Noyb sues Hamburg DPA for approving ‘pay or okay’

The Austrian privacy advocacy group Noyb is suing the data protection authority (DPA) from Hamburg for allowing the German news magazine Der Spiegel to use the ‘pay or okay’ business model for its website.

In the Summer of 2021, the DPA from Hamburg received a GDPR complaint against the ‘pay or okay’ banner displayed on Der Spiegel's website. Readers had to decide whether to pay a subscription fee to read all content on the German news outlet’s site or give Der Spiegel permission to collect and use their personal data.

It almost took three years for the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI) to determine that Der Spiegel was permitted to implement the controversial ‘pay or okay’ model onto its website.

Noyb, however doesn’t consider ‘pay or okay’ as a fair business practice.

“It is known that more than 99.9 percent agree to track when confronted with ‘pay or okay’. Yet only 3 to 10 percent actually want personalized advertising. In the meantime, even the EU Commission has expressed considerable doubts about the legality of the model,” the Austrian interest group says in a statement.

Furthermore, Noyb argues that the DPA from Hamburg met with representatives of Der Spiegel several times, but no serious discussion took place to justify the DPA’s decision. Instead of listening to the person who filed the complaint, the regulator provided legal advice to Der Spiegel on how to implement ‘pay or okay.’ The complainant was only informed after the decision had been made.

Max Schrems, honorary chairman of Noyb, argues that a privacy regulator can’t provide legal advice and simultaneously sensitize companies.

“Nobody should be a lawyer and a judge at the same time. However, the Hamburg data protection authority seems to see no problem in advising companies or even actively calling for the introduction of ‘pay or okay’ instead of objectively investigating the facts. It is obvious that the authority will not consider the changes it has arranged as illegal,” he says.

Noyb and the complainant have filed a lawsuit with the Hamburg Administrative Court to have the DPA’s decision overturned. If successful, the HmbBfDI will have to reconsider the complaint from 2021.