Location Data as Contractual Counter-Performance: A Consumer Perspective on Recent EU Legislation

Abstract

This chapter analyses recent developments in the area of digital consumer law in the EU while focusing on the ‘data as counter-performance’ quandary and its application to location data. The immense technological and economic significance of location data in smart urban spaces renders them a relevant subject for inquiry in the context of ongoing legal efforts to protect consumers who grant permission to use their location data in exchange for digital goods and services.

This work has been funded by the Federal Ministry of Education and Research of Germany (BMBF) under grant No. 16DII111 (‘Deutsches Internet-Institut’). Zohar Efroni, Dr., LL.M., is Research Group Lead at the Weizenbaum Institute for the Networked Society in Berlin, Humboldt University Law Faculty, Berlin, Germany.

1 Introduction

The classic problem of how to get from point A to point B in the most efficient and convenient way demands new solutions in our digital time and age, especially in modern cities, which are home to 70% of the EU population.¹ Technological solutions are predominantly based on the generation, collection and extensive use of electronic data. To name just one example, ‘mobility as a service’ (MaaS) stands for a technology-based platform solution in an urban setting that heavily relies on multiple mobility data sources.² Location data play a key role not only in MaaS platforms but also in many other data-driven solutions, technologies, products and business models that shape life in the hyper-connected environment powered by the growth of smartphones. The promise of location-based services and personalised mobility solutions for consumers is considerable—and so are the challenges and risks they pose to individual interests.

A recent privacy incident that has captured much media attention is illustrative. Apple’s iPhone 11 Pro was reported to have continued collecting location data even when the user set the iPhone not to collect such data.³ Namely, the phone continued pinging its GPS modules despite users’ deliberate choice to disable this function.⁴ In this way, contrary to users’ expectations and possibly to Apple’s own privacy policy, it was impossible to completely turn off location-based system services simply by individually switching off location services for all applications and system services. Rather, users needed to turn off all global location services in the device settings.

Apple replied to the allegation by explaining that the matter was rooted in the ‘ultra wideband technology’ embedded in the device.⁵ This technology endows the device with spatial awareness to identify other ultra wideband devices nearby. One application of this technology is enabling file sharing between devices via AirDrop.⁶ Apple added that the management of ultra wideband compliance and its use of location data are done entirely on the device and that the company is not collecting user location data.⁷ Still, the revelation was not particularly flattering for a company that takes pride in its comparatively strict privacy and security standards.⁸

The location data that mobile devices collect fuel giant, global and in some cases thinly regulated markets, which often operate and prosper entirely unnoticed by those who own the devices. A series of articles in The New York Times picked up the topic. As part of The Privacy Project, reporters obtained a file containing more than 50 billion location pings from over 12 million US citizens as they moved through several major cities such as Washington, San Francisco and Los Angeles.⁹ The newspaper attained the data from a commercial location data company—one of dozens of its kind—that collects precise location data by utilising software included in mobile phone applications. The online article illustrates via the use of interactive heatmaps and analytics techniques how much can be learned about people simply by following their movement traces over time, and how easy it can be to obtain and use such data in the absence of effective regulation.¹⁰ The report shows further how omnipresent surveillance is and how penetrative it can be. A US advertising executive was quoted as describing the location data industry there as ‘the Wild West’.¹¹

Shortly before this chapter went to print, a global crisis overshadowed all the problems location data have elicited so far, and for that matter, it dwarfed all other national, regional and global problems as well: As of July 15th 2020, the novel coronavirus (SARS CoV-2) has caused over thirteen million infection cases and over half a million deaths worldwide. In order to slow down its expansion rate and bring the spread of the pandemic under control, an early identification of infected individuals as well as all other individuals who have been in contact with them is considered critical: Knowing the mobility patterns of positively tested individuals during the relevant period, cross referencing this data with the location data (typically generated by smartphones) of all the persons who were in close physical contact with them, and then, based upon matches, taking preventive measures such as sending direct SMS warnings, ordering quarantine and isolation, conducting pinpointed testing, etc., is considered by many a promising, even a vital strategy to contain the disease.

This current example comes to briefly demonstrate both the enormous utility location data may have and the potential for misuse. In times of crisis such as these, the harm to privacy rights and even to the integrity of the political system in some democracies as a whole often go unnoticed. Less people ponder now whether a massive and unchecked collection of location data by the government as part of the measures it takes against a health disaster of this dimension is justified, proportionate and in conformity with fundamental rights.

