How to provide information about the use of personal data
Explain to consumers what exactly you do with their personal data, for example that you sell the data or use it to determine prices or marketing messages, or that you use it to personalize prices. Consumers must be able to make a well-informed decision about what to purchase and from which business they make that purchase. To that end, consumers need to know how your business uses their data. In that way, consumers are also able to compare purchases on the basis of the use of data (personal or otherwise) as well.
Is it difficult for consumers to find or understand information about the use of their personal data, or to do so in a timely manner? If so, they will not be able to take that information into account in their purchase decisions. As a result, consumers could make decisions that they would not have made if they had known everything. This can be a misleading commercial practice. Unfair commercial practices are prohibited. ACM enforces compliance with these rules laid down in consumer law.
Information about the use of personal data is thus important information that you are required to provide under consumer law. The General Data Protection Regulation (GDPR) explains exactly what information you have to provide regarding the use of personal data. The GDPR stipulates how you are allowed to process personal data and how you can ask consumers for consent for the collection thereof. The Dutch Data Protection Authority (AP) enforces compliance with the GDPR. The AP and other European data protection authorities are members of the European Data Protection Board. They have drawn up guidelines (in Dutch) on, among other things, the way in which you have to inform about the use of personal data and the privacy options that consumers have.
What is required and what is not allowed?
Example: Information on the use of data (personal or otherwise) in app stores
An app store informs consumers about various characteristics of the apps, such as the developer, customer ratings, price, compatibility, and age restrictions. However, information on the way in which the apps use data (personal or otherwise) only appears at the bottom of the page. This is a misleading practice, and is therefore not allowed.
If the app provider acts on its own behalf, it must provide this information itself. The information must be easy-to-find for consumers. This means it cannot be presented in the fine print at the bottom of the page. Consumers should not need to scroll or swipe to find it either. It is fine, in any case, if the information is presented near the price.
- Section 3A of the Dutch Civil Code, Book 6 (Unfair commercial practices) (in Dutch)
- Directive 2005/29/EC (Unfair Commercial Practices Directive)
- General Data Protection Regulation
- Directive (EU) 2019/770 (Directive for the supply of digital content and digital services)
- Section 1aa of the Dutch Civil Code, Book 7 (agreements for the delivery of digital content and digital services between traders and consumers) (in Dutch)
Explanation of regulations
Together with other consumer authorities in 26 countries, ACM called on two app store providers to adjust their app stores. App providers had to inform consumers better about their app’s use of data. One provider as well as the other app store provider answered this call.