Prohibition of tying

The prohibition of tying is an important principle in data protection law that plays a central role, particularly in the context of the General Data Protection Regulation (GDPR). It prohibits the linking of consent to the processing of personal data with the provision of a service if the data processing is not necessary for the provision of the service.

Legal basis:

The prohibition of tying is enshrined in Art. 7 para. 4 GDPR:
“In assessing whether consent has been freely given, utmost account shall be taken of the fact whether, inter alia, the performance of a contract, including the provision of a service, is dependent on consent to the processing of personal data which are not necessary for the performance of that contract.”

Key aspects of the prohibition of tying:

1. voluntary nature of consent: Consent must be given without coercion. The data subject must have a genuine choice. 2. separation of contract and data processing: consent to data processing must not be a prerequisite for the conclusion of a contract if the data is not required for the performance of the contract. 3. proportionality: it must be checked whether the data processing is actually necessary for the purpose pursued. 4. transparency: The purposes of data processing must be presented clearly and comprehensibly.

Areas of application in the IT and media industry:

1. social media: platforms may not make the use of their services dependent on consent to extensive data processing. 2. app development: apps may not request more data than is necessary for their function. 3. online stores: Consent to promotional emails must not be a prerequisite for a purchase. 4. streaming services: The use of the service may not be made dependent on consent to the processing of usage data for advertising purposes. 5. software licenses: The use of software must not be linked to comprehensive data collection that goes beyond what is necessary for functionality.

Challenges and limits:

1. delimitation difficulties: In individual cases, it can be difficult to determine which data is actually required for the fulfillment of the contract. 2. business models: Some business models, particularly in the area of free online services, are based on the processing of user data for advertising purposes. 3. technical implementation: The implementation of systems that enable differentiated consent can be technically complex. 4. international application: The global nature of many IT and media services can lead to conflicts with less stringent data protection regimes in other countries.

Practical implementation:

1. granular consents: Providers should offer options for differentiated consent for various data processing purposes. 2. privacy by design: privacy-friendly default settings and systems should be integrated into products and services from the outset. 3) Transparent communication: The purposes of data processing and the consequences of not granting consent must be clearly communicated. 4. alternative offers: Where possible, companies should offer alternatives that require less data processing, possibly for a fee. 5. regular review: the necessity and proportionality of data processing should be regularly reviewed and adjusted.

Conclusion:

The prohibition of tying is an important instrument for protecting the informational self-determination of users. It presents companies in the IT and media sector with the challenge of designing their business models and technical systems in compliance with data protection regulations. At the same time, it offers the opportunity to build trust and differentiate themselves from the competition through transparent and user-friendly data protection practices. It is important for companies to take the prohibition of tying into account from the outset when designing their products, services and contracts. A careful analysis of the necessary data processing, combined with transparent communication and flexible consent options, can help to both meet legal requirements and increase user acceptance.