The data protection agency ruled that financial incentives could influence people’s consent – especially if they are in a vulnerable position.