Jusletter IT

Not only radio, but any digital media broadcast strives towards individual user engagement and personalisation of not only advertisements but also content which has been a trend since the 1990s. This holds to be especially true for social network based and context awareness-based recommender systems.¹ Such a system, which enables listeners of hybrid radio to consume a personalized broadcast as well as to interact with a radio station through the means of their favourite platform or chatbots.² In this paper we will discuss legal issues, in particular of data protection in the light of the General Data Protection Regulation (GDPR), in particular personalisation and collection of personal data in listener engagement, dealing with aspects of personalised content and social media interaction and monitoring.

As linear broadcasts tackle the topic of individual user experiences only in a limited manner, new ways of communication have been sought by the industry. Such a platform has been developed through a unified backend which enables a broadcaster to use a managing application for the editorial team and presenter with plugins such as integrating indexing, personalization, interaction and clustering services while emphasizing data protection compliance in the meantime.³ Personal data may be proposedly collected through three major applications. Users will have the opportunity to engage with a radio station of their choice through a webpage, a smartphone app or a chatbot implementation designed for the platform of their choice, for example, through the Facebook Messenger API.⁴ As each of these three applications require to be set up distinctly as they fulfil several disparate purposes, they are going to be evaluated individually.

The following three objectives are central to this process and outline the general concept:

• Enable the listeners to interact with radio in a personalized way through their preferred (social) channel and remain connected;
• Optimise tools and platforms for the radio editorial team to give them a better overview of interaction in order to engage more and better with their audience;
• Build innovative services and platforms to enable automation of user interaction;
• Through such objectives, multitudes of controllers and processors alike take part in processing operations. Processing activities include the training of neural networks for content recognition, indexing services to create searchable databases, deployment of personalisation services, integration of artist and music databases as well as maintaining user datasets.

Personalisation of services under collaborative filtering but not under recommendation-based systems inherently requires personal data to provide content suited to the individual.⁵ As such, preference models, age, gender, social media accounts, content consumption and even client devices deliver important information on how and which content the data subject likes to consume. In mapping the preferences to a user account authenticated by an e-mail address or another UID⁶ renders the user, as a natural person, identifiable and by that matter a data subject according to Art. 4 (1) GDPR⁷. As such, the material scope of the GDPR applies to any kinds of such operations until a user profile is being deleted or the data aggregated, therefore constituting a «disproportionate effort» in terms of time, cost and manpower to re-identify natural persons, the aforementioned being relative criteria.⁸

Personal data may be delivered by the data subject but also social media constitutes a major source for input for broadcasting services. Data made available to the public is very relevant for the justification of processing, in particular in scenarios using user generated content not only for the purpose of entertainment, but for news and other journalistic aims. In the following sections, the grounds of processing according to Art. 6 and 9 GDPR will be discussed and set into reference to the questions of user engagement.

Processing shall be lawful for purposes of legitimate interests of the controller that must be weighed against the interests of the data subject (Art. 6 (1) (f) GDPR). This provision shall be interpreted in harmony with the fundamental freedoms of the European Union (e.g. freedom of press and radio broadcasting).⁹ It encompasses economic interests which involves both user interaction as well as news reporting. To further determine this rather abstract provision, Rec. 47 states that one must consider whether the data subject can «reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.» Art. 6 (1) (f) GDPR should, however, not be understood as a catch-all provision that would allow almost any processing, as long as there is an «argumentative facade».¹⁰ To mitigate such negative effects the normative and individual¹¹ weighing of interests between controller and data subject shall be taken into account.¹² It should therefore be evaluated among the following points:

• Affiliation with the controller;
• if the processing is foreseeable or customary in trade;
• reasonable expectations of the data subject.¹³

As further outlined below, data subjects will expect processing activities only if they actively try to share stories or media content with a station by, for example, using a corresponding hashtag for a radio program.

In the context of (public) media, the right to freedom of expression (as enshrined in Art. 11 of the EU Charter of Fundamental Rights) should be addressed. Art. 85 (1) GDPR reads: «Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.» Even without an explicit law of Member States the right to freedom of expression has to be taken into account when balancing interests since freedom of expression can amount to a «legitimate interest pursued by the controller or a third party».¹⁴ In addition Rec. 153 GDPR, which corresponds to Art. 85 GDPR, states that «[i]n order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly.»¹⁵ When public data is used for the purpose of sharing it for journalistic purposes it is in general justified depending on the national implementation of Art. 85 GDPR. Therefore radio broadcasters shall be allowed to skim public media for the purpose of journalistic tasks.

