Johnny Ryan <johnny@pagefair.com>	20 September 2017 at 15:14
To: *************** <***************@iabuk.net>
Dear ***************,

I look forward to the call later.

Before that, here is some initial feedback on the document. There appear to be significant errors, the most important of which concern the author's view of consent walls. 

The authors refer to Article 95 of the GDPR to say that “the ePrivacy Directive’s more specific rules prevail over the rules of the GDPR”. But what the Article actually says is:

“This  Regulation  shall  not  impose  additional  obligations  on natural  or  legal  persons  in  relation  to  processing  in connection  with  the  provision  of  publicly  available  electronic communications  services  in  public  communication networks  in  the Union  in  relation  to  matters  for  which  they  are  subject  to specific  obligations  with  the  same objective set  out  in Directive  2002/58/EC.” 

In other words, if there are “specific obligations” already defined in the ePrivacy Directive, and if these relate to the provision of electronic communications services, then the GDPR  imposes no additional obligations. 

However, the authors proceed to rely on their interpretation of Article 95 to refer to Recital 25 in the ePrivacy Directive, which they say enables a website to make access conditional on the visitor’s acceptance of tracking cookies. However, the line that they cite from the recital does not appear to impose an obligation on what parties should do. Instead, it talks about things that they are free to do. 

Moreover, the authors are trying to fight an article with a recital. But recitals are without legal force, and can not affect the meaning of articles. This makes the authors’ failure to cite Article 7(4) of the GDPR surprising. This article definitively decides the issue: 

“When  assessing  whether  consent  is  freely  given,  utmost account  shall  be  taken  of  whether,  inter  alia,  the performance  of  a  contract,  including  the  provision  of  a  service,  is conditional  on  consent  to  the  processing  of  personal data  that is  not  necessary  for  the  performance  of  that  contract.” 

As a further note, I am worried that the authors seem to have missed an important element in their citation of Recital 25 of the ePrivacy Directive.  They cite only part of a sentence: "website content may still be made conditional on the well-informed acceptance of cookies". 

The entire sentence is, however, more useful: "Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose." And the same recital tells us what a "legitimate purpose" is: "...a legitimate purpose, such as to facilitate the provision of information society services". (The definition of "information Society services" presented in Article 1(2) of 98/48/EC refers to services that are requested by users, and do cover the content, not the ads). 

The document suggests that tracking walls are viable, when clearly they are not.

We urgently need to face reality and take concrete steps to make the advertising system perform well in a situation where data classed as "personal" are only usable for a very small audience. 

Johnny