the interests or fundamental rights and freedoms of the data subjects, and also explain to them the safeguards they have taken to protect personal data, including, where appropriate, the right to opt out of the processing.101 In this respect the Working Party emphasises that consumer protection law, in particular, laws protecting consumers against unfair commercial practices, is also highly relevant here. If a controller hides important information regarding unexpected further use of the data in legalistic terms buried in the small print of a contract, this may infringe consumer protection rules concerning unfair contractual terms (including the prohibition against 'surprising terms'), and it will also not fulfil the requirements of Article 7(a) for a valid and informed consent, or the requirements of Article 7(f) in terms of reasonable expectations of the data subject and an overall acceptable balance of interests. It would of course also raise questions of compliance with Article 6 as to the need for a fair and lawful processing of personal data. For instance, in a number of cases, users of ‘free’ online services, such as search, email, social media, file storage or other online or mobile applications, are not fully aware of the extent to which their activity is logged and analysed in order to generate value for the service provider and therefore they remain unconcerned of the risks involved. In order to empower data subjects in these situations, a first necessary - but by no means in itself sufficient - precondition102 is to make it clear that the services are not free, and that rather, the consumers pay using their personal data. The conditions and safeguards subject to which data may be used must also be clearly spelled out in each case to ensure the validity of Article 7(a) consent, or a favourable balance under Article 7(f). III.3.6. The right to object and beyond (a) The right to object under Article 14 of the Directive Article 7(e) and (f) are particular in the sense that while they mainly rely on an objective assessment of the interests and rights involved, they also allow the self-determination of the data subject to come into play with a right to object103: at least in the case of these two grounds, Article 14(a) of the Directive provides that ('save where otherwise provided by national legislation') the data subject ‘can object at any time on compelling legitimate grounds
101
As explained on page 46 of the Working Party's Opinion 3/2013 on purpose limitation (cited above in footnote 9), in case of profiling and automated decision-making, 'to ensure transparency, data subjects/consumers should be given access to their 'profiles', as well as to the logic of the decision-making (algorithm) that led to the development of the profile. In other words: organisations should disclose their decisional criteria. This is a crucial safeguard and all the more important in the world of big data'. Whether or not an organisation offers this transparency is a highly relevant factor to be considered also in the balancing exercise. 102 For further possible safeguards with regard to the increasingly common situations in which consumers pay with their personal data, see Section III.3.6 in particular pages 47-48 on 'Data protection-friendly alternatives to 'free' on-line services' and on 'Data portability, 'midata' and related issues'. 103 This right to object should not be confused with consent based on Article 7(a), where the data controller cannot process the data before he obtains such consent. In the context of Article 7(f), the controller can process the data, subject to conditions and safeguards, as long as the data subject has not objected. In this sense, the right to object can rather be considered as a specific form of opt-out. See more details in the Working Party's Opinion 15/2011 on the definition of consent (cited in footnote 2).
44