If a broadcaster wants to know about current trends and events, having a look at trending hashtags on Twitter or using his own for the purpose of user engagement has almost become common practice. Personal data is «made public» if the subject releases data into a public space.¹⁶ As such, the accessibility to an indefinite number of people, e.g. no restrictions on who may be part of a social network, is therefore sufficient.¹⁷ According to Art. 9 (2) (e) GDPR processing of personal data shall not generally be exempted if processing relates to personal data which are manifestly made public by the data subject. This ground of justification also applies to «public posts» on social media platforms. Even if Art. 9 GDPR is applicable only to processing of «special categories of personal data», this clause is still relevant regarding processing of «normal» personal data. One even may argue that the legal basis for processing sensible data allows for an argumentum a maiore ad minus.¹⁸

However, the fact that personal data is publicly available can also be considered when weighing the interests or if it remains unclear if the data subject published his own data. In respect to publicly available data the ECJ ruled that, «in relation to the balancing which is necessary pursuant to Art. 7(f) of Directive 95/46¹⁹, it is possible to take into consideration the fact that the seriousness of the infringement of the data subject’s fundamental rights resulting from that processing can vary depending on whether or not the data in question already appear in public sources.»²⁰ Compared to the Satamedia case, also the processing purposes and the means of redistribution shall be taken into account.²¹ The ECJ also states that «[u]nlike the processing of data appearing in public sources, the processing of data appearing in non-public sources necessarily implies that information relating to the data subject’s private life will thereafter be known by the data controller and, as the case may be, by the third party or parties to whom the data are disclosed. This more serious infringement of the data subject’s rights enshrined in Articles 7 and 8 of the Charter must be properly taken into account by being balanced against the legitimate interest pursued by the data controller or by the third party or parties to whom the data are disclosed.»²²

From a technical point of view, social media as well as web forums usually allow searching and indexing their services either through an API or allow or deny access to their sites through Robots Exclusion Standard Protocol in order to decide if an indexer (or crawler) should have access for his specific purposes. Services like Twitter and Facebook use their own interfaces when it comes to searching through posts and the respective user database. Since the application of «robots.txt» on a website means only a prohibition of indexing by search engines, it does not necessarily imply the objection of a data subject to data processing. According to some opinions, the requirements for processing publicly available data according to Art. 9 (2) (e) GDPR are not being met just by the data subject publishing.²³

According to the principle of informational freedom, publicly available data shall be used by anyone²⁴ and, according to Martini, «no limits» exist regarding purpose limitation.²⁵ As Jahnel points out correctly, when gathering posts from social media networks it shall be considered whether additional information is gained by processing (e.g. via profiling) which themselves are not publicly available.²⁶ Such generation of «added value» by, for example analysis of «big data» sets, would therefore conflict with such postulation, not only because the data subject may not reasonably expect such activities. This seems to be the logical conclusion when considering the fact that this additional information cannot be attributed to the original intention of the data subject.

For radio broadcasters and editors however, social media analysis for market impact analysis plays an important role. Schulz does not condone an argumentum a maiore ad minus from Art. 9 (2) (e) but Art. 6 (1) (f) GDPR for passive research alone. Furthermore, such processing activities are privileged under Art. 5 (1) (e), 9 (2) (j) and 89 GDPR.²⁷ Such would yield massive benefits in the weighing of interests.²⁸ Due to the exception in Art. 89 (4) GDPR commercial purposes of a station would need to rely on the general framework, however, shall still be taken into account. If the processing is not based on the data subject’s consent or on a Union or Member State law²⁹, according to Art. 6(4) GDPR, processing for a purpose other than that for which the personal data have been collected can be justified. The criteria mentioned in Art. 6 (4) GDPR should, however, be considered when weighing the interests. After a weighing of interests and consideration of general principles as outlined in Art. 5 GDPR, this also applies to special categories of personal data.³⁰

In general, there is no incompatibility to be found between the publication of information on (public) social media and processing activities of a radio broadcaster and media services for user engagement. Especially considering the fact that in common practice, hashtags and trigger words are being used by the stations as well as by the users in order to find and be found.³¹

Radio stations see themselves confronted with processing additional information which will neither fall within the framework of weighing of interests, nor the performance of a contract. According to Art. 7 (4) GDPR, the controller has to prove why he needs which personal data for what purpose. However, the delicacy of the consent framework may be demonstrated by a recent ruling of the Berlin Regional Court against Facebook Ireland³² (Landgericht Berlin) which states that the terms «acknowledgement» and «read and understood» should not be used as they would move the burden of proof to the user.

