Summary of the Opinion of the European Data Protection Supervisor on the legislative package ‘A New Deal for Consumers’

(The full text of this Opinion can be found in EN, FR and DE on the EDPS website www.edps.europa.eu)

(2018/C 432/04)

This Opinion outlines the position of the EDPS on the legislative package entitled: ‘A New Deal for Consumers’ that is composed of the Proposal for a Directive as regards better enforcement and modernisation of EU consumer protection rules and the Proposal for a Directive on representative actions for the protection of the collective interests of consumers.

The EDPS welcomes the intention of the Commission to modernise existing rules in an area whose goals are closely aligned to those of the recently modernised data protection framework. He recognises the need to fill the gaps in the current consumer acquis in order to respond to the challenge presented by predominant business models for digital services which rely on massive collection and monetisation of personal data and on the manipulation of people's attention through targeted content. This is a unique opportunity to improve consumer law to redress the growing imbalance and unfairness between individuals and powerful companies in digital markets.

In particular, the EDPS supports the aim to extend the scope of Directive 2011/83/EU of the European Parliament and of the Council (1) in order to allow the consumers, who receive services not rendered against a monetary price, to benefit from the protection framework offered by this Directive, as this reflects today's economic reality and needs.

The Proposal took into account the recommendations of the EDPS Opinion 4/2017 and refrains from using the term ‘counter-performance’ or distinguishing between data ‘actively’ or ‘passively’ provided by consumers to suppliers of digital content. However, the EDPS notes with concern that the new definitions envisaged by the Proposal would introduce the concept of contracts for the supply of a digital content or digital service for which consumers can ‘pay’ with their personal data, instead of paying with money. This new approach does not solve the problems caused by using the term ‘counter-performance’ or by making an analogy between the provision of personal data and the payment of a price. In particular, this approach does not sufficiently take into consideration the fundamental rights nature of data protection by considering personal data as a mere economic asset.

The GDPR already laid down a balance regarding the circumstances under which the processing of personal data may take place in the digital environment. The Proposal should avoid promoting approaches that could be interpreted in a way inconsistent with the EU commitment to fully protect personal data as laid down in the GDPR. To provide broad consumer protection without risking to undermine the principles of data protection law, an alternative approach could be envisaged, such as based on the broad definition of a ‘service’ from the e-commerce Directive, the provision defining the territorial scope of the GDPR or Article 3(1) of the Council General Approach on the Digital Content Proposal.

The EDPS therefore recommends refraining from any reference to personal data in the definitions of the ‘contract for the supply of digital content which is not supplied on tangible medium’ and the ‘digital service contract’ and suggests to rely instead on a concept of a contract under which a trader supplies or undertakes to supply specific digital content or a digital service to the consumer ‘irrespective of whether a payment of the consumer is required’.

Furthermore, the EDPS draws attention to several potential interferences of the Proposal with the application of the EU data protection framework, in particular with the GDPR and provides recommendations.

First of all, the EDPS stresses that the processing of the personal data can only be done by the traders in accordance with the EU data protection framework, in particular the GDPR.

Second, the EDPS is concerned that if the concept of ‘contracts for the supply of a digital content or digital service for which consumers provide their personal data, instead of paying with money’ were introduced by the Proposal, it could mislead service providers who would be led to believing that the processing of data based on consent in the context of a contract is legally compliant in all cases, even where the conditions for valid consent set out in the GDPR are not fulfilled. This would undermine legal certainty.

Third, the complex interplay between the right of withdrawal from the contract and the withdrawal of the consent for processing of personal data, as well as the obligation of the trader to reimburse the consumer in the event of withdrawal demonstrates the difficulties of reconciling the concept of ‘contracts for the supply of a digital content or digital service for which consumers provide their personal data, instead of paying with money’ introduced by the Proposal with the fundamental right nature of personal data and the GDPR.

Also, the EDPS considers that the Proposal should amend Article 3 of Directive 2011/83/EU and introduce a provision that clearly states that in case of a conflict between the Directive 2011/83/EU and the data protection legal framework, the latter prevails.

