Source: https://www.jipitec.eu/issues/jipitec-8-1-2017/4528
Timestamp: 2019-04-25 19:47:33+00:00

Document:
Article 3 para. 1 of the proposed Directive on certain aspects concerning contracts for the supply of digital content recognises that consumers may use their personal data as counter-performance in exchange for contents or services. This approach confirms a social practice, which may be observed everywhere in the digital environment. Accepting personal data as counter-performance in bilateral contracts intensifies the rights and duties of both parties. For the consumer, the proposed Directive clarifies that the data subject providing its personal data to the supplier shall have the same rights as in the case of a money consideration paid to the supplier. However, what are the duties of the consumer and what are the rights of the supplier? The proposed Directive does not address this issue. The article provides some initial answers based on German contract law.
The legal construction of “free services” on the Internet, which are provided to consumers while their personal data is requested or harvested, is currently undergoing a change of paradigm. Until recently, service providers like social media services, search engines, communication services, and hosting platforms, presented their business model as purely ad-funded services based on a two-sided market, in which the advertisers pay for the service and the users only have the advantages of attractive and cost-free services.  If the service asked the users consent to any data processing, this consent was treated under the old paradigm as being independent from the supply of the service. This idea of two independent legal transactions – supply of service and transmission of data – has been criticised by some commentators in recent years.  The European Commission's - Proposal for a Directive on certain aspects concerning contracts for the supply of digital content of December 2015  (DSDC) may now change the landscape.
2. Which scenarios are covered by the Directive?
The DSDC proposes to introduce harmonised rules on contracts for the supply of digital content in a broad sense, also comprising many services contracts, including services allowing the creation, processing, or storage of data and services allowing sharing of and any other interaction with data in digital form provided by other users of the service, see Art. 2 N° 1. For all those contracts, Art. 3 para. 1 DSDC explicitly provides that the Directive shall apply to any contract where the supplier supplies digital content to the consumer “and, in exchange, a price is to be paid or the consumer actively provides counter-performance other than money in the form of personal data or any other data.” The language of Art. 3 para. 1 DSDC is broad and seems to cover all cases in which the service providers use the personal data of the consumer as the basis for the refunding of its service. However, the Commission's concept is more restrictive and covers only actively provided data. According to Recital 14, the Directive should apply only to contracts where the supplier requests and the consumer actively provides data, such as name and e-mail address or photos. To the contrary, the Directive should not apply to situations where the supplier collects data necessary for the digital content to function in conformity with the contract; for example geographical location for a mobile application to function properly. Additionally the Directive should not apply to situations where the supplier collects information, including personal data, such as the IP address, or other automatically generated information such as information collected and transmitted by a cookie, without the consumer actively supplying it. If the final text of the Directive would exclude all the scenarios mentioned in Recital 14, its scope of application would be rather limited. Yet, the Draft Report of the European Parliament's Committee on Legal Affairs sets forth a proposal to give the provision a broader scope and to include cases in which the personal data is “collected by the supplier or a third party in the interest of the supplier”.  It is indeed hardly convincing to exclude personal data collected by the service provider – e.g. search terms, geographical location data etc. – if such data is processed and used beyond the usage necessary for the functioning of the service.  Such a processing of personal data will regularly depend on the consumer’s consent.  Thus, the consumer provides a valuable counter-performance in exchange for the service and should profit from the protection given by the Directive. The same is true for data whereby the collection of which was initially strictly necessary for the performance of the contract or for meeting legal requirements, if the supplier later continues to process the data for commercial purposes, e.g. if a streaming service later uses data on the supplied content to offer other content or services to the consumer.
The DSDC provides rules on the supply and conformity of digital content, on the rights and obligations of the parties, and on the termination of the contract. It does not harmonise the rules on the formation of contracts, especially in case of personal data as counter-performance, see Art. 3 para. 9. This leaves some of the most important practical legal issues raised by contracts with data as counter-performance to national law, as determined by Art. 3, 4 and 6 of Regulation 593/2008 on the law applicable to contractual obligations (Rome I).  The following analysis is based on the application of German law. Other jurisdictions will encounter comparable problems.
