Paying with Data : A Study on EU Consumer Law and the Protection of Personal Data

Sammanfattning: “If you are not paying for the product you are the product”. In a paraphrasis: if you do not pay for the product with money, you probably pay for it with your personal data. This is a common understanding we have nowadays when it comes to how a number of IT companies work; and this understanding has some very solid grounds since business models based on creating direct revenues by processing personal data – be it sharing the data or insights from the data or creating profiles that are then used to provide targeted advertisements and promotions – are the main reason why most of today’s tech giants have become so profitable. In the EU the processing of personal data has traditionally been regulated under the data protection law regime. However, lately a new approach has gained in popularity where consumer law may also be applied in order to augment the protection of consumers when they provide their data in exchange for a product. A number of scholars, authorities and even some national courts have examined and recommended solutions on how consumer law could be interpreted in order to include the protection of consumers from unfair practices and contractual terms with regard to the processing of personal data by traders. This study, however, takes a step back and ponders whether there are any legal reasons for such a new approach, based on the substantive protection consumer law may provide under its notion of fairness. More specifically, it is examined whether consumer law indeed provides a better or different kind of protection for consumers with regard to their personal data when they “pay” with them in comparison to the protection provided solely under the EU data protection law regime, as well as what new understandings this new approach entails both with regard to consumer law and data protection in general in the EU.