Data Collection and Consent: Does Yes Really Mean Yes?
Technology giants such as Google, Facebook and Amazon have been on an upward path to success and only seem to be growing bigger by the day. The main reason for this upward slope of progress is their control over “data.” The data collected from users has allowed these platforms to monopolize the market and hinder emerging competitors from developing and offering any significant competition. The success of companies such as Google, Uber and Amazon can be attributed to their mindset which perceives “data as an asset.”[1] The commodification and monetization of data has enabled them to offer popular complementary services and expand their reach. This is evident from the classic ‘Google’ example where, on the basis of data, Google widely expanded the horizon of its offered services. However, where data mining has its virtues for tech companies and the digital market, this phenomenon is concerning for the users. This is because users generally do not have much control over the collection of their data by digital companies. Their consent is obtained through practices that can at best be classified as ‘murky’ or ‘lying in a grey area.’ After the data has been collected, users cannot control its usage or dissemination either.
The value of data as an asset and the growing privacy concerns of users signify that users should have a substantial say in whether and how their data is to be collected. The basis of all data mining activities by giant tech platforms can be found in the ‘Terms of Service.’ The Terms of Service are the contractual provisions users assent to in order to sign up for digital platforms. These Terms of Service contain many provisions which relate to how the data of users is to be utilized and shared with third parties. For the sake of brevity, this article limits its analysis to Facebook’s Terms of Service. In its Terms of Service, Facebook states that it needs certain permissions from the users in order to provide its services.[2] These include the permission to use the content created and shared by users and the permission to use the users’ name, profile picture and information about their actions in relation to the optimization of advertisements and other sponsored content.[3] Facebook clearly outlines that the usage of this data in connection with ads or other sponsored content is not compensated for,[4] as users are sharing their data with Facebook in return for access to its products and services. It cannot be denied that users do consent to these Terms of Service in order to use Facebook, thus Facebook has legal authority to collect their data and share it further for advertisement purposes. However, it is imperative to question whether a majority of users has the “option” or “choice” to not use platforms such as Facebook. The inexorable reach of social media, especially among the younger segments of the population, is quite evident. Even if one makes the decision to opt out of this digital social interaction with one’s peers, many are pulled in due to the availability of essential information on these platforms, including the information available through school/university groups, support groups, work opportunities, or E-commerce platforms. In light of the foregoing, it is pertinent to analyze the ways in which digital platforms such as Facebook obtain consent from the users and whether an argument can be made that this consent is vitiated on account of it not being ‘freely’ given.
Free Consent Under the Contract Act 1872
The word “freely” is used in reference to the consent-related provisions of the Contract Act 1872. Since platforms such as Facebook enter into a contract with their users in the form of their Terms of Service and other data policies, this article relies on the provisions of the Contract Act to determine the validity of such a contract from the perspective of “free consent.” Prior to that, however, it is essential to discuss how the law defines “consent”. The Contract Act states that,
“…two or more persons are said to consent when they agree upon the same thing in the same sense.”[5]
When this definition is applied to Facebook’s Terms of Service, it is apparent that the two parties (the platform and the user) do not agree upon the same thing in the same sense due to information asymmetry. Facebook’s Terms are phrased in such a manner that they sound facilitative and beneficial to the users. The following is an example of this:
“…by using our Products, you agree that we can show you ads that we think will be relevant to you and your interests.”
Since many users are unsophisticated with regard to technology usage, they do not realize that they are signing their data over to Facebook. These unsophisticated users strikingly include children below the age of 18 and illiterate persons. It is evident that most of the users do not fully comprehend Facebook’s Terms of Service or are not familiar with the technological and legal nuances of the Terms. The issue was exacerbated in light of an admission made by Mark Zuckerberg in a US Senate hearing where he stated the following:
“I would imagine probably most people do not read the whole thing (Terms of Service), but everyone has the opportunity to and consents to it.”[6]
Thus, it is quite evident that Facebook’s Terms of Service do not meet the initial criteria of “consent” provided under the Contract Act. It may be argued here that the law does not explicitly require these platforms to even have Terms of Service, so they are benefiting the users by providing this information, but it is manifest that such provisions only serve to limit the liability of the platforms.[7] Nonetheless, it is almost impossible to prove in a court of law that both the parties did not agree to the contract in the same sense. The notion of consent in the usage of digital platforms and services is an emerging field, however, long-standing principles of contract law such as caveat emptor (let the buyer beware) reveal the burden of due diligence placed on buyers of goods and services. In this case, even though there is no monetary consideration exchanged between the two parties, there is an apparent exchange of services for data. Even if it is hypothetically assumed that the users legally consent to the Terms of Service, such consent cannot be said to have been “freely” obtained.