In emergency situations, as in normal times, utilising location data is particularly prevalent in modern urban environments, in which mobility becomes ever ‘smarter’ and in which movement patterns can be ascertained and exploited in more accurate, sophisticated and pervasive manners.¹² With this observation in mind, the aim of this chapter is twofold. The first part (Sect. 2) seeks to sketch the main issues triggered specifically by location data and the application of EU data privacy and data protection law to evolving commercial scenarios. This part argues that assessing the problem requires a broad perspective that, besides law, includes technological and economic aspects of newly evolving ecosystems. The three spheres are often intertwined: technological advancements offer new solutions to familiar problems, and moreover, they offer entirely new behavioural options and choices (that might ultimately create new problems). The potential added value for consumers stimulates economic activity and business models designed to monetise technological innovation and enhance consumption. All this happens within a legal environment that might impose restrictions on technology and commerce and where regulative adjustments might be called for.

The second part (Sect. 3) focuses on risks and opportunities for consumers who are willing to trade their (location) data specifically for digital goods and services. Providing the data often relates directly to benefiting from more personalised, finely tuned and, in the end, useful technological solutions. In light of the rising trend often described as (consumer) data commodification,¹³ the second part endeavours to provide initial insights into the problem of location data that economically—and potentially also legally—function as a counter-performance, particularly after the enactment of Directive (EU) 2019/770, which addresses the topic.

2 Location Data: Conceptual, Technological and Economic Perspectives

2.1 Conceptual and Definitional Perspectives

2.1.1 General Observations

Location data is a term often used in the context of digital technology and economy but which is less often explained or treated as a unique type of data that creates a unique set of problems.¹⁴ In order to somewhat narrow the scope of the present discussion, it appears reasonable to begin by limiting it to machine-readable data, i.e. data that are generated, stored, analysed, aggregated, enriched, edited, manipulated, transmitted, etc. by the use of digital machines and devices. Next, it is clear that location data in our context go beyond the colloquial meaning of a category of machine-readable data that essentially indicate a physical location in space (often referred to as ‘geolocation’¹⁵); non-spatial information can also reveal the location of an individual.¹⁶

In addition, technologies that collect and utilise spatial coordinates very often match it with temporal data, namely timestamps associated with pings of physical locations. The timestamps are an integral element of the data from a technological perspective.¹⁷ Hence, some academics¹⁸ and actors in the business-technology sector¹⁹ use the term spatio-temporal data to more precisely describe the data being collected and processed for analytics, functionality, mobility and other purposes. Moreover, fully capturing the essence and value of location data includes not only an indication of physical location at a certain time but also information about the direction and speed they may encapsulate.²⁰

Location data hence provide the basis for mobility data,²¹ a concept that is intimately related to the common understanding of smart mobility. In turn, smart mobility was defined on one occasion as ‘collecting, managing, and analysing (fusing) various data sources related to different aspects of residents’ movement in order to better understand and improve the way people move.²² It follows that smart mobility crucially depends on high quality mobility data on a massive scale and from multiple sources.

Spatio-temporal data can be said to create an interface layer between the presence and behaviour of a person in cyberspace and the presence and behaviour of that person in real space. Beyond the deductive force of such data (knowing the physical location of a person at a certain time can disclose personal preferences, tastes, behaviours and social connections),²³ the data interface layer highlights a problem that can be described as the vanishing boundaries between living and operating in these two ostensibly distinct and yet increasingly intertwined spaces.²⁴

The location component not only triggers the question of (which) space but also the question of what or whom. Location data are machine generated. With various levels of accuracy, they ascertain the location of a device—not a natural person. Attributing the location to a specific individual is necessarily based on assumptions, correlations, statistical calculations and often on additional data sets and information that establish the presumed nexus to an individual.²⁵ It can be reasonably assumed, for instance, that the location of a smartphone at a certain time and the location of the person registered as its owner are one and the same. Based on device location data alone, however, a certain degree of uncertainty always remains.

2.1.2 Legal Definitions

Location data are potentially subject to data protection and data privacy laws. Though the main legal data protection instrument in the EU—the GDPR²⁶—mentions location data by name in its definition of ‘personal data’,²⁷ it neither defines this term nor provides a detailed explanation. The ePrivacy Directive,²⁸ which aims to guarantee the confidentiality of communications over publicly available electronic communication networks and services, defines location data as meaning ‘any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service’.²⁹ Recital 14 of this Directive is somewhat more detailed in providing that:

Location data may refer to the latitude, longitude and altitude of the user’s terminal equipment, to the direction of travel, to the level of accuracy of the location information, to the identification of the network cell in which the terminal equipment is located at a certain point in time and to the time the location information was recorded (emphasis added).

The ePrivacy Directive distinguishes between ‘location data’ and ‘traffic data’, with the latter defined as ‘any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof’.³⁰

Based on these definitions, the Directive further distinguishes between the protection scheme and compliance requirements pertaining to ‘traffic data’ on the one hand and ‘location data other than traffic data’ on the other. Regarding the latter category, Art. 9(1) of the ePrivacy Directive provides, inter alia, that ‘[w]here location data other than traffic data, relating to users or subscribers of public communications networks or publicly available electronic communications services, can be processed, such data may only be processed when they are made anonymous, or with the consent of the users or subscribers to the extent and for the duration necessary for the provision of a value added service’.

