In the digital economy, one increasingly hears the claim that personal data is the “new currency”. Nevertheless, the Higher Regional Court of Stuttgart recently issued a decision dismissing a lawsuit brought by a consumer association against a retail chain and confirming that it is permissible to advertise participation in a loyalty programme as “free of charge”, even though users, in order to use the app, provide their personal data. The Court took a clear position – the provision of personal data, in and of itself, does not constitute “payment” or a “price” within the meaning of the relevant rules governing the pre-contractual information obligation regarding the total price.

Facts of the Case

Personal data controller was a well-known discount retail chain offering consumers a loyalty programme via a mobile application. Registered users, through their in-app account, received personalised product information and offers, including offers from third parties.

The registration terms contained the statement that participation in the programme was “free of charge”. At the same time, the terms provided that the app collects users’ personal data for the purpose of sending personalised offers and promotions, including a description of the categories of data processed, and that the data is also processed for the purpose of optimising the loyalty programme itself.

The Federal Association of Consumer Organisations initiated proceedings, arguing that the service was not “free of charge”, because the user in fact “pays for the service” with their personal data, and that the retailer therefore had to comply with the obligation to inform users of the “total price” of the service, as required for distance contracts under German consumer protection rules.

The controller argued that the obligation to inform about the total price applies only where there is payment in money, and not where personal data is provided. In addition, it stated that the collection and use of personal data for the purpose of personalising offers was clearly explained in the terms of use, and that transparency regarding processing is a matter of compliance with personal data protection rules.

The German Court’s Decision

The Court dismissed the claim and held that the provision of personal data cannot be qualified as “payment” or as a “price” within the meaning of consumer rules governing the pre-contractual obligation to provide information on the total price of the service in distance contracts. In interpreting the term “price”, the Court relied on European consumer law, emphasising that this notion relates to monetary remuneration (i.e. a digital representation of value), while the provision of personal data does not fall within that concept. For that reason, the fact that the retail chain described participation in the loyalty programme as “free of charge” in its terms of use was not considered problematic, given that consumers had no obligation to pay money and did not incur other costs within the meaning of the relevant regulations.

At the same time, the Court indicated that consumer protection in terms of awareness of the consequences of providing personal data is ensured primarily through personal data protection rules—particularly through the information obligations under Articles 13 and 14 of the General Data Protection Regulation (“GDPR”)—rather than by expanding the consumer-law concept of “price”. In other words, although personal data may have economic value in digital business models, this does not mean that it automatically becomes a “price” within the meaning of rules on the total price of a service.

The Court also examined the allegations that the statement about “free participation” was misleading from the perspective of competition law, bearing in mind that European guidance on unfair commercial practices warns that, in an online environment, it may be misleading to present a service as “free of charge” if personal data is collected without an adequate explanation of its use. However, in the specific case, the Court did not find deception, because the controller had appropriately explained, in the terms of use, the collection and purposes of processing of personal data, including an indication of the categories of data processed. Given that consumers did not incur a cost within the meaning of the obligation to inform about the total price, the Court concluded that the use of the term “free of charge” does not mislead consumers.

Finally, the Court did not engage in an assessment of whether specific GDPR obligations had been breached, because the claimant did not base its claims on an alleged infringement of the GDPR information obligations.

Significance of the Decision for the Relationship between Consumer Law and Data Protection in EU and Serbian Practice

The decision makes an important contribution to delineating consumer law and personal data protection law in the era of digitalisation. Although personal data is often discussed in public as a “currency”, the Court clearly indicated that this concept cannot be automatically transposed into the consumer-law framework, particularly when it comes to the pre-contractual obligation to provide information on the total price of a service. This confirms that “price”, within the meaning of the relevant consumer protection rules, primarily relates to monetary remuneration, while the provision of personal data is not qualified as payment.

At the same time, the decision serves as a reminder that the permissibility of advertising “free participation” does not relieve the controller of the obligation to inform users clearly and transparently about the processing of personal data. In practice, this means that regulatory risk most often does not arise at the level of the consumer-law concept of price, but at the level of transparency and lawfulness of the processing.

For Serbia, bearing in mind the alignment of the domestic framework with European standards, the decision indicates the direction of interpretation for models that rely on loyalty programmes and personalised offers. Controllers should therefore ensure that marketing statements are aligned with the content of the privacy notice, because the lawfulness of such models will, in practice, be determined precisely by reference to the transparency standard.

This article is to be considered as exclusively informative, with no intention to provide legal advice. If you should need additional information, please contact us directly.