a combination of goods, services and/or digital content?
The example given by the European Commission in its guidance on the Directive is the situation where a distance contract involves the delivery and installation of a household appliance. If the appliance was delivered and also installed when delivered, the consumer will have the right to cancel within 14 days from receipt of the appliance and receive a refund for it, but the trader will be entitled to retain the installation service fee.
However, the situation for mixed contracts involving digital content is less clear. The problem is that, as mentioned above, a “mixed purpose contract” as described in the Directive and the Commission’s guidance, together with the limited European case law cited by the Commission in its guidance (e.g. case C-20/03 Marcel Burmanjer), is described only as including a mixture of goods and services. It doesn’t involve the new statutory concept of “digital content”. In particular, Recital 19 of the Directive expressly states that digital content contracts “should be classified, for the purpose of this Directive, neither as sales contracts nor as service contracts.” So it appears to be the case that digital content contracts are envisaged to be a mutually exclusive class of distance contract.
It’s therefore very unclear how the withdrawal rights should operate in a contract which involves the provision of digital content together with either goods and/or services. Imagine for example a subscription involving periodic delivery of a hard copy comic (goods) together with access to exclusive streamed video clips (digital content). In particular when does the 14 day period start running and can the withdrawal right be excluded in relation to the digital content?
The most obvious conclusion would be to assume that the same principle under Article 2(5) and Recital 50 of the Directive applies by analogy and the contract would be classed as a “sales contract” but the trader would still be able to exclude the withdrawal right in respect of the digital content element. However, this is very much an assumption and the outcome would still not be very clear regarding how this would work in practice – i.e. if the trader can exclude the cancellation/refund rights for the digital content – what would then be refunded to the consumer if he/she cancelled pursuant to the goods rules?
In contrast to the Directive, the new UK Consumer Rights Act 2015 (the CRA) which will come into force in October this year and which, broadly speaking, relates to defective or substandard goods, services and digital content, deals with mixed digital contracts in a more granular way.
Sections 1(4)-(6) of the CRA set out the position regarding mixed contracts including any combination of goods, services and/or digital content. Under the CRA, the service element expressly attracts specific service rights and remedies, the goods element attracts the specific goods rights and remedies and the digital content element attracts the specific digital content rights and remedies. The CRA also addresses how termination in whole or part might work for mixed contracts and in particular whether such a contract is “severable” (sections 20(20)-(21)).
The Times apparently cited concern for reader sensitivities as its reasoning for rejecting the ad. The controversy increased when The Guardian decided to accept the same ad, as explained on the Guardian’s site here.
A similar controversy arose soon after, when the Jewish Chronicle newspaper issued a public apology to readers who complained after it ran the below advert for the Disasters Emergency Committee’s Gaza crisis appeal.
These stories made me wonder to what extent the ASA, the regulator of UK advertising, has been required to adjudicate on advertising in the context of the Israeli Palestinian conflict. So in this post I’ve taken a look back through all the published ASA adjudications (I could find) which have related in one form or another to the conflict. If you think I’ve missed any, please let me know!
By my counting there are 9 relevant adjudications in total which span from the first in April 2010 up until a recent one last month. Out of the 9 adjudications, 5 of them involved an investigation into adverts published by the Israeli Government Tourist Office. The complaints against the Israeli Tourist Office have usually related to whether or not certain territory or a certain landmark is or is not part of Israel. The ASA has found for and against the various complainants depending on the facts of the particular complaint and the content of the ads.
For example in this adjudication from April 2010 and this adjudication from March 2012, the ASA upheld complaints that the Israeli Tourist Office ads misleadingly implied that East Jerusalem, the West Bank, the Gaza Strip and the Golan Heights were recognised as part of Israel. Another similar ruling came in November 2011, where the ASA upheld a complaint regarding a press ad by a company called ILAN Real Estate, which was held to misleadingly imply that a property development in Efrat in Dekel was in Israel, whereas in fact it was a settlement in the occupied West Bank.
However, in this adjudication from April 2011 and this one from April 2012, the ASA did not uphold complaints that ads from the Israeli Tourist office misleadingly implied that the Western Wall and the whole of Jerusalem (including the Old City and the Church of the Holy Sepulchre) were part of Israel.
The other adjudication involving the Israeli Tourist Office involved 3 complaints about a magazine ad which stated amongst other things that Israel is “a melting pot of races and creeds...” In that ruling the complainants challenged, amongst other things, whether the claim was misleading and likely to cause offence because they believed that Palestinians in Israel were restricted in movement and excluded from some areas of daily life. In the ruling, the ASA did not uphold the claim on the basis that the inhabitants of Israel were made up of a number of different ethnic groups and faiths and, as with all societies around the world, inequalities existed and the claim would be understood by consumers to be a reference to the population mix of the country and not a claim that the population necessarily lived in harmony and equality.
Out of the remaining 3 adjudications, two of them are “tourism” related and are quite similar to the rulings referred to above regarding the Israeli Tourist office but come from the other side of the conflict. In this adjudication from March 2011, the ASA investigated a magazine ad for Travel Palestine which 149 people complained misleadingly implied that (a) Palestine was a recognised country; (b) the whole of the area described as situated “between the Mediterranean Coast and the Jordan River” was Palestinian-administered territory; and (c) Jerusalem was part of Palestinian-administered territory. The ASA did not uphold the first two points, but did uphold the third point regarding Jerusalem on the basis that, amongst other things, the status of Jerusalem was in dispute. Similarly, in this adjudication from December 2011, the ASA upheld various complaints that an online interactive map created by the Palestinian Diplomatic Mission misleadingly implied amongst other things that either the state of Israel did not exist, or that certain Israeli cities such as Haifa were in fact part of Palestine.
The final ruling is the most recent one from 3 September 2014 where, following complaints from UK Lawyers for Israel and Baroness Deech, the ASA investigated three ads for Medical Aid for Palestinians. The ads described various hardships faced by Palestinians under Israeli occupation. In the ruling a whopping 22 separate issues were investigated, which is an unusually large number of separate issues for an ASA adjudication. Out of the 22 issues, one was upheld which related to a claim regarding the number of Palestinians alleged to have had their permit request to get to hospital denied, the other 21 issues were not upheld. Out of all of these rulings, this one is definitely worth reading because of the granularity with which the ASA was required to investigate various facets of the Israeli occupation of the West Bank.
A particularly fascinating aspect to all of these is the way in which the Israeli-Palestinian conflict can challenge the traditional separation between editorial and advertising, whereby the mere decision to run or not run a particular ad can itself be a “political” decision.
Enter your email address to follow The Digital Law Blog and receive notifications of new posts by email.
All views expressed in this blog are my own and don’t represent the views of the law firm I work for.
Please don’t rely on this blog as a source of legal advice, it’s not intended to create any kind of lawyer-client relationship.
For more information about me and this blog see the About page.
RSS feed of this blog here.

References: Art 21
 Art 21
 Art 21
 Art 21
 Art 21
 Art 14
 Art 4
 Art 16
 Art 29
 Art 8
 Art 8