Accordingly, location data only sometimes qualify as traffic data—it depends on whether the data processing goes beyond the mere purpose of enabling the transmission of communication.³¹ This structure, and specifically the lack of sufficient coherence in the distinction between location data that qualify as traffic data and location data that do not as well as the separate sets of rules that apply to each category, has been criticised.³² Realising these deficiencies, Art. 29 Working Party (predecessor of the European Data Protection Board) recommended merging the provisions of Art. 6 and Art. 9 of the ePrivacy Directive, suggesting furthermore that both traffic data and location data are ‘metadata’ of increasing informational value that should be subject to a harmonised consent-based regime.³³

This approach was adopted in the Commission’s proposal for the ePrivacy Regulation,³⁴ which, once enacted, would repeal the ePrivacy Directive and drop the distinction between traffic data and location data—including their respective definitions.³⁵ At the same time, the ePrivacy Regulation Proposal would introduce an explicit distinction between the content of electronic communications and metadata. Recital 2 of the ePrivacy Regulation Proposal explains:

The content of electronic communications may reveal highly sensitive information about the natural persons involved in the communication, from personal experiences and emotions to medical conditions, sexual preferences and political views, the disclosure of which could result in personal and social harm, economic loss or embarrassment. Similarly, metadata derived from electronic communications may also reveal very sensitive and personal information. These metadata includes the numbers called, the websites visited, geographical location, the time, date and duration when an individual made a call etc., allowing precise conclusions to be drawn regarding the private lives of the persons involved in the electronic communication, such as their social relationships, their habits and activities of everyday life, their interests, tastes etc.³⁶

This approach reflects the understanding that both location data and traffic data fall under the concept of ‘metadata’, a designation that nonetheless is not contradictory to the very sensitive personal information they may contain. The Proposal maintains a different distinction manifested in new definitions of ‘electronic communications content’³⁷ and ‘electronic communications metadata’.³⁸ Accordingly, data on the location of the device generated in the context of providing electronic communications services and the date, time, duration and type of communication qualify as electronic communications metadata. After noting the great importance users attribute to the confidentiality of their communications and their wish to control the use of electronic communications data for purposes other than conveying the communication, Recital 17 of the Proposal provides:

Therefore, this Regulation should require providers of electronic communications services to obtain end-users’ consent to process electronic communications metadata, which should include data on the location of the device generated for the purposes of granting and maintaining access and connection to the service. Location data that is generated other than in the context of providing electronic communications services should not be considered as metadata. Examples of commercial usages of electronic communications metadata by providers of electronic communications services may include the provision of heatmaps; a graphical representation of data using colors to indicate the presence of individuals. To display the traffic movements in certain directions during a certain period of time, an identifier is necessary to link the positions of individuals at certain time intervals. This identifier would be missing if anonymous data were to be used and such movement could not be displayed (emphasis added).

This statement clarifies that location data collected in contexts other than providing electronic communications services³⁹ would fall outside the scope of the Regulation. If the same data, however, qualify as personal data under the GDPR, the latter instrument applies and users’ consent might still be required. In the latest iteration and proposed amendments to the text of the ePrivacy Regulation Proposal, introduced by the EU Parliament in late 2019,⁴⁰ an additional Recital (17aa) was proposed:

Metadata such as location data can provide valuable information, such as insights in human movement patterns and traffic patterns. Such information may, for example, be used for urban planning purposes. Further processing for such purposes other than for which the metadata where initially collected may take place without the consent of the end-users concerned, provided that such processing is compatible with the purpose for which the metadata are initially collected, certain additional conditions are met and safeguards are in place, including, where appropriate, the consultation of the supervisory authority, an impact assessment by the provider of electronic communications networks and services and the requirement to genuinely anonymise the result before sharing the analysis with third parties. As end-users attach great value to the confidentiality of their communications, including their physical movements, such data cannot be used to determine the nature or characteristics on an end-user or to build a profile of an end-user, in order to, for example, avoid that the data is used for segmentation purposes, to monitor the behaviour of a specific end-user or to draw conclusions concerning the private life of an end-user. For the same reason, the end-user must be provided with information about these processing activities taking place and given the right to object to such processing.⁴¹

Overall, the EU legal scheme and recent trends regarding location data are conscious of the increasing utility of location data and the importance of safeguarding users’ privacy and data protection interests, regardless of the specific technology applied. Both the GDPR and the ePrivacy Regulation Proposal advance a technology-neutral approach to their respective subject matters.⁴² In parallel, the conceptual and definitional distinction between content and metadata remains, as does the reliance on anonymisation to reduce risks to privacy interests.