The literature is divided with regard to the relation between the information being provided according to Art. 13 and 14 GDPR in a «Privacy Policy Statement» and to whether or not these informational provisions should be used as a reference to Art. 4 (11) GDPR («informed»). A violation of Articles 13 or 14 GDPR do not automatically result in an invalid consent.³³ However, they must be clearly separated or at least be highlighted when presented together.³⁴ Therefore, concerning the minimum requirements for valid consent, several opinions exist.³⁵ The WP29 guidelines on consent have been partially adopted by legal commentaries³⁶ but also criticized by the literature (e.g. exclusion of information regarding storage limitation in the agreement itself³⁷ or the idea of only including processing purposes as well as notice if and with whom personal data might be shared³⁸):

For a consent, economic aspects should be taken into account. How much information may a station be able to present on e.g. a mobile platform? A viable configuration shall therefore be the minimum information such as

• personal data in question,
• processing purpose(s),
• the identity of the controller or joint controllers

to be provided in addition to the information according to Art. 7 (3) GDPR with a general referral to the respective privacy policy in form of a(n) (embedded) link according to the WP29 document («integrated approach»).³⁹

Concerning storage limitation, the consent agreement does not impose a particular threat to the fundamental rights of the data subject as his right to revoke the processing activity does not depend on how long personal data is saved by the controller. A link to the data protection statement shall therefore suffice. Most controllers will employ processors. As media services use a multitude of processing services and share data across networks informing third parties about deletion requests according to Art. 17 (2) GDPR becomes very relevant. This is not to say that the third party, being a controller himself, does not have a legitimate basis to process said personal data. Only a «best effort» to inform is required.⁴⁰ In the case of joint controllers, according to Art. 26 (1) third sentence GDPR, a contact point for data subjects may be designated.⁴¹ Rec. 43 GDPR is referencing to Directive 93/13/EEC.⁴² Austrian rulings on such consumer contracts have been interpreting «factual knowledge in a specific case» quite «strictly».⁴³ Therefore, just informing about «third parties» in general is not sufficient.⁴⁴

Once consent has been revoked stations see themselves confronted with deletion. Overlap between legal basis of Art. 6 (1) GDPR is largely possible with constraint regarding consent: «In other words, the controller cannot swap from consent to other lawful bases. For example, it is not allowed to retrospectively utilise the legitimate interest basis in order to justify processing, where problems have been encountered with the validity of consent.»⁴⁵ Therefore, «if a controller chooses to rely on consent for any part of the processing, they must be prepared to respect that choice and stop that part of the processing if an individual withdraws consent.»⁴⁶ The commentary literature is unanimous regarding the interaction of Art. 6 (1) (a) GDPR and other legal basis in stating that «at least one» must be fulfilled, therefore enabling consent to be taken as a first choice regardless of other grounds of processing that might have taken its place.⁴⁷ Whereas Buchner/Petri argue that, concerning public institutions, an illusion of choice might be suggested to the data subject, the informational provisions of Art. 12 seq. GDPR still apply to the controller and suggest no detriment to the interests of the data subject; furthermore, the lawmaker did not intend a suspensory effect.⁴⁸

Concerning the use of chatbots and alternative means of automated communication another problem arises for a radio station: «The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 [of Art. 5] (‹accountability›).» This framework guarantees a degree of transparency to the data subject and ensures that such voluntary act is being recorded properly, independent of the text of the notion of consent itself.⁴⁹ This implies that such demonstration should be sufficient to show that the intended legal basis indeed has been consent.⁵⁰ The modality of such demonstration has not been specified by Art. 7 GDPR. As implicit consent is possible within the framework of the GDPR⁵¹ the literature argues, that such will be a valid basis⁵² alongside Art. 6 (1) (c) as processing to comply with a legal obligation to save data for demonstration.⁵³ This in understanding that according to Art. 5 (1) (b) GDPR such purpose is sufficiently specified.⁵⁴ Fundamental questions arise if a system will only collect an extremely limited amount of information rendering identification of data subjects hard and costly, being in no relation to the service provided:

• What data will be required to comply with Art. 7 (1) GDPR to sufficiently demonstrate consent?
• Will the data subject have to be identified?
• Is the processor in need of gathering more identifying data than needed for the performance of his service and his individual purposes?

