Social media websites often include a “tell-a-friend” function that enables users to share content with their personal contacts or invite them to be their “friends” and interact on the site. The Belgian Data Protection Authority is challenging this model. Is this the end of tell a friend?

The Belgian DPA recently fined social media platform Twoo 50,000 euros for privacy violations of its tell-a-friend feature. And while the fine may be small compared to other EU fines, like the massive French data protection authority CNIL fine imposed on Google, the decision is still important because it makes non-users’ consent necessary for a platform to send emails or other communications to non-users, which puts the platform in a near-impossible situation. Also, the DPA’s decision is one of the first examples of a prominent fine being issued under the one-stop-shop mechanism of the EU General Data Protection Regulation.

Tell a friend

What is a tell-a-friend feature? Referral programs have been around for a while and originated with news websites allowing users to forward articles to friends. Social media platforms took it to the next level through mass messaging with tell-a-friend features. These features typically allow a user to sort through their address book on a personal device and, via the platform, share content with contacts or invite contacts to become the user’s friend on the platform. The user’s contact address book may include individuals who are already users of the social media platform and individuals who are not platform users.

What privacy requirements apply to tell-a-friend? Messaging requirements for third parties in the EU are complex due to the intersection of two legal regimes. First, the GDPR requires a legal basis for having and retaining a recipient’s contact details, such as an email address or phone number. In addition, the ePrivacy regime (by virtue of the ePrivacy Directive as implemented by EU member states) sets requirements for sending commercial electronic communications (e.g., email but also SMS and other types of direct messaging). While the potentially available legal bases under the GDPR can include both consent and legitimate interest, under the ePrivacy regime (absent an established exception), consent is the only valid reason to send electronic communications.

Accordingly, whether a tell-a-friend communication requires consent or could also be sent on the basis of legitimate interest depends on whether the tell-a-friend communication sent by the platform qualifies as a commercial electronic communication, which would mean that the ePrivacy regime also applies (and thus consent is a strict requirement). Where the tell-a-friend feature requires consent under the ePrivacy regime, it is important to note that it requires the recipient’s consent, not the existing user’s consent.

In 2009, the Article 29 Working Party, the former EU consortium of privacy authorities, assessed the legality of tell-a-friend practices in its Opinion on Online Social Networking. The WP29 explained that the ePrivacy Directive’s requirements for direct marketing do not apply to personal communications. Thus, the WP29 published its opinion that if a tell-a-friend communication is either sent using the existing user’s own email system or sent via a platform under strict conditions, the message would not be considered commercial electronic communication under the ePrivacy framework and consent would not be a prerequisite. The conditions provided in the WP29 Opinion for sending tell-a-friend communications via the platform are:

• No incentive is given to either sender or recipient.
• The platform did not select the recipients of the message.
• The sender’s identity was clearly disclosed.
• The sender knew the full content of the invitation.

Unlike the Belgian DPA in the enforcement against Twoo, the WP29 did not clarify whether the recipient must be a platform user, as well.

The platform and its tell-a-friend feature

Twoo is a social media platform founded in Belgium in 2011, with approximately 180 million users. It allows users to discover and connect with others globally using a matchmaking algorithm. The platform’s tell-a-friend feature operated as explained above. The platform claimed that it relied on the sender’s consent to access their address book, pre-select the User Contacts who could be a good match, and send the invitation to User Contacts and Non-User Contacts. The DPA disagreed with the platform’s assessment and found that it violated the GDPR in a number of ways:

• Distinction between recipients. First, the DPA distinguishes between tell-a-friend communications to Users Contacts and Non-User Contacts. With respect to User Contacts, the DPA applies the WP29 opinion and indicates that communications to User Contacts do not amount to direct marketing and thus do not require the recipient’s consent, provided the platform complies with the four criteria set out in the WP29 opinion described above. In fact, the DPA indicates that consent is not an appropriate legal basis because User Contacts have already permitted the platform to use their personal information. Therefore, legitimate interest or contractual necessity as a basis for collecting information from this group of recipients would be more appropriate.
• Consent required for Non-User Contacts. With respect to Non-User Contacts, the DPA indicates that, in such a case, communications do amount to commercial electronic communications, the ePrivacy regime applies, and consent from the recipient is required before sending a message to any Non-User Contact via the tell-a-friend mechanism. As for the underlying collection and retention of personal information, which is assessed under the general GDPR framework, the DPA considered that the platform also needed the recipient’s consent. Legitimate interest basis for this processing is not available because of the impossibility for Non-User Contacts to exercise control over their personal information. The only part of the processing that the DPA accepted legitimate interest as legal basis was for performing a compare and forget check (i.e., comparing the sender’s address book to identify other potential User Contacts and discarding Non-User Contacts’ information).

The challenge for the outcome of the DPA’s decision is that it renders most tell-a-friend systems impracticable. One of the main purposes of a tell-a-friend system is to alert and invite people who are not on the platform. From the platform’s perspective, it will be nearly impossible to validly obtain their consent to receive communications. One alternative could be for platforms to enable their users to invite friends on their own initiative, for example, by the platform sending an email to its users’ personal email accounts. However, this solution is generally seen as impracticable, and it may not have the same effects as invitations generated through the platform itself. Further to the DPA’s inquiry, Twoo indicated it has discontinued its tell-a-friend feature altogether.

One-stop-shop

Another noteworthy aspect of the Belgian DPA’s enforcement is its application of the GDPR’s one-stop-shop mechanism. The Twoo case is one of the first times OSS has been successfully put into practice (most notably, one-stop-shop was not applied in the CNIL-Google case).

One-stop-shop essentially aims to provide a central enforcement mechanism for companies with activities across multiple EU member states. The one-stop-shop procedure involves one DPA taking the lead on behalf of other concerned DPAs. The lead DPA is the DPA of the country in which the company has its main establishment. In this case, the Belgian DPA acted as the lead DPA, and 23 authorities from 16 different countries declared themselves as concerned DPAs.

The one-stop-shop procedure allows for multiple ways of cooperation. In this case, the lead DPA, before finalizing its decision, sent the draft decision to the concerned DPAs for their review, with the possibility of the European Data Protection Board issuing a binding decision under the GDPR’s consistency mechanism if no consensus is reached.

The fact that this decision was made using one-stop-shop means that the findings on tell-a-friend systems will apply in all the jurisdictions of the concerned DPAs. It is unclear whether during the one-stop-shop procedure in this case authorities in other EU member states were consulted or whether Twoo simply did not have activities in all EU countries. But the fact of the matter is that EU authorities have successfully applied one-stop-shop in this enforcement action, and companies can now be required to apply the new tell-a-friend requirements in a multitude of EU member states.

Photo by Priscilla Du Preez on Unsplash