New Noyb lawsuit says Hamburg data watchdog acted as lawyer for German newspaper

Noyb sued the Hamburg data protection authority on Thursday (1 August) in a bid to overturn its recent decision that German newspaper Der Spiegel “pay or okay” model was lawful, arguing that the DPA gave the newspaper legal advice in a previous case.

The influential non-profit Noyb, founded by Austrian activist lawyer Max Schrems, filed a complaint under the General Data Protection regulation (GDPR) with the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) back in 2021 over Der Spiegel’s “pay or OK” banner.

Der Spiegel’s “pay or OK” model requires users to either pay for accessing its website or agree to certain terms, which include the “storage and processing of data for personalised advertising with profiling,” reads Der Spiegel’s website.

The court ruled that Der Spiegel’s banner was permissible after three years.

In that time, HmbBfDI was “in close contact” with the newspaper, “invited them to its premises and provided feedback on the proposed changes,” charging Der Spiegel €6,140 in administrative costs, Noyb said in a Thursday press release. At the same time, they declined to hear from the complainant.

Noyb is now suing HmbBfDI at the Hamburg Administrative Court to have the decision overturned, arguing that the authority acted both as lawyer and judge for Der Spiegel.

“The Hamburg data protection authority has obviously provided Der Spiegel with legal advice,” said the complainant’s lawyer Raphael Rohrmoser.

Der Spiegel declined to comment on the lawsuit, saying it did “not wish to anticipate” the answer of the Hamburg authority, a spokesperson told Euractiv.

HmbBfDI did not respond to Euractiv’s request for comment at the time of publication.

Screenshot of Der Spiegel’s “pay or OK” banner, the subject of three years of controversy.

An empty decision?

Under the GDPR, data protection authorities might “sensitise” companies, but not advise them, Noyb said.

When resolving the 2021 complaint, the authority did not provide “justification as to why users having to pay for their basic rights should constitute a voluntary consent and genuine freedom of choice,” stated Noyb.

The public and EU authorities disapprove of the “pay or OK” model, the non-profit said.

The European Commission recently said that Meta’s similar “pay or OK” model is in breach of digital competition rules in preliminary findings. The model does not give users an “equivalent” choice that does not come with data collection and personalised ads because it charges for an ad-free experience, the Commission said.

The European Data Protection Board – composed of all national data protection authorities of the 27 EU countries – published an opinion in April saying that Meta’s “pay or okay” binary approach was not compliant with the EU’s data privacy regulation.

HmbBfDI even advised another media company to follow a similar model, Noyb said in its press release.

Noyb has filed two complaints on Meta’s “pay or OK” model, one in November 2023 and another in January.

[Edited by Chris Powers]

Read more with Euractiv