The Norwegian Data Protection Authority (Datatilsynet) has opened supervisory proceedings against Schibsted regarding the group’s payment solution for avoiding behavioural advertising, after receiving more than 30 complaints and around 100 tips.
The question is whether the arrangement, under which readers must pay in order to avoid tracking-based advertising, satisfies the requirements for freely given consent.
It was at the end of May this year that Schibsted introduced mandatory payment for subscribers who wish to avoid being served surveillance-based marketing on the websites of its regional newspapers.
The system is called “Schibsted Ad Choice” (Schibsted annonsevalg). Reactions were strong, including from the data and developer community. Subscribers cancelled their subscriptions in protest, writes Kode24.
The Norwegian Consumer Council (Forbrukerrådet) and the privacy organisation NOYB filed a complaint about the payment scheme with the Norwegian Data Protection Authority and contend that it does not satisfy the privacy legislation’s requirements for freely given consent.
The Director of the Norwegian Consumer Council, Mette Fossum, says that privacy is a fundamental right that should not cost extra.
Could result in a ban
Schibsted has now been ordered by the Norwegian Data Protection Authority to submit documentation and explain how, in its view, the solution complies with the regulations.
Director Line Coll of the Norwegian Data Protection Authority describes the case as one of principle and says that it has generated broad engagement.
Head of Section Tobias Judin says that it is too early to assess what sanctions Schibsted could potentially be subjected to, but points out that the available measures may range from prohibitions and deletion of data to reprimands or administrative fines.
The case has high priority, but the Authority cannot estimate how long it will take.
“We are not selling privacy”
Schibsted’s Head of Communications, Bjørn-Martin Bache Nordby, says that the group takes the supervisory proceedings seriously and will cooperate, and rejects the claim that it is “selling privacy”.
He maintains that all readers have the same rights under the GDPR (General Data Protection Regulation), regardless of their choice, and that Schibsted disagrees that the solution violates the regulations.
– We disagree with their [the Norwegian Data Protection Authority’s] assessment. Schibsted carried out thorough legal assessments prior to the rollout and stands by the solution we have implemented.
According to Nordby, Schibsted has drawn on experiences and assessments from other European countries in developing the solution.
– The background to Ad Choice is that consent requirements are being interpreted more strictly than before, while editor-controlled media are facing increasingly strong competition for advertising revenue from global platforms. Schibsted Ad Choice is our way of responding to this development, Nordby tells Kode24.