Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Question

Apologies in advance if this is not the correct exchange for this question.

I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU.

As part of the data consent / privacy policy, users can agree to allow the company to collect additional data about their account, in addition to our standard terms.

I have been asked to implement a set of new features. Part of this implementation involves making these features inaccessible to users who have not allowed the company to collect additional data. If the user agrees to share this data, they can access the new features. However, these new features do not need to use the additional data in order to work.

I am concerned that this is illegal and am hesitant to carry out the project. I have spent some time trying to research this online but have been unable to find clear advice on the legality of leveraging feature access against data consent options. I do not think this is considered best practice, but I am unable to assess if it is illegal, or just a poor decision.

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Answer 1

Any processing of personal data needs a legal basis, for example necessity for some contract or legitimate interest. If no other legal basis allows the processing, you need to acquire consent. Consent must be freely given. If something is gated behind consent without that consent being really necessary, this might coerce users and they would not be able to consent freely. The GDPR does not have a hard ban on this, but it explicitly calls out that this case must be considered when determining whether consent is valid.

So what your company is trying to do is in a dark grey area. Not necessarily wrong, but likely so.

Consent could be made free if users have an actual choice. For example, some online newspaper sites had success with a “pay or consent” wall. (Success in the sense that some data protection authorities allowed this). In your case, this could mean that users either consent to extra data collection, or that they buy some reasonably priced premium mode.

But none of this is for you to decide. You can voice your doubts that the software would be compliant. You could also ask if the Data Protection Impact Assessment document for this proposed processing is available (creating such an assessment is likely mandatory in this case). But in the end, it is the company's obligation to be compliant, and this responsibility is largely shouldered by the company's data protection officer (to whom you can turn with further questions).