The first requirement for the formation of a contract with personal data as counter-performance is a respective offer to conclude such a contract. In terms of typical contracts for the supply of digital content, it will be the service provider who offers to conclude a contract for the use of its service.  It is therefore a question of interpretation of the terms and conditions of the service, of the explanations on the website, and the general appearance of the service, whether the service provider offers to conclude a contract with personal data as counter-performance. This interpretation, according to German contract law, is based on objective standards, as stated in section 157 of the German Civil Code: “Contracts are to be interpreted as required by good faith, taking customary practice into consideration.” The decisive test is therefore how an average and reasonable addressee would understand the declarations and conduct of the service provider. In this regard, empirical evidence from Germany shows that users understand “free” services as services they pay for with their personal data. In a recent study  conducted in 2014 with 1002 randomly chosen German Internet users, 67% declared that they acknowledge that delivery of personal data and consent in data processing is a method of payment for Internet services. It is therefore quite plausible that an average user of a data-driven Internet service will understand an offer for a “cost-free use” in fact as an offer to exchange his or her personal data against the service.
Acceptance of such an offer may be declared explicitly, especially by ticking boxes, or implicitly by mere use of the service. German contract law has developed several means to avoid formalistic obstacles. According to section 151 sentence 1 German Civil Code, a contract comes into existence through the acceptance of the offer without the offeror needing to be notified of acceptance, if such a declaration is not to be expected according to customary practice. Based on this provision, it is well established in court practice that the use of Internet services may be interpreted as acceptance of the contract offer to use the service in accordance with the terms and conditions.  With regard to services that process the data of the users, one could even go further and understand such data processing as an indicator that the service has taken note of the user's acceptance of the contract terms.
As to the validity of contracts, several issues deserve attention. The validity of the contract for the supply of digital content will not be harmonised by the DSDC, but will remain in the realm of autonomous national contract law, Art. 3 para. 9 The validity issues are diverse and complex and can only be sketched out here.
The DSDC is mainly focussed on the consumer's rights and the supplier's obligations and leaves the consumer's duties in the realm of autonomous national contract law.  According to Article 5 DSDC, the supplier shall supply the digital content to (a) the consumer or (b) a “third party which operates a physical or virtual facility making the digital content available to the consumer or allowing the consumer to access it and which has been chosen by the consumer for receiving the digital content”.  Besides the fact that Art. 3 confirms the possibility to use data as counter-performance, the DSDC does not further specify the contractual obligations of the consumer in such a case.
Another question concerns accuracy and updating of personal data. Terms and conditions of typical platforms oblige the user to submit correct data and changes to the data, examples are Xing (“The user is obliged (a) to provide only true and non-misleading statements along with its real name, and to refrain from using pseudonyms or pen names …”)  , Facebook (“Facebook users provide their real names and information, and we need your help to keep it that way. Here are some commitments you make to us relating to registering and maintaining the security of your account…”)  or Amazon (“You are responsible for ensuring that the details you provide us with are correct and complete, and for informing us of any changes to the information you have provided.”)  If the consumer, who submits data as counter-performance, may claim to be treated on equal footing as a paying customer, why then should the service provider not have the right to claim for such personal data as they could claim for the payment of the money consideration? It is the very nature of a contract to be bound by the promises given. Still, a duty to update the personal data without a respective request of the service provider should be assessed as being unfair in the sense of Art. 3 para. 1 of the Unfair Terms Directive. The average consumer does not read terms and conditions or privacy policies. If an update clause was valid, consumers would be in breach of contract without being aware of it. Services should therefore ask their customers from time to time for an update.
Lack of conformity of the digital content, as defined by Art. 6 DSDC  , leads to the remedies specified in Art. 12, 13 DSDC. The service provider must bring the digital content into conformity, otherwise the rules on termination and damages may be applied.
By contrast, if the submitted data is incomplete or incorrect, the national contract law principles on non-conformity apply. The German Civil Code provides different remedies for cases of non-conformity depending of the nature of the contract, especially for sale, service, and lease contracts. Contracts on the submission of personal data are not regulated in German contract law so far. One obvious solution would be to apply the principles that have been developed for license contracts. Courts and commentators agree that license contracts should be treated analogous to the provisions on lease contracts with regard to the issue of non-conformity.  The service provider could claim for the submission of correct data, section 535 German Civil Code, for a restitution of the value of its own performance (instead of a rent reduction, section 536), for damages, section 536a, and for the termination of the contract in accordance with section 543 German Civil Code.
The DSDC provides detailed rules for the right of the consumer to terminate the contract, whereas it remains silent on the termination right of the supplier.
