Introduction

Directive (EU) 2019/770, otherwise known as the Digital Content Directive (DCD), has recently been implemented in Italy within the Chapter I-bis of the Italian Consumer Code. Among other things, the implementation reignited the debate over personal data monetization (i.e. the possibility for data subjects (and entities) to sell and share personal data as assets with an intrinsic economic value). Many commentators viewed the DCD as an opening to the practice of providing digital content or services in exchange for personal data (instead of a price payment). In this regard, Recital 24 of the DCD explicitly states that “digital content or digital services are often also supplied where the consumer does not pay a price but provides personal data to the trader” and that “such business models are used in different forms in a considerable part of the market.”

However, data monetization is often seen as a threat to the fundamental right to the protection of personal data. In fact, there are conflicting positions at the EU level, and in particular in Italy, as to whether monetization of personal data is a practice that complies with the data protection legal framework. In order to better assess the current positions on data monetization, we set out below some examples of divergence in this respect.

Arguments against data monetization

The European Data Protection Board (EDPB), in its Guidelines 2/2019 on the processing of personal data in the context of online services states that “considering that data protection is a fundamental right guaranteed by Article 8 of the CFREU, and that one of the main purposes of the GDPR is to provide data subjects with control over information relating to them, personal data cannot be considered as a tradeable commodity.” The EDPB clarified that the processing of personal data differs from monetary payments for multiple reasons, including the fact that, once control over personal data has been lost, it may not necessarily be regained. The same position was later confirmed in the EDPB’s Statement 05/2021 on the Data Governance Act, which highlighted that personal data cannot be exchanged or traded in a way that breaches data protection principles. The EDPB and the European Data Protection Supervisor (EDPS) followed the same reasoning in their Joint Opinion 2/2022 on the Data Act proposal. Although data subjects can consent to the processing of their personal data, they still cannot waive their fundamental rights. In this respect, according to the EDPB and EDPS, the prospect of “commoditization” of personal data would unacceptably undermine the very concept of human dignity and the human-centric approach underpinning the European legal order.

Similarly, the Chairman of the Italian data protection authority (Garante), during the Parliamentary hearing on the protection of consumers and users, on February 16, 2022, emphasized the importance of appropriate digital education to allow truly free and informed choices in the age of the “zero-price economy” (i.e.  the provision of content and services that appear to be free but are actually paid through the collection of personal data). In the Chairman’s view, the monetization of consent may even lead to the “monetization of freedom” of individuals and the “re-feudalization” of social relationships, to the detriment of the most vulnerable persons.

Arguments in favor of data monetization

The Italian Courts seem to hold a conflicting view. According to the Italian regional administrative Court of Lazio (TAR Lazio), the argument that personal data are only protected as a fundamental right safeguarded by data protection law represents a simplistic and partial view of their inherent potential. Personal data can in fact constitute a commercial asset “capable of assuming the function of consideration (counter-performance) of a contract in the technical sense.”

Consent can therefore constitute the object of commercial transactions, provided that “economic operators must comply with the requirements of clarity, completeness and non-deceptiveness of the information provided for by consumer protection law.”

A similar conclusion seems supported by recent developments in the practice of French and Austrian Data Protection Authorities, which have concluded that the so-called “pay or consent” mechanism may be considered valid, subject to certain requirements. While the cases concerning “pay or consent” mechanisms relate to very specific circumstances of otherwise paid services that are provided free of charge if cookie consent is granted, some commentators view this as a clear opening to the recognition of the monetary value associated with the use of personal data.

Concluding remarks

Despite the current uncertainty, while asking for more clarity and consistency from the regulators, most commentators consider data monetization as an inevitable development of current business models (especially for operators of the online and digital advertising). At the same time, there is little doubt that the monetization of personal data can lead to risks of data being used detrimentally, lower protection of fundamental rights, and invalidity of consents, where the data subject's capacity to make a free choice is in some way inhibited. Any legal strategy to address data monetization will require a case-by-case assessment, taking into account, among many other things, local data protection and consumer protection laws.

This article has been co-authored with Marco Propato and Luca Zannoni.