2.2 Technological Perspectives

A myriad of devices and technologies used by urbanites collect, process and exchange location data at a considerable volume, frequency and scale. Location-based services generally aim to obtain the accurate position of individuals—both indoors and outdoors—in order to provide services such as route planning and navigation and to facilitate travel efficiently and comfortably. Global Positioning Systems (GPS) are considered the dominant technology for outdoors positioning as well as the most accurate and reliable, but other technologies are also prevalent, such as WiFi-based localisation cell tower triangulation.⁴³ Technologies used for localisation indoors include WiFi (WLAN), internal measurement unit (IMU), radio frequency ID tags (RFID), Bluetooth, GSM and FM.

Research has identified three principal domains in which technology is advancing rapidly, penetration into consumer markets is considerable and location data provide increasing functionality: smartphones, connected cars and the Internet of Things (IoT).⁴⁴ In all of these domains, various location technologies are in use, and the positioning data generated are often infused with other information sources such as geographic information system (GIS) data or real traffic data.

Some technologies are specifically tailor-made for smartphones, e.g. applications with location-based check-in services that enable individuals to share their activity-related choices. In particular, social media applications equipped with check-in functions (such as Facebook or Twitter) provide a vast amount of relevant data that help to determine activity patterns in the context of urban mobility. Among other purposes, such data allow researchers and analytics experts to ascertain individual mobility patterns with growing precision and granularity.⁴⁵

The potential of location data is obviously not limited to social media applications with check-in functions. Mobile phone traces can be used for various purposes, ranging from urban transportation modelling and research⁴⁶ to the creation of personal profiles and targeted advertising by commercial entities⁴⁷ as well as areas beyond commerce such as criminal investigations.⁴⁸ Researchers have noticed that companies also use ultrasonic side channels on mobile devices, usually without the customers being aware of it, in order to determine physical locations and content consumption habits and to follow their movements with applications that permanently ‘listen’ through the device’s built-in microphone to ultrasonic beacons in the background.⁴⁹

Due to the extremely broad use of smart mobile devices for performing daily tasks in urban settings, the location points of a growing number of such devices (and by extension, of their users) are being constantly processed, calculated and transmitted. Researchers determined that it is now dramatically easier to track the location of a huge number of mobile devices, ‘leading to a wealth of information about the mobility of humans, vehicles, devices, and practically anything that can be fitted with a mobile computing device’.⁵⁰ And the density of sensors, signals and reception points—particularly in the city—contributes to the aggregation of very precise, high-quality location data.⁵¹

Developments in the area of consumer IoT also demonstrate an increasing reliance on location,⁵² and the penetration of IoT into more areas of private and social life contributes to an explosion in the volume, variety, accuracy and quality of processable data.⁵³ IoT location data are particularly accurate, which also renders them a particularly valuable, multipurpose source for commercial players, among others.⁵⁴ Researchers have begun to take notice of the possible impacts and risks involved in analysing data sets from IoT devices combined with smart city infrastructure in the context of digital forensics,⁵⁵ among other areas. It would not be exaggerated to say that location data are the lifeblood of smart mobility, and IoT devices are one critical source for such data.

Clearly, connected cars, assisted driving technologies and autonomous vehicles (collectively ‘connected cars’) are another important source.⁵⁶ Modern automobiles also become smarter⁵⁷ and more connected thanks to numerous in-car sensors, on-board computing capacities and an internet connection to external sources. According to one account, connected cars are equipped with on-board computers and embedded mobile broadband as well as dozens of sensors and around 40 microprocessors collecting telematics and driver data. These can produce and then upload to the cloud up to 25 GB of data with every driving hour.⁵⁸ A considerable portion of this data qualifies as location data or is part of the mobility data the car generates.

As indicated by researchers, both the technologies that generate the data and technology-based analytics models (including AI) open up an extremely broad range of use cases for such data:

Mobility data have been used to answer questions such as how people travel between cities and what the patterns are of their daily commute, as well as to predict socioeconomic trends, find relationships in online social networks, identify people’s weight and health status, discover employment patterns, and follow the spread of infectious diseases […]. Models of mobility were used in designing public transportation systems, in taxicab allocation, and in performing crowd-sourcing tasks. In addition, the analysis of mobility patterns leads to a growing field of commercial applications by mobile communication service providers […] as well as by several companies that have already started to provide location-based services analyzing mobile phone location traces.⁵⁹

2.3 Economic Perspectives

There is a close bond between the useful things technology makes possible and the commercial endeavours that monetise and design business models around them. Given the sheer wealth of information advanced technologies and analytics methods currently offer, the economic significance of location data can hardly be overstated.⁶⁰ The data have an enormous commercial value for companies that provide a wide range of products and services and sometimes become a key resource for the firm’s value proposition. As mentioned in a recent study, data can become the product (as compared to merely enhancing or augmenting an existing product), with location-based services being an archetypical example.⁶¹