Consent is said to be free when it is not caused by coercion, undue influence, fraud, misrepresentation or mistake — that is, consent would not have been given had it not been for the existence of one or more of these factors.[8] For the purposes of understanding consent within the context of digital platforms, the aspects of fraud, undue influence and misrepresentation are pertinent. Coercion and mistake, by essence of their definitions provided in the Act,[9] are not applicable to the present analysis.
Fraud
In order to establish “fraud” in a court of law, it is necessary to prove an “intent to deceive.” This arduous burden of ascertaining a platform’s “intent” cannot be easily met in a court of law, especially in the aftermath of the Cambridge Analytica scandal when Facebook updated its Terms of Service to make them user-friendly and comprehensible.[10] It is now convenient for Facebook to argue that it has no intent of deceiving its users as it has tried to facilitate them. However, despite the strict burden of proof, it is apparent that the new Terms only give a certain impression to the users that they have control over their data, when intrinsically, users are signing a non-negotiable agreement. This is linked to the element of undue influence.
Undue Influence
The Contract Act states that,
“…a contract is induced by undue influence where the relations subsisting between the parties are such that one of the parties is in a position to dominate the will of the other and uses that position to obtain an unfair advantage over the other.”[11]
This provision aptly describes the relationship between Facebook and its users. Facebook wields monopolistic control over the market which has been gained through “acquiring, copying or killing its competitors.”[12] Thus, users do not have the option of switching to another similar platform if they are not satisfied with the services being offered by Facebook or not comfortable with its Terms of Service. If people want to use Facebook, they are bound to agree to its dictated Terms of Service, without having any bargaining authority. Either the users suffer from bounded rationality, or, even if they are rational actors, Facebook is able to dominate their will through its monopolistic powers. This is because even if users are aware of Facebook’s data mining activities, they have no option but to consent to its Terms of Service in order to use the platform. Facebook states in its Terms that users “grant” Facebook a “non-exclusive, transferable, sub-licensable, royalty-free and worldwide licence to host, use, distribute, modify, run, copy, publicly perform or display, translate and create derivative works” of their uploaded content which is ordinarily protected by intellectual property rights.[13] This mandatory licensing and the users’ lack of independent will thereunder is a clear example of how Facebook dominates the users’ will in order to further its own commercial gains. Even if the users delete their uploaded content, that content may still exist somewhere on the digital sphere as any sub-licensee under this mandatory licensing agreement may retain the data for its use.[14] It is evident that Facebook obtains a lot of data on its users, even when not all obtained data is essential for the provision of its services. In this regard, it is imperative to mention that in order to evaluate the validity of “free consent,” Article 7(4) of the General Data Protection Regulations (GDPR) in the European Union (EU) considers it of utmost importance to determine whether the provision of a particular service is conditional upon the users providing consent to the processing of personal data, which is not even necessary for the performance of that particular agreement. If the aforesaid standard is applied to Facebook’s Terms, it is evident that the consent provided under the aforesaid mandatory licensing agreement cannot be deemed to be freely given, as Facebook is not using all the obtained data for the provision of its own services and is rather sub-licensing it to other entities.
Misrepresentation
Misrepresentation, under the Contract Act, has been defined as:
“…any breach of duty which, without an intent to deceive, gains an advantage to the person committing it, or any one claiming under him, by misleading another to his prejudice or to the prejudice of any one claiming under him.”[15]
It can be argued that Facebook commits a breach of duty when it fails to inform the users of precisely how it is accessing and utilizing their personal information, such as contact lists, location, activities, etc. This is to the prejudice of the users as their privacy is at stake and their personal information is being used to hone the services of the platform without them even being fully aware of it. In this regard, even EU has warned Facebook of impending sanctions over its misleading Terms and Conditions, as according to the Commission, Facebook only informs the users that their data is being used to improve their overall ‘experience,’ however, it does not notify them that this data is used for commercial purposes as well.[16] It can well be assumed that if full disclosure is made to the users, they would demand better privacy settings or even compensation for the appropriation of their data.