Furthermore, the EDPS also welcomes the new Proposal on collective redress, which intends to facilitate redress for consumers where many consumers are victims of the same infringement, in a so-called mass harm situation. The EDPS assumes that the redress mechanism envisaged in the Proposal on collective redress aims to be complementary to the one in Article 80 of the GDPR on representation of data subjects.

Nevertheless, to the extent personal data protection-related matters would be included in the scope of the collective action under the Proposal, the EDPS considers that ‘the qualified entities’ that will be able to bring the representative actions in this field under the Proposal should be subject to the same conditions as set out in Article 80 GDPR.

Along the same lines, the Proposal on collective redress should clarify that the representative actions regarding data protection issues can only be brought before administrative authorities that are the data protection supervisory authority within the meaning of Articles 4(21) and 51 GDPR.

In conclusion, the EDPS considers that the application of two different mechanisms on collective redress, to the GDPR and to the future e-Privacy Regulation, alongside other substantive points of interaction between consumer and data protection, requires more systematic cooperation between the consumer protection and data protection authorities that could be done, for instance, within the already existing voluntary network of the enforcement bodies from competition, consumer and data protection areas — the Digital Clearinghouse.

Finally, the EDPS welcomes the initiative to update the enforcement of consumer rules: the revision of the Consumer Protection Cooperation Regulation. In this context, the EDPS considers that it is important to further explore the synergies between the data protection and consumer law. The cooperation between the consumer protection and data protection authorities should become more systematic wherever specific issues that are of interest for both side arise, in which consumer welfare and data protection concerns appear to be at stake.

I. INTRODUCTION AND BACKGROUND

1. On 11 April 2018, the European Commission (hereinafter ‘the Commission’) issued the Communication ‘A New Deal for Consumers’ ( 2 ) (hereinafter ‘the Communication’) together with two following legislative proposals: — proposal for a Directive amending Council Directive 93/13/EEC, Directive 98/6/EC, Directive 2005/29/EC and Directive 2011/83/EU as regards better enforcement and modernisation of EU consumer protection rules (3); — proposal for a Directive on representative actions for the protection of the collective interests of consumers and repealing Directive 2009/22/EC (4).

2. The two proposals are to be seen as a package with common objectives, notably to: — modernise existing rules and fill the gaps in the current consumer acquis; — provide better redress opportunities for consumers, support effective enforcement and greater cooperation of public authorities in a fair and safe Single Market; — increase cooperation with partner countries outside the EU; — ensure equal treatment of consumers in the Single Market and guarantee that national competent authorities are empowered to tackle any problems with ‘dual quality’ of consumer products; — improve communication and capacity-building to make consumers better aware of their rights and help traders, especially small and medium-sized enterprises, to comply more easily with their obligations; — look at future challenges for consumer policy in a fast evolving economic and technological environment.

3. More specifically, the Proposal as regards better enforcement and modernisation of EU consumer protection rules (hereinafter ‘the Proposal’) aims at making the improvements outlined below: — More effective, proportionate and dissuasive penalties for widespread cross-border infringements; — Right to individual remedies for consumers; — More transparency for consumers in online marketplaces; — Extending protection of consumers in respect of digital services; — Removing burdens for businesses; — Clarifying Member States' freedom to adopt rules on certain forms and aspects of off-premises sales; — Clarifying the rules on misleading marketing of ‘dual quality’ products.

4. Furthermore, the Proposal for a Directive on representative actions for the protection of the collective interests of consumers (hereinafter ‘the Proposal on collective redress’) intends to facilitate redress for consumers where many consumers are victims of the same infringement, in a so-called mass harm situation.

5. At the time of the adoption of these two proposals, the EDPS was not consulted by the Commission.

VII. CONCLUSION

On the Proposal:

69. The EDPS welcomes the intention of the Commission to modernise existing rules and fill the gaps in the current consumer acquis in order to respond to current challenges such as emerging new business models, in which personal data is being demanded from consumers wishing to access digital content or make use of digital services.