As a result, personal data are being increasingly commodified,⁶² that is, they are being traded and handled by market participants as a valuable commodity.⁶³ To name one prominent example, companies such as HERE provide a plethora of services based on the understanding that ‘the world […] is increasingly powered by location data and technology, enabling people and objects to live, move and interact faster, safer and in a more efficient way than ever before’.⁶⁴ HERE, in which major automotive players currently hold significant shares, provides products and solutions that are centred around the idea that location, described as the ‘data layer of everything’, is the one element that is critical to enabling an ‘autonomous world’.⁶⁵ The HERE Open Location Platform is described as being able to create exhaustive data pools (with data gathered from car sensors, smart city systems and/or other IoT platforms) and thereby offer the opportunity to develop advanced location-based services.⁶⁶

HERE is not alone in discovering the economic potential of commercialising high-quality location data on a massive scale. It competes with other players in an ecosystem where the automotive industry and smart mobility are building on AI-based solutions and where business, innovation, markets and the economy at large are ‘data-driven’.⁶⁷ In China, Navinfo is striving to become ‘the digital brain of intelligent driving with ultraprecise location information and automotive-grade semiconductors for Advanced Driver Assistance Systems (ADAS) and autonomous driving’.⁶⁸ In the realm of location-based services, Foursquare, the company that, as per its own statement, ‘invented the check-in’, now has a product (Pilgrim SDK) that embeds foreground and background location awareness into smartphone applications in order to provide contextual content in real time.⁶⁹ According to an online report from 2018, this company generated over 3 billion visits a month from 105 million locations globally.⁷⁰ Such enormous amounts of location data—in some cases the product that carries the entire business model of commercial enterprises—are being successfully and creatively converted into revenue.

A wide range of business models have emerged in the location data ecosystem, including platform, service, hardware and software providers that initially collect the data from consumers; data brokers that specialise in buying and selling data sets in secondary data markets;⁷¹ and data-driven technology companies that invent sophisticated methods and models to analyse and extract more insights and commercially valuable information from Big Data. Consequently, new markets emerge in which businesses and users directly and explicitly trade personal-level location information.⁷² In other words, business models in which consumers ‘pay’ with their data are on the rise, and consumer protection law is confronted with completely new situations and problems.

3 Recent EU Legislation in the Area of Digital Consumer Protection

3.1 Background

In December 2015, the European Commission published two proposals for directives that would regulate certain aspects concerning contracts for the supply of digital content⁷³ and for the online sale of goods.⁷⁴ The proposals triggered a lively debate that continued during the various phases of legislation,⁷⁵ with the European Parliament and the Council of the EU proposing significant changes to the original proposals along the way.⁷⁶ At the conclusion of the trilogue negotiations in March 2019, the texts of both directives received their final form,⁷⁷ followed by the official publication of the directives shortly thereafter.⁷⁸

The debate in recent years has circled around several issues,⁷⁹ including (1) coverage of situations in which the consumer provides data as counter-performance instead of a price for digital content and services and (2) the inclusion of embedded digital content under the protection scheme of the directives (in the current texts of the directives such embedded digital content is referred to as ‘goods with digital elements’). Framework questions such as the explicit inclusion of ‘personal data’ as counter-performance and the simultaneous application of the GDPR triggered an extensive discussion. Another question circled around protection to consumers that ‘passively’ provide personal data instead of a price.

The general aim of the resulting directive concerning digital goods and services (DCSD) is to fully harmonise certain requirements concerning contracts between traders and consumers for the supply of digital content or services (Recital 11 DCSD). It is explicitly designed to harmonise

rules on the conformity of digital content or a digital service with the contract, remedies in the event of a lack of such conformity or a failure to supply and the modalities for the exercise of those remedies, as well as on the modification of digital content or a digital service.⁸⁰ Recitals 12 through 17 lay out a fairly long list of matters in which Member States are not strictly bound by the DCSD. These matters include national rules on the formation, validity, nullity or effects of contracts; the legal nature or classification of the contract; remedies for ‘hidden defects’; and claims against any third party that is not the trader. The debate regarding the proper reach of the DCSD did not focus specifically on location data. The remainder of this chapter seeks to fill this gap.

3.2 Data as Counter-Performance

3.2.1 Recognition in the DCSD

The initial Commission’s proposal (COM-DCD) included a provision that extended the scope of the Directive to cases where the consumer actively provides, in exchange for digital content, counter-performance other than money in the form of personal data or any other data.⁸¹ After much debate over this issue (including a critical opinion issued by the European Data Protection Supervisor⁸²), the Directive now sets forth that consumers who provide personal data in exchange for digital content or digital services in principle should benefit from the protections therein.⁸³ This provision is subject to two exceptions: (1) when the personal data are provided by the consumer is exclusively processed by the trader for the purpose of supplying the digital content or digital services, or (2) for allowing the trader to comply with legal requirements to which the trader is subject—and in both cases, the trader does not process that data for any other propose.⁸⁴