Voidable Contracts
In accordance with the Contract Act, when consent to an agreement is caused by fraud, misrepresentation or undue influence, the agreement is voidable at the option of the party whose contract was so caused.[17] Moreover, a contract induced by undue influence may be set aside either absolutely or, if the party who was entitled to avoid it has received any benefit thereunder, upon such terms and conditions as the court may seem just.[18] These provisions are problematic with regard to data protection because courts setting aside the agreement themselves (even while allowing users to retain control over their data under the latter provision), or giving users the option to terminate the agreement does not ultimately benefit them. This option is already available to them as Facebook clearly states that users can delete their account if they do not agree with the Terms of Service. The intrinsic need of using such platforms in today’s world has already been discussed in the article. Therefore, not using the platform completely is not the appropriate solution here. It also needs to be acknowledged that data collection is not a problem in itself as it does lead to better optimization of services for the users and development of technology such as artificial intelligence. The main issue is the requirement of informed consent as users are not aware of how their data is accessed and utilized. The Contract Act further outlines that if consent was caused by fraud or misrepresentation and the affected party insists that the contract shall be performed, they shall be put in the position in which they would have been if the representations made had been true.[19] This provision can be used to bind Facebook to make a full disclosure in its Terms of Service, otherwise users should be able to opt out of sharing their data for commercial purposes as Facebook has represented to them that their data shall only be used for the optimization of services. However, it should also be noted that proving any deceptive practices on part of these platforms through conventional provisions of law is difficult, especially in countries like Pakistan where jurisprudence regarding digital platforms is rather underdeveloped.
Conclusion
It is proposed that where the provisions on consent under the Contract Act 1872 form a good starting point for curtailing the scope of data collection by technology companies, it is better to adopt extensive data protection legislation. In this regard, the General Data Protection Regulation is a progressive step towards ensuring the rights of users. The GDPR attempts to resolve some significant data protection issues. For instance, it does not regard consent as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.[20] Moreover, it requires separate consent for each processing operation,[21] with the request for consent to be presented in a manner clearly distinguishable from other matters.[22] It is apparent that these provisions cater to and resolve many issues pertaining to consensual data collection by big technology companies and can prevent the occurrence of fraud, misrepresentation and undue influence. While Pakistan has other legislation which can be used to protect data, such as consumer protection laws or the Prevention of Electronic Crimes Act 2016, comprehensive legislation which solely pertains to regulating the scope of data collection by technology giants and is based on progressive international standards of privacy is the need of time.
References
[1] MIT Technology Review Custom and Oracle, ‘The Rise of Data Capital’ < http://files.technologyreview.com/whitepapers/MIT_Oracle+Report-The_Rise_of_Data_Capital.pdf> accessed 17 December 2020.
[2] Facebook, Terms of Service <https://www.facebook.com/terms.php> accessed 17 December 2020.
[3] Ibid.
[4] Ibid.
[5] Contract Act 1872, Section 13.
[6] John Naughton, ‘What Facebook’s terms and conditions really ought to say’ (The Guardian, 22 April 2018) https://www.theguardian.com/commentisfree/2018/apr/22/what-facebooks-terms-and-conditions-should-really-say> accessed 20 December 2020.
[7] STA Law Firm, ‘Worldwide: Digital Platforms And Their Terms Of Use: Does It Matter?’ (Mondaq, 11 May 2018) https://www.mondaq.com/it-and-internet/700124/digital-platforms-and-their-terms-of-use-does-it-matter accessed 20 December 2020.
[8] Contract Act 1872, section 14.
[9] See section 15 for coercion, and sections 20, 21 and 22 for mistake.
[10] Jenny Anderson & Ephrat Livni, ‘Facebook’s new data sharing policies, translated so a 13-year-old can understand’ (Quartz, 02 May 2018) https://qz.com/1266835/facebooks-terms-of-service-translated-so-you-understand-your-data-and-privacy-settings/ accessed 22 December 2020.
[11][11] Contract Act 1872, Section 16(1).
[12] Salvador Rodriguez, ‘Facebook is a social network monopoly that buys, copies or kills competitors, antitrust committee finds’ (CNBC, 06 October 2020) <https://www.cnbc.com/2020/10/06/house-antitrust-committee-facebook-monopoly-buys-kills-competitors.html#:~:text=The%20House%20Antitrust%20Subcommittee%20determined,by%20the%20subcommittee%20on%20Tuesday> accessed 19 December 2020.
[13] Terms and Conditions (n 2).
[14] Ibid.
[15] Contract Act 1872, Section 18(2).
[16] Jennifer Rankin, ‘EU warns Facebook it faces sanctions over ‘misleading’ T&Cs’ (The Guardian, 20 September 2018) <https://www.theguardian.com/technology/2018/sep/20/eu-warns-facebook-faces-sanctions-misleading-terms-conditions-data> accessed 23 December 2020.
[17] Contract Act 1872, Sections 19, 19A.
[18] Contract Act 1872, Section 19 A.
[19] Ibid, Section 19.
[20] General Data Protection Regulation 2016, Recital 42.
[21] Ibid, Recital 43.
[22] Ibid, Article 7(3).
The views expressed in this article are those of the author and do not necessarily represent the views of CourtingTheLaw.com or any organization with which she might be associated.