70. However, the EDPS notes with concern that the new definitions envisaged by the Proposal would introduce the concept of contracts for the supply of a digital content or digital service for which consumers can ‘pay’ with their personal data, instead of paying with money. The EDPS would like to stress that this new approach does not solve the problems caused by using the term ‘counter-performance’ or by making an analogy between the provision of personal data and the payment of a price. In particular, he considers that this new approach does not sufficiently take into consideration the fundamental rights nature of data protection by considering personal data as a mere economic asset. To provide broad consumer protection without risking to undermine the principles of data protection law, an alternative approach could be envisaged, such as based on the broad definition of a ‘service’ from the e-commerce Directive, the provision defining the territorial scope of the GDPR or Article 3(1) of the Council General Approach on the Digital Content Proposal.

71. The EDPS therefore recommends refraining from any reference to personal data in the definitions of the ‘contract for the supply of digital content which is not supplied on tangible medium’ and the ‘digital service contract’ and suggests to rely instead on a concept of a contract under which a trader supplies or undertakes to supply specific digital content or a digital service to the consumer ‘irrespective of whether a payment of the consumer is required’.

72. In addition, the EDPS draws attention to several potential interferences of the Proposal with the application of the EU data protection framework, in particular with the GDPR and provides recommendations: — processing of the personal data can only be done by the traders according to the EU data protection framework, in particular in line with the GDPR; — if the concept of ‘contracts for the supply of a digital content or digital service for which consumers provide their personal data, instead of paying with money’ were introduced by the Proposal, it could mislead service providers who would be led to believing that the processing of data based on consent in the context of a contract is legally compliant in all cases, even where the conditions for valid consent set out in the GDPR are not fulfilled. This would undermine legal certainty; — a period of 14 days to withdraw from the contract introduces by the Proposal cannot be considered as a restriction on the right to withdrawal of the consent at any time provided for in the GDPR; — it may not be possible to evaluate the value of personal data in the event of withdrawal from the contract. It is therefore questionable whether the Proposal could indeed ensure that consumers are fairly compensated.

73. Finally, the EDPS considers that the Proposal should amend Article 3 of Directive 2011/83/EU and introduce a provision that clearly states that in case of a conflict between the Directive 2011/83/EU and the data protection legal framework, the latter prevails.

On the Proposal on collective redress:

74. The EDPS welcomes the new Proposal on collective redress, which intends to facilitate redress for consumers where many consumers are victims of the same infringement, in a so-called mass harm situation.

75. Nevertheless, to the extent personal data protection-related matters would be included in the scope of the collective action under the Proposal, the EDPS considers that ‘the qualified entities’ that will be able to bring the representative actions in this field under the Proposal should be subject to the same conditions as set out in Article 80 GDPR.

76. Along the same lines, the Proposal on collective redress should clarify that the representative actions regarding data protection issues can only be brought before administrative authorities that are the data protection supervisory authority within the meaning of Articles 4(21) and 51 GDPR.

77. The EDPS also considers that the application of two different mechanisms on collective redress, to the GDPR and to the future e-Privacy Regulation, alongside other substantive points of interaction between consumer and data protection, requires more systematic cooperation between the consumer protection and data protection authorities that could be done, for instance, within the already existing voluntary network of the enforcement bodies from competition, consumer and data protection areas — the Digital Clearinghouse.

On the revision of the Consumer Protection Cooperation Regulation:

78. The EDPS welcomes the initiative to update the enforcement of consumer rules: the revision of the Consumer Protection Cooperation Regulation.

79. In this context, the EDPS considers that it is important to further explore the synergies between the data protection and consumer law. The cooperation between the consumer protection and data protection authorities should become more systematic wherever specific issues that are of interest for both side arise, in which consumer welfare and data protection concerns appear to be at stake.

Brussels, 5 October 2018. Giovanni BUTTARELLI European Data Protection Supervisor

(1) OJ L 304, 22.11.2011, p. 64.

(2) Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee ‘A New Deal for Consumers’, COM(2018) 183 final.

(3) Proposal for a Directive of the European Parliament and of the Council amending Council Directive 93/13/EEC of 5 April 1993, Directive 98/6/EC of the European Parliament and of the Council, Directive 2005/29/EC of the European Parliament and of the Council and Directive 2011/83/EU of the European Parliament and of the Council as regards better enforcement and modernisation of EU consumer protection rules, COM(2018) 185 final.

(4) Proposal for a Directive of the European Parliament and of the Council on representative actions for the protection of the collective interests of consumers and repealing Directive 2009/22/EC, COM(2018) 184 final.