The Commission notes that for some companies, a large component of their business model is to collect personal data and share it with third parties. These are typically social media platforms, email providers, search engines and software providers.
The data they collect may go beyond what people may actively share with them on their public profile. They might also track emails, calendar, searches, locations, messages, pages users are interested in, and groups they take part in.
“With this data, they map your virtual identity based on your interests and your preferences. They then monetise your virtual identity for targeted advertising,” it said.
According to the new rules on data protection that have to be applied since May 2018 (General Data Protection Regulation), when the processing of your personal data is based on your consent, this consent needs to be based on an informed decision and expressed through an affirmative action from the user’s side.
“You may have experienced many companies directly contacting you to accept their new terms and conditions and review your privacy settings in May 2018. We strongly encourage you to carefully read the terms and conditions, and optimise your privacy settings so that the platforms do not process and disclose to third parties, data you are not willing to share. The platforms might also have asked for your consent for processing of additional personal data that are not necessary for the provision of the service. This consent should be freely given, i.e. not made conditional on the provision of the service. In any case you can withdraw your consent at any time,” DG Justice added..
Users can lodge a complaint with their national Data Protection Authority. The Data Protection Authorities can impose a range of sanctions on companies, platforms and organisations, including suspending or stopping data processing and imposing a fine of up to €20 million or 4 % of the business annual global turnover.