Consumers are often unaware that they may very well be paying something in return for services advertised as “free” by certain providers: Although the consumer does not pay a fee in the traditional sense for the provider’s service, instead he or she voluntarily transmits personal data to the provider, e.g. by participating in a customer card system in order to receive discount codes. These personal data are processed by the provider and resold, for example, for personalised advertisements. The providers of “free” services make considerable financial profits this way.
On this occasion, and in order to strengthen the rights of consumers, legislators have legally regulated “payment with data” as part of the implementation of the European Directive on certain aspects concerning contracts for the supply of digital content and digital services (DIDRL) (PDF only in German). As of 1 January 2022, as soon as the provider requests personal data in excess of the required level for its service to the consumer, a contract is concluded between providers and consumers for consideration. It should be irrelevant whether consumers consciously and actively provide the data or only allow the provider to collect the data.
Prior to the conclusion of this contract, consumers will be informed in the future about the use of the transmitted data in that the provider of the service must explain that and to what extent personal data are to be collected as consideration for the respective service. Via the revised § 312 of the Civil Code and the newly inserted § 327 thereof, the applicability of the provisions on digital products and the consumer protection provisions is extended to contracts through which the consumer provides personal data. This means that the consumer has a revocation right and can therefore change his or her mind and withdraw from the contract after it has been concluded.
To protect providers, a right of termination has been stipulated in the event consumers revoke their consent in data protection law or object to the processing of their data. This is because the provider should also not be obliged to offer its service free of charge.
Practical notes
The question of what legal implications arise from an exchange of services in return for personal data and how consumers will be protected in such cases in the future has now been definitively clarified by lawmakers. In addition, it is to be expected that “free” offers of services as of 1 January 2022, if they are not completely eliminated, will in any case only be available to a greatly reduced extent, so that the legislative objectives can be expected to be achieved.
Service providers are required to make their service offerings more transparent and to inform consumers about the use of their personal data and about their revocation right.