To answer the first question concerning the threshold of being able to identify the data subject in recording and storing his notion of consent it is imperative to consider the operations of the controller and the context, the scope and the expectations of the data subject regarding the consent itself. The bare minimum of stored information should therefore consist of:

• Which relationship does Art. 7 (1) enter to with Art. 11 GDPR?
• The processing the subject consented to;
• An identifying object such as IP, e-mail or full name of the subject;
• An integer value as timestamp.

The literature suggests that, as the consent should be able to be proven by the controller as long as the respective legal basis lasts, only an e-mail address confirmed of being under control of the data subject should be used (double-opt-in-procedure).⁵⁵ However, in regards to question two, the principle of data minimisation says otherwise. The WP29 argues, that showing only «a link» to the processing should be of sufficient nature⁵⁶ while the previously cited literature at least acknowledges that certain evidence of the identity of a data subject will be challenging to provide in online environments.⁵⁷ This wording allows the deduction that the data subject does not necessarily have to be identified to give consent for the reasons of mail addresses not necessarily stating a clear name, leaving the data subjected merely identifiable. Another point pro can be found in Art. 12 (6) GDPR allowing the controller to request additional information of the data subject to confirm his identity. Stemmer also remarks, that electronically checking a box before using a service as a technical precondition will not be sufficient to demonstrate consent.⁵⁸ He also notes that an «electronic protocol» is a viable option of documentation.⁵⁹ Art. 11 GDPR says that a controller should not be held responsible to collect additional data not required for the performance of his service only to comply with the GDPR itself. The telos can be elucidated in two points being that the controller should not be obliged to identify every subject using a potentially not identifying service therefore protecting the controller from undue cost of identification and protecting the basic human rights of the data subject.⁶⁰ Should a controller be in need to collect more data about a subject just to demonstrate a compliant and therefore valid notion of consent, Art. 11 (1) as well as Art. 5 (1) (c) GDPR, the general principle of data minimisation, may be violated.

This leads to the conclusion that a controller shall only be held responsible to demonstrate a notion of consent with data of a higher level of identification if he himself is already collecting it. Web services analysing user behaviour and sharing tracking information with third parties should therefore not store a (dynamic) IP and a timestamp but the tracking ID itself as well as cookies and metadata from browser fingerprinting methods which require consent according to Art. 5 2002/58/EC.⁶¹ This as such storage would prove to be more concise than an additional IP address and would not violate the principle of Art. 5 (1) (c) GDPR as the data in question to demonstrate consent is being collected either way by the controller.

The service radio stations are providing consists in rending individual engagement with subjects possible by automated means making it easier to either share content and stories with editors or receive information and recommendations about the program and even personalised content. The literature remains relatively silent concerning the definition of «contract» which, of course, shall be interpreted autonomously according to union law. This imposes significant concern for a processing party if it remains unclear whether or not another lawful basis can be applied as a subsidy as denied by the WP29 in the initial publication of WP259.⁶² This interpretation has been highly questionable as the verbatim expression of the regulation, «no other legal ground for the processing»⁶³ and «at least one of the following [legal basis] applies»⁶⁴, points in the opposite direction. However, as outlined above, Art. 5 (1) (a) GDPR may be violated concerning the application of other legal basis as a subsidy for consent. According to the E-Commerce-Directive,⁶⁵ a contract is a legal transaction or obligation similar to a legal transaction.⁶⁶ A quasicontractual relationship can therefore be designated as a contract if they are based on a voluntary decision of the data subject.⁶⁷ Quasi-contractual relations on a goodwill basis are seen as being included by Albers⁶⁸ as well as Buchner/Petri⁶⁹ while Schulz⁷⁰ and Frenzel⁷¹ uphold a different opinion as free services shall not be included, as the term «enter […] into a contract» shall be interpreted strictly. According to the latter, unilateral contracts may be also included (e.g. «Auslobung» in Germany).⁷² Even if no classical payment is required as economic counter performance, such a service still remains synallagmatic if the user provides personal data for purposes such as market analysis and personal advertisement.⁷³ This leads to a situation where users «pay» for a service with personal data. However, in the case of the aforementioned purposes, users receive the service of easily obtaining program information and personalised content or receive a chance to broadcasted live while at the same time editors may benefit by creating additional content for a radio program out of submitted media and stories.

