The diligent work of the legal community has resulted in numerous publications regarding the legal framing of competitions under the GDPR. The primary aim of this article is to determine the legal basis on which the processing of personal data of competition participants should occur.
Several potential bases for processing the data of participants are mentioned in the literature.
Most commonly, these are consent (Article 6(1)(a) GDPR), necessity for the performance of a contract (Article 6(1)(b) GDPR), or legitimate interest, understood as the ability to fulfill a public promise made by the competition organizer (Article 6(1)(f) GDPR).
However, it is essential to first determine how to classify the competition under the provisions of the law.
Does a competition always rely on a public promise?
The answer to this question must be negative. Generally, a competition will rely on a public promise, as its role often involves expanding the influence and marketing potential of the organizer. Such a competition is then addressed to an indeterminate group of recipients, and the commitments made by the organizer will most often fit within the concept of a public promise.
However, the premise of the "public" nature of the promise falls away when the competition is directed at a predetermined group of recipients. This refers, for example, to a situation where the organizer holds a competition for its employees and distributes information about it on the company intranet. Similarly, this will be the case when clients of a particular service of the data controller are invited to participate in the competition via email. In competitions organized in this manner, it cannot be said that the statutory prerequisites are met.
Thus, even a cursory analysis allows us to conclude that the topic of competitions should be considered on at least several levels. This prompts consideration of whether such internal differentiation translates into the legal bases described in the GDPR. For the purposes of the further part of the article, a competition that involves a public promise will be referred to as a "Type 1 competition," while a competition organized without utilizing this institution will be referred to as a "Type 2 competition."
Performance of a contract or taking action at the request of the data subject before the conclusion of a contract
One of the grounds for processing data is the necessity for (i) the performance of a contract to which the data subject is a party, or (ii) taking actions at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR). A contract – unlike a unilateral promise – is a bilateral legal act.
By applying a distant analogy, one could argue that in both cases we are dealing with contractual relationships, and thus conclude that processing data for the purpose of fulfilling a unilateral promise can be based on Article 6(1)(b) GDPR. However, in my opinion, a linguistic interpretation does not provide grounds for such conclusions. The EU legislator deliberately used a formulation excluding unilateral legal acts from the catalog of actions falling under this legal basis for data processing.
Thus, we cannot base data processing on the ground indicated in Article 6(1)(b) GDPR if we are organizing a type 1 competition. However, we will be able to utilize it in the case of a type 2 competition – provided that the conditions of such a competition are accepted. If a person expresses interest, we must process their data to fulfill the request prior to entering into a contract. Once the contract is concluded, data processing will be necessary for its performance. This should not raise any controversy.
Legitimate Interest
I have no doubt that legitimate interest is the only basis for data processing in the case of a type 1 competition. It is essential to refer primarily to Recital 47 of the GDPR: “Such a legitimate interest may exist, for example, in cases where there is a significant and appropriate kind of connection between the data subject and the data controller, for instance, when the data subject is a client of the data controller or acts on its behalf. To determine the existence of a legitimate interest, a thorough assessment should be conducted in each case, including an assessment of whether, at the time and in the context in which the personal data is collected, the data subject has reasonable grounds to expect that data processing for this purpose may occur. The interests and fundamental rights of the data subject may override the interests of the data controller, particularly in cases where personal data is processed in situations where the data subjects do not have reasonable grounds to expect further processing.”
It is difficult to imagine a more obvious example of a situation in which a person “has reasonable grounds to expect that data processing for this purpose may occur.” If a person submits their participation in a competition, they can fully rationally expect that someone will record their submission and subsequently process it for the purpose of conducting the competition.
PROMOTIONAL OFFER
Check the compliance of your competitions
Do you need assurance that your competition meets GDPR requirements? During the conversation, we will analyze the competition documentation, and you will receive a special offer for a compliance audit.
Although a formalistic approach would dictate that a type 2 competition is most often associated with processing based on necessity for the performance of a contract, I see other possibilities in this case as well. It should be noted that when we are undoubtedly dealing with a contract, these considerations are purely theoretical. A contract is, from the data controller's perspective, a more stable legal basis for processing than legitimate interest.
However, there may be ambiguous situations that will be difficult to unequivocally classify as a contract between the data controller and the participant, while simultaneously exhibiting significant similarities to a public promise. This similarity supports the argument that in such situations, processing should be based on a legitimate interest.
Consent of the Data Subject
Despite many differing opinions from legal scholars, I believe that consent does not constitute a legal basis for the processing of personal data for the purpose of organizing and conducting a competition – this applies to both type 1 and type 2 competitions. The position that "despite the arguments presented above advocating for refraining from collecting consents for data processing in connection with the organization of competitions, some data controllers will likely want to continue using this solution. Clearly, this is not associated with any legal risk, provided that consents are collected in accordance with the provisions of the GDPR" does not seem accurate.
The existence of a legal basis in the form of Article 6(1)(b) or (f) of the GDPR excludes the possibility of relying on consent – for reasons that are not only dogmatic (the choice of an inappropriate legal basis) but also practical. Above all, basing processing on consent would undermine the data controller itself. In this way, it would make the data subject the actual disposer of the processing process. On the other hand, relying on a legitimate interest allows for at least a debate in the event of potential objections and enables weighing the legitimate interests of the data controller against the rights and freedoms of the data subject.
Data controllers tend to complicate their lives and collect additional forms. However, in my opinion, mere access to the competition should be considered as consent – if we hypothetically assume that it is a valid legal basis for processing data in connection with the competition. This generates an obvious risk that the consent form will be prepared incorrectly. Irregularities may consist, in particular, of a failure to adhere to the principle of specificity of consent. This most often manifests itself in obtaining one consent for multiple processing purposes (e.g., consent for processing data for the purpose of organizing and conducting the competition and for sending commercial information via email).
Summary
Legitimate interest appears to be the best solution in the case of most competitions. This is supported by both doctrinal considerations and practical issues. If the data controller can rely on grounds such as the performance of a contract or a legally justified legal interest, then collecting consents becomes yet another unnecessary formality that may ultimately turn against the organizer of the competition in the long run.