3.2.2 Normative Priority of EU Data Protection and Privacy Law

The DCSD now states generally that in the case of any conflict, the GDPR overrides provisions under the DCSD.⁸⁵ The same applies to conflicts with the e-Privacy Directive (Directive 2002/58/EC).⁸⁶ This priority rule is helpful at least on a formal level for resolving questions of parallel application.⁸⁷ It should help domestic legislatures and courts with the task of applying a certain legal regime in case of discrepancies. Such discrepancies are likely in light of the conceptual and practical overlaps between data protection/privacy law (protecting the individual as a data subject/user) and consumer protection law (protecting potentially the same individual as a consumer). This bright-line rule represents the general understanding that neither contract law in general nor specific consumer protection regulations should derogate from the level of protection persons enjoy under data protection and privacy law. More precisely, Art. 3(8) DCSD provides that consumer protection under the DCSD should be ‘without prejudice’ to the data protection body of law.

3.2.3 ‘Passively Provided’ Data

Early proposals suggested a distinction between actively and passively provided data in data-as-counter-performance scenarios. Whereas the COM-DCD referred only to data that are actively provided by the consumer,⁸⁸ the Council’s draft would have allowed Member States to extend the application of the directive to passively provided data as well.⁸⁹ Both the Council and the EU Parliament refrained from using the term ‘actively’ within their respective amendments to Art. 3 of the DCD draft. The Council’s draft kept the emphasis on actively provided data while excluding collected metadata (such as IP addresses) or automatically generated content (such as information collected and transmitted by cookies).⁹⁰ By comparison, the Parliament’s draft (EP-DCD) would allow for the inclusion of data that is provided passively (e.g. personal data collected by the trader such as IP addresses).⁹¹ The option of excluding passively provided data from the scope of Art. 3 DCSD has been criticised on several grounds,⁹² including the fact that the distinction between actively and passively provided data could turn fuzzy in certain situations.⁹³ Ultimately, the phrase ‘actively provide[s]’ was removed from the final text.

Especially relevant to location data is Recital 25 DCSD, which indicates that ‘metadata’ are not covered by the DCSD unless Member States specifically extend the application of this Directive to such situations.⁹⁴ It follows that data which qualify as ‘metadata’ will trigger protection only if the exchange of such data against digital content/services is specifically recognised under domestic law as a ‘contract’.⁹⁵ At the same time, Recital 24 DCSD clarifies generally that the conclusion of the contract and the provision of the data do not have to happen simultaneously or at any specific proximity of time in order for the DCSD to apply.⁹⁶ This Recital includes the ongoing collocation of data that users upload or create in the course of using the digital content/service, which might, under a certain interpretation, also encompass ‘passive’ data provision situations.⁹⁷

Alas, the DCSD does not provide a definition for the term ‘metadata’.⁹⁸ The examples of metadata it mentions—namely, ‘information concerning the consumer’s device or browsing history’—do not offer a conclusive answer. One important area in which this ambiguity is relevant is the case of cookies. It has been argued, for instance, that cookies that collect data such as browsing history (hence ‘metadata’ that the consumer, strictly speaking, neither uploads nor creates) in exchange for digital goods or services is a situation excluded from DCSD.⁹⁹ Another area that comes to mind, of course, is location data.

3.2.4 Application to Location Data

Given that only personal data can count as counter-performance,¹⁰⁰ location data would qualify if (a) it is considered ‘personal data’ under the GDPR and if (b) the data are not exclusively processed by the trader for the purpose of supplying the digital content or digital services.¹⁰¹ As to the first condition, in light of the GDPR’s broad definition of ‘personal data’¹⁰² and the corresponding interpretation by the Court of Justice of the European Union (CJEU),¹⁰³ the exclusion of non-personal data might end up having a marginal impact in practice. It is generally reasonable to assume that non-anonymised location data are more valuable than anonymised data to traders in the B2C sector in terms of allowing pinpointed targeted advertising, refined consumer profile building and individualised pricing models. The first condition nonetheless triggers the general problem of how and where to draw the line between personal and non-personal (including anonymised) data.¹⁰⁴

The ePrivacy Regulation Proposal suggests that location pings require a device identifier to make them useful in terms of creating heatmaps and ascertaining mobility patterns that are important to the research and development of smart mobility concepts in densely populated cities.¹⁰⁵ Furthermore, depending on the technology and device at play, consumer location data that are collected automatically often come with ‘build-in identifiers’ such as IP address, device ID and advertiser ID in smartphones. Even when separated from those identifiers, location data are particularly susceptible to re-identification attacks, and within the broader discussion about the sheer feasibility of rendering personal data completely and permanently anonymised, location data present an example in support of arguments that total anonymisation cannot be attained.¹⁰⁶ The upshot is that location data will almost always qualify as personal data under the GDPR (unless sufficiently anonymised before processing under applicable/acceptable technical and legal standards of anonymisation) and thereby fulfil the first condition.

