By: Dr. Camilo Alfonso Escobar Mora ©
Founder of JURÍDIA – Learning and Research Center for Preventive Consumer Law in Digital Advertising
In our theory of preventive consumer law in digital advertising the processing (treatment) of consumer personal data means the legal act that a person makes (physical —natural— or moral —juridical—) that has as an object the reception and / or use of that data for a specific purpose —that is: for an specific activity and / or objective— (if the purpose is indeterminate, the legal act is vitiated because its object is imprecise). Personal data is the data that is linked and / or associated to a person.
Data owner (properly: data holder) is the person who links and / or associates with the data. Is the person linked and / or associated with the data. Then: consumer is the owner (holder) of the data with which her / him is associated and / or linked. That is to say: she / he is the owner (holder) of the data that is associated and / or linked to her / him. Properly: the consumer is the owner (holder) of the data that is associated and / or linked to her / him specific and particular characteristics in a way that makes her / him determinate and / or determinable.
There is public personal data and not public personal data. The public is the one that can be received and / or validly used without having the authorization (consent) of its owner (holder). But: the reception and / or use is only valid if it is done for the purpose for which a rule considers it public. That is: it is only valid if it is done for the purpose determined in the rule. For that reason: if the norm (rule) does not determine the purpose with clarity (properly: if the norm does not determine the purpose) the data is not public. The non-public data (data of restricted reception and / or use) is the one that can only be received and / or validly used if the person that needs to use that data has the owner (holder) authorization (consent).
Now: in our theory the processing (treatment) of consumer personal data must be done when it is diligent to make the advertising that is communicated to be valid. In general: in the theory the processing (treatment) of consumer personal data is done if it is diligent to make the legal relationship between the company and the consumer based on advertising valid. And: it should not be done if it does not make that validity. For that reason: diligence defines the necessity of processing (treatment) of consumer personal data (according to the case, in the case and to the extent of the case —tailored to the case—) and the form to make that processing (treatment) valid (when it is necessary).
Processing (treatment) of consumer personal data is a unilateral legal act that involves actions and / or omissions on these data. Therefore: as it is a legal act must meet the validity elements that apply (depending on the case). It is clarified: in the theory that act is included within the legal relationship that is formed between the company (commercial company) and the consumer based on advertising (digital advertising) because the treatment is linked to an advertising activity (advertising activity).
Properly: the processing (treatment) is linked to a company unilateral legal act whose purpose is the communication of advertising from the company to the consumer (or towards consumer) and that company act (unilateral act of communication of its advertising to the consumer or towards consumer) can be part of a legal relationship that has formed with the consumer (if before the advertising communication that relationship has been formed) or can form a legal relationship with consumer (if before the advertising communication does not a relationship has been formed).
This relationship can be extra-contractual or contractual. There is a contractual relationship if the relationship prior to the advertising communication forms a contract or if consumer accepts an advertisement that has the form of a commercial offer. There is an extra-contractual relationship if the relationship prior to the advertising communication does not form a contract or if consumer is not informed of an advertisement that has the form of a commercial offer (that is to say: if advertising does not communicate a commercial offer to the consumer).
Then: the act validity (of the unilateral legal act of processing —treatment— of consumer personal data) depends on the validity of that legal relationship (that is to say: depends on that legal relationship validity). Therefore: the legal relationship must be harmonious with the rules that apply to it. And: as the act is part of that relationship if the relationship is valid the act is valid.
Then: the consumer (or her / his valid representative) must accept (validly) the formation of that relationship. What also makes the development and termination of that relationship valid for that acceptance (as for that acceptance). But: so that the whole relationship is valid (properly: so that the relationship is valid) both the formation and its development (execution) and termination must be harmonious with rules that apply.
And: if within that relationship there exists an act of processing (treatment) of her / his personal data that processing (treatment) must be valid both in the fact of being accepted by her / him (before it is performed) in a valid way with the rules (norms) that apply to it (that is to say: with rules that apply to that acceptance) as in the fact of be done in a harmonious way with rules that apply to it (that is to say: with rules that apply to that processing) and to be completed in a harmonious way with the rules that apply to it (that is to say: with rules that apply to that completance).
For that reason: the company or the third parties that it involves to do that act in its representation must be diligent in making that unilateral legal act (that is to say: in processing —treatment— that data) in a valid way. As its object (that is to say: as the object of the act) is not directly available to the person who performs the act (because the consumer personal data is not its property. In general: does not have the ownership right over the consumer data personal) it (that is: the company) must obtain the right of use, enjoyment and / or disposition that is related to the purpose of the act.
As the company is the person who performs the act (including: it is the person in whose name the act is performed, in the case in which another person does it in its representation) that is the person who must obtain the right of (thay is to say: the right to) use, enjoyment and / or disposition that is related to the purpose of the act. Another thing is that people linked to the company must be authorized by the company to perform the act on its behalf and must only do so on what the company obtains the right of use, enjoyment and / or disposition that is related to the object of the act.
The act object is the treatment of the consumer personal data for a specific purpose. That is: for a specific activity and / or objective. In the theory: that specific activity and / or objective is an activity and / or objective related to the digital advertising communication from the company to the consumer (or towards consumer).
Company obtains the right of use, enjoy and / or dispose of that data from a rule. From the rule (included: from the set of rules) that applies to the case (according to the case, in the case and to the extent of the case —tailored to the case—).
This rule can be a norm that makes it obtain the right to use, enjoy and / or dispose of that data in a direct way (if the act object is the treatment of a public personal data and the act is related to the specific processing —treatment— purpose that is allowed in that norm) or it can be a norm that makes it obtain the right of use, enjoyment and / or disposition of that data in an indirect way that consists of obtaining the consumer authorization (if the act object is the treatment of a non-public personal data).
Then: when the act object is the treatment of a non-public personal data the consumer must authorize that person to validly use, enjoy and / or dispose of her / his personal data. And: the act can only be done for what consumer has authorized.
Then: company must be diligent in foreseeing and making the legal relationship it forms with consumer based on an advertisement valid. Therefore: it must be diligent in defining if processing —treatment— is necessary for that validity. And: if the treatment is necessary the company must be diligent in foreseeing and making that legal act be valid.