Sex and sharing data have a lot in common – they require voluntary consent

The German authorities have made it clear: Sharing user data between apps is going to be treated a lot like sex  in the future. It’s a big no-no unless there is explicit and voluntary consent — especially if one party is a lot bigger than the other.

The German antitrust authorities, the Bundeskartellamt, has ruled that Facebook must get voluntary consent from people before collecting their data while using secondary Facebook services such as WhatsApp and Instagram and third-party websites. If this explicit user consent is not given, Facebook will have to substantially restrict its collection and combining of data between its various services.

The interesting wrinkle is what happens when users don’t give their approval. Andreas Mundt, President of the Bundeskartellamt stated it as a two-punch blow: “If users do not consent, Facebook may not exclude them from its services and must refrain from collecting and merging data from different sources.”

It’s a question of dominance

Both sides – the Bundeskartellamt and Facebook – are talking a lot more about market dominance than data privacy. “The extent to which Facebook collects, merges and uses data in user accounts constitutes an abuse of a dominant position,” explained the Bundeskartellamt in a blog post. The responding Facebook blog emphasizes that popularity is not dominance – and that they believe the Bundeskartellamt isn’t even the right agency to be chasing them. “The GDPR specifically empowers data protection regulators – not competition authorities – to determine whether companies are living up to their responsibilities,” said the Facebook blog. Their position is that there are lots of social media alternatives out there and that using information across services simply helps Facebook to provide them better. Consent for combining data from various sources was not mentioned in the Facebook post.

Into the uncertainty we go

Both sides are digging in and Facebook has said it will appeal the ruling within the next month. This ruling comes at an uncertain time for the technology giants. Facebook has already announced its plans to merge the Messenger, WhatsApp and Instagram messaging apps. Google has just been hit with fine in France for GDPR violations. In addition, it’s not clear if or when the United States will come up with a unified data privacy law.

No automatic default solution will be accepted

It’s a question what acceptable terms & conditions could look like for the end user. As Mundt put it: “An obligatory tick on the box to agree to the company’s terms of use is not an adequate basis for such intensive data processing.” One has to wonder if Google’s new layered levels of consent for data transfers of private user data between its various services and trackers would also pass muster with the Bundeskartellamt.

It’s time for explicit, voluntary consent 

It only takes a little extrapolation to see the likely future — at least in Europe. When it comes to the collection and exchange of personally identifiable information between apps, it’s  time for a mandatory ‘opt in’ from the user.

http://www.subr.edu/page/1978 

This post is also available in: GermanFrenchItalian

As a PR Consultant and journalist, Frink has covered IT security issues for a number of security software firms, as well as provided reviews and insight on the beer and automotive industries (but usually not at the same time). Otherwise, he’s known for making a great bowl of popcorn and extraordinary messes in a kitchen.