Most mobile applications are being provided through the means of an app-store like Google Play or the Apple App-Store. The user will, before entering into relations with the app provider, be presented a text message or text box. Multiple opinions exist on with whom a contract will be concluded when a user downloads an app via the app store. Lachenmann uses the agreement between the app stores and the developer⁷⁴ whereas Bisges finds that for the reasons of liability issues and developers being the ones offering their various services and should be the ones a contract will be concluded with.⁷⁵ Following the opinion of Lachenmann, the Apple App-Store would be the contracting partner, on the contrary to Google Play. Regardless of the conformity of such statement to domestic laws and consumer provisions, terms of service shall be presented and agreed to by the subject, designating the user and the service provider (radio station) as parties.⁷⁶

Some stations allow users to access an embedded chat interface. A contract requires affirmative or at least conclusive action by one party; this shall be a declaration of intention. However, no affirmative action will be required on the user side. The subject is able to access the feature by simply entering and sending text. However, the user is not being presented with the possibility to enter into a contract as well as will not have the general impression of doing so since, on a goodwill basis, no declaration of intent happens. Therefore, no personal data should be processed under the legal basis of performance of a contract. This effect could be mitigated by an application that will let the user sign in before using the service itself, rendering it easier to construct an obligation. Else, as outlined above, legitimate interest shall be an alternative.

Especially regarding social media monitoring, several questions regarding to Art. 14 GDPR have to be dealt with. Special transparency requirements arise with the use of cookies («access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information»⁷⁷) as long as they carry personal data.⁷⁸ This can either happen through the privacy policy statement as outlined above or directly through a banner. According to the WP29, cookies must conform to two criteria⁷⁹ in being either strictly necessary for communications or being requested by the user and required to perform a service of the information society. Cookies from social plugins such as the Facebook login will not match the first criterion if the user is not already logged in.⁸⁰ The user is therefore required to opt in beforehand. As it is impossible to inform a data subject using the designated hashtag of a radio program that invites users to share content via Twitter, the provision of information would involve a disproportionate effort. It shall be considered to therefore include links in a stations social media profile pointing to data protection statements as a subsidiary measure.

Social Plugins shall be considered trackers as well, as they gather personal data in order to generate statistical information about website use or store personal preferences of the subject to display personal advertisement. A Facebook plugin transmits data such as session cookies and transient cookies of the implemented webpage as well as cookies used for identification of the subject from other partner sites.⁸¹ It is debatable whether website operators are fully responsible as controllers for the data collected by such plugins but should take full responsibility for any personal data collected on their website.⁸² However, considering the latest ruling of the ECJ, Schleswig-Holstein, entities processing personal data are being considered joint controllers if the operator is able to request analytics from the service provider.⁸³ Wille suggest a «double-click solution» in order to gain the user’s consent.⁸⁴ This can be achieved by letting users enable social plugins themselves or only providing a link to the social media platform, thereby assuring that no personal data is being collected by the website and immediately shared with another entity.

Online personalisation and user privacy need to go hand in hand as personal attributes and preferences are often strongly correlated and therefore of high value in big data industries.⁸⁵ According to Art. 13 (2) (f) GDPR, such additional information would include the information about the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR. The former constitutes that automated decision making has to «produce legal effects concerning him or her [data subject] or similarly significantly affects» the data subject. Since basically anything could show regards to a legal effect, this specific regulation has to be interpreted restrictively. Does the selection for a prize game already fall under the scope of «legal effects»? Looking at Rec. 71 GDPR, it might appear that only negative and restricting legal consequences fall under the scope. With regards to the wording of Art. 22(1) GDPR «similarly significant affects» or in the German wording «in ähnlicher Weise […] beeinträchtigt», meaning that the additional scope of similar effects encompasses only adverse consequences. While every translation of the text of the directive is equally valid and is therefore of the same importance as the English version, there is still some discussion in the literature regarding the necessity of said negative impact since the GDPR does not define the threshold of «similarly significant […] effects». The WP29 states, however: «similarly significant effects may be positive or negative.»⁸⁶ Ultimately, this depends on how the radio station designs its systems. The general consequences should therefore be balanced with considerations to the precision of the methods, excluding trivial operations.

Radio stations face several hurdles if they want to efficiently engage an audience as large as possible and enabling personalisation features whilst supporting many platforms of choice to communicate such as Twitter.

Radio broadcasters shall be allowed to skim public media for the purpose of journalistic tasks. Processing of public data, regardless of the application of either Art. 6 or 9 GDPR, should not be detached from the original purpose of publishing. For processing additional information which will neither fall within the framework of weighing of interests, consent from the data subject is the obvious choice. However, the provisions concerning consent, identification and withdrawal of consent must be observed. Further, information provisions must be complied with.

As a large quantity of users engage with a radio station, it is of importance to consider the special rules on automatic processing of data. In most cases, the processing by radio stations will not produce legal effects.

This work has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement no. 761802, MARCONI.