The second condition calls for a careful assessment. Whether the location data that the consumer provides are processed exclusively for supplying the digital content/services in accordance with the DCSD depends largely on the facts and circumstances of the individual case. The assessment will be as complex (or as straightforward) as ascertaining the technical, contractual and practical conditions surrounding the exchange. In addition, obligations under the DCSD’s supply and conformity requirements¹⁰⁷ and perhaps some other sources external to the contract might be relevant.

This restriction under Art. 3(1) is formulated in a very similar way to Art. 6(1)(b) GDPR, which permits the processing of personal data if ‘processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’ (emphasis added). At the same time, the GDPR provision is somewhat broader compared to Art. 3(1) DCSD. The latter excludes from the concept of counter-performance the processing of personal data exclusively ‘for the purpose of supplying the digital content or digital service in accordance with this Directive’ (emphasis added). It seems that, at least in some cases, processing for the purpose of supply is a specific type of contract performance necessity. Under this interpretation, it is conceivable that Art. 6(1)(b) GDPR might also capture processing that is not directly related to supplying the contracted subject matter.

The EDPB opined that ‘Article 6(1)(b) [GDPR] applies where either of two conditions are met: the processing in question must be objectively necessary for the performance of a contract with a data subject, or the processing must be objectively necessary in order to take pre-contractual steps at the request of a data subject’.¹⁰⁸ In this context, the concept of necessity is applied not strictly under contract law but under data protection (objective) assessment criteria. At the same time, even under such a narrow construction of the legal basis of Art. 6(1)(b) GDPR, it is clear that there is no perfect overlap with Art. 3(1) DCSD. As a result, a valid Art. 6(1)(b) GDPR basis does not exclude a priori application of the DCSD, but in practice, processing on this basis will often coincide with situations excluded under Art. 3(1) DCSD. In a legal-economic environment that tolerates the consensual commodification of personal data and simultaneously imposes strict data protection limitations on traders, a successful business model seeking to monetise the data will usually need to rely on processing grounds other than contractual performance necessity, mainly on consent.¹⁰⁹

Indeed, the importance of users’ affirmative consent in situations where location data are being processed by the trader is expected to increase in light of the CJEU jurisprudence on metadata collected by cookies. In the Planet49 case, the CJEU ruled that a pre-selected checkbox does not fulfil the requirements of consent.¹¹⁰ Active, informed and specific consent is required for using both personal and non-personal data covered under the e-Privacy Directive,¹¹¹ and the user should have a viable option to refuse the implementation of cookies as ‘user consent may no longer be presumed but must be the result of active behaviour on the part of the user’.¹¹² Similar to data retrieved via cookies (e.g. IP addresses), location data are often collected in the course of a continuous, automated process inherent to using a connected device. The process runs seamlessly in the background without any affirmative action of users to ‘hand over’ their data and sometimes even without their knowledge.

The prominence of consent is expected to grow under the upcoming ePrivacy Regulation as an important lawful basis of processing ‘electronic communications metadata’.¹¹³ Already today, consent is the main lawful basis of processing location data that qualify as sensitive data under Art. 9 GDPR. The claim that users often do not actively provide explicit consent to the collection of their (personal) location data poses a major compliance challenge that relates to the more general problem of how to improve the consent process in digital and online settings.¹¹⁴

In the final analysis, whether consumers actively provide the personal (location) data or not is of secondary importance, and in any case, it should not impose a technical limitation on the DCSC’s scope. For the opposite conclusion, a convincing normative or economic argument saying that location data provided ‘passively’ call for a lower degree of consumer protection would have to be made. The question of how to reconcile commercial data as counter-performance models with privacy and data protection law and their consent requirements (importantly including Art. 7(4) GDPR) will remain the paramount challenge.

3.3 Embedded Digital Content and IoT

3.3.1 Products Bundled with Digital Elements

After many twists and turns on the issue of goods with embedded digital content, the DCSD adopted a new definition for ‘goods with digital elements’, meaning ‘any tangible movable items that incorporate, or are inter-connected with, digital content or a digital service in such a way that the absence of that digital content or digital service would prevent the goods from performing their functions’.¹¹⁵ This definition covers what is commonly referred to as IoT devices.¹¹⁶ IoT devices connect to the internet via IP addresses, and connectivity is by definition essential for them to perform their functions.¹¹⁷

The legal scheme explicitly excludes goods with digital elements from the DCSD while making such goods subject to the Sale of Goods Directive (SGD).¹¹⁸ Since the SGD applies solely to sales contracts,¹¹⁹ and since its definition of a sales contract does not entertain the concept of data as counter-performance,¹²⁰ goods with digital elements for which the consumer provides data instead of a price are covered neither by the DCSD nor by the SGD. It follows that renting, lending and gratis distribution of a consumer IoT device remains outside of the regulative scope of these directives, unless the transaction for the supply of digital elements can be severed from the transaction concerning the physical good and be treated separately and independently.¹²¹

