The Hamburg Data Protection Authority (DPA) is facing a lawsuit from privacy advocacy group noyb after it declared the controversial ‘Pay or OK’ consent system used by news magazine DER SPIEGEL to be permissible. This system forces users to either consent to personal data usage or subscribe to the service.
The case began in the summer of 2021 when a complainant filed a GDPR complaint against DER SPIEGEL’s use of the ‘Pay or OK’ banner. The Hamburg DPA took nearly three years to conclude that the system was acceptable, without thoroughly investigating the facts or considering the implications for genuine user consent. The complainant and other users argue that having to pay for privacy rights does not constitute voluntary consent, a concern echoed by the EU Commission.
During the proceedings, the Hamburg DPA maintained close contact with DER SPIEGEL, meeting with company representatives and providing feedback on their proposed changes. This behavior has raised concerns about the DPA’s impartiality, as it appears to have provided SPIEGEL with legal advice at a fraction of the cost typically charged by law firms. The complainant, on the other hand, was not involved in the discussions and many of his messages went unanswered. Dr. Raphael Rohrmoser, the complainant’s lawyer, pointed out that the Hamburg DPA’s actions effectively gave SPIEGEL an unfair advantage, undermining the authority’s role as an impartial investigator.
In response to the DPA’s decision, the complainant has filed a lawsuit with the Hamburg Administrative Court, seeking to overturn the ruling. If successful, the DPA will be required to revisit and reassess the original complaint from 2021. This case highlights the ongoing debate over user consent and the responsibilities of data protection authorities in upholding privacy rights.