This ‘distribution of labour’ between the DCSD and the SGD means that unless the physical component serves merely as a data carrier of digital content, the SGD applies exclusively to sales contracts of goods that include digital elements. The question of whether the digital element in a given case is essential for the good to perform its functions is to be answered, to a large extent, by the terms of the contract itself and the surrounding circumstances. For IoT devices covered by the SGD, the Directive’s protection scheme spreads over the digital components alongside the physical elements. It sets forth specific objective requirements for conformity that are typical to digital content and services, such as the duty to inform the consumer and to supply updates, including security updates that are necessary to keep those goods in conformity.¹²² The SGD, however, does not include a detailed provision comparable to Art. 19 DCSD regarding modifications in the digital content or services and the consumer protection safeguards therein.¹²³

3.3.2 Application to Location Data

The application of the coverage question to IoT devices is certainly relevant for smart mobility. The consumer devices used for smart mobility usually qualify as goods with digital elements under the DCSD/SGD scheme. Those devices rely on location data and connection to the internet is essential for their proper function and utility. During their operation, they establish connection to remote services that access their location data. As noted, in the absence of transfer of ownership for a price, the consumer protection layer of the DCSC/SGD does not apply. It appears that traders still sell most consumer IoT devices for money.¹²⁴ But a shift to business models that more intensively and transparently monetise personal data collected by the device for a considerable discount, a subscription model and/or gratis distribution instead of sales transactions do not seem that farfetched.

Particularly in the consumer IoT and smartphone segments, consumers have a strong incentive to share their location with hardware, software, service and platform providers. Depending on the particular case, sharing location data can dramatically increase personal usability and functionality. The mission of consumer protection law at this juncture should be to ensure that consumers, who suffer from information asymmetry vis-à-vis traders, weaker bargaining positions and in some cases total lack of both bargaining power and viable alternatives, are not being exploited. One important element is imposing transparency obligations on traders to enhance consumers’ understanding of the context, purposes, implications and risks associated with sharing location.

A comprehensive evaluation of the legal position of EU consumers in the IoT segment should include further regulative instruments, such as the Consumer Rights Directive (2011/83/EU) as recently revised by Directive (EU) 2019/2161 (Consumer Rights Modernisation Directive CRMD).¹²⁵ The CRD generally secures broad information rights under Article 5 thereof (including information about the total price of the goods or services) as well as specific information requirements for distance or off-premises contracts (Article 6). The revised CRD (to be transposed in national laws by 28 May 2022) borrows many important definitions from the GDPR and the DCSD/SGD scheme.¹²⁶ It will apply explicitly ‘where the trader supplies or undertakes to supply digital content which is not supplied on a tangible medium or a digital service to the consumer and the consumer provides or undertakes to provide personal data to the trader’.¹²⁷

In principle, CRD rights should apply to contracts regarding IoT goods, namely, both to the physical component of the device and the digital content or service that makes it work. But this is not always the case. For instance, some consumer rights specifically attach requirements concerning pre-contractual information duties¹²⁸ or the rights of consumers in the case of withdrawal¹²⁹ to digital content. Under the revised CRD, these rights will also apply to digital content/services of goods with digital elements subject to a sales contract, except for cases where the digital content is supplied on a tangible medium and the consumer ‘pays’ with personal data. This structure suggests that pre-installed digital content on an IoT device does not benefit from the CRD’s protections that apply to digital content.

The synopsis sketched above, while only briefly touching upon the genuinely complex matrix of digital consumer protection law in the EU, demonstrates that the implications of the revised CRD for IoT consumers are not easy to pin down. As the consolidated body of consumer protection law emerging under the New Deal for Consumers Initiative of the European Commission and the enactment of the DCSD/SGD becomes more intricate, the exposition, implementation and compliance challenges are likely to increase and provide fertile ground for further research and discussion.

4 Conclusion

Location data remain an extremely relevant and dynamic playing field for technology developers, market actors and consumers. As such, they calls for the attention of lawmakers and courts as they come to define the legal boundaries for these dynamics and, to some extent, prescribe the rules of the game. The task of enabling market models with an increasing reliance on data and their consensual exchange in B2C markets and, at the same time, preserving the rights of individuals as data subjects and consumers should not be underestimated. Many questions within data protection and privacy law itself as well as questions concerning its interface with other legal domains such as consumer protection and contract law remain unresolved.

Location data, due to their unique significance and role in the digital economy, could play a pivotal role in the process of figuring out this interplay—which is hopefully moving towards a coherent and consistent legal scheme that finds the right balance between personal autonomy, state intervention and market economy. On the one hand, utilising location data is indispensable for numerous technological innovations and key for economic growth. On the other hand, such utilisation poses new risks to individual interests. Whether location data therefore could and should be treated as a unique category of data from a legal perspective is a vexing question that has not yet been extensively discussed, but it certainly deserves some deeper deliberations.