Where the supplier has failed to supply the digital content in accordance with Art. 5, the consumer is entitled to immediately terminate the contract in accordance with Art. 11 and 13.  If the digital content has been supplied but is not in conformity with the contract, the consumer may terminate the contract under the conditions of Art. 12 para. 3. Long term contracts may be terminated any time after the expiration of the first 12 months, Art. 16 DSDC.
The effects of the termination of the contract in case of data as counter-performance are provided for in Art. 13 and 16 DSDC. Art. 13 para. 2 lit. b) provides that the supplier shall take all measures “which could be expected in order to refrain from the use of the counter-performance other than money which the consumer has provided in exchange for the digital content and any other data collected by the supplier in relation to the supply of the digital content including any content provided by the consumer (...)”. Other duties of the supplier in case of termination concern the portability of data and user generated content retained by the supplier, Art. 13 para. 2 lit. c).  Art. 16 para. 4 provides similar rules for the termination of long-term contracts. What is not provided for in the DSDC is a claim for restitution of the profits made by the supplier based on the consumer's data before termination. However, given the full-harmonisation approach of the DSDC, it seems hardly conceivable to refer to national law for such a claim.
The right of the supplier to terminate the contract is left to national law. If German law is applicable, the supplier has a right to terminate the contract in accordance with sections 323, 535 et seq. German Civil Code if the consumer fails to supply the promised data, or in case of a lack of conformity of the data as discussed in section 5 of this article. Such a termination has an effect ex post. This means that the consumer may be obliged to compensate the supplier for the use of digital content before the termination of the contract, see section 346 para. 1 and 2 German Civil Code. In addition, the supplier must have a right to terminate the contract without notice in application of section 543 para. 2 N° 1 German Civil Code, if the consumer withdraws its consent in the use of the data.  Such a termination only has effects on the future. For the time period in which the supplier could legally use the consumer's data, the supplier may not claim for compensation of the use of the digital content.
* By Prof. Dr. Axel Metzger, LL.M. (Harvard), Professor of Law, Humboldt-Universität zu Berlin.
 See e.g. Bräutigam MMR 2012, 635; Buchner DuD 2012, 39, 41; Rogosch, Die Einwilligung im Datenschutzrecht, 41.
 Draft Report of the Committee on the Internal Market and Consumer Protection and of the Committee on Legal Affairs 7.11.2016, C8‑0394/2015 – 2015/0287(COD) drafted by MEPs Evelyne Gebhardt and Axel Voss.
 See European Law Institute, Statement on the European Commission's Proposed Directive on the Supply of Digital Content to Consumers, 15-16; Faust, Digitale Wirtschaft – Analoges Recht, Gutachten zum 71. Deutschen Juristentag, 2016, A 18; Spindler MMR 2016, 147, 149-150.
 But see Härting CR 2016, 735-740.
 The parties may choose the applicable law according to Art. 3 Rome I based on the service terms and conditions. However such a choice may not deprive the consumer from the protection afforded to him by the law of his habitual residence under the conditions of Art. 6 para. 1, 2 Rome I.
 See e.g. the terms and conditions of www.xing.com/terms , de-de.facebook.com/terms, www.amazon.de/gp/help/customer/display.html?ie=UTF8&nodeId=505048 .
 See DIVSI, Daten – Ware und Währung, Hamburg 2014, www.divsi.de/wp-content/uploads/2014/11/DIVSI-Studie-Daten-Ware-Waehrung.pdf , 16.
 See e.g. LG Frankfurt am Main CR 2006, 729, 731.
 See Bräutigam MMR 2012, 635, 637; Jandt/Roßnagel MMR 2011, 637, 639-640.
 Compare Faust, Digitale Wirtschaft – Analoges Recht, Gutachten zum 71. Deutschen Juristentag, 2016, 8 et seq.
 See Metzger AcP 2016, 817, 839-840 for German law.
 Reliable economic data on the value of a set of personal data is not available yet. Facebook's price paid for WhatsApp is often cited as a proxy: 55 $ per user, see www.bloomberg.com/news/articles/2014-10-28/facebook-s-22-billion-whatsapp-deal-buys-10-million-in-sales . Other criteria may be taken from the pricing mechanism of services like datacoup.com who offer to pay money for the use of personal data. From the German legal academic literature see Schwartmann/Hentsch PING 2016, 117, 125, who value the data set of car from a three years lease contract at 1.500-2.000 €. See also Wandtke MMR 2017, 6.
 Faure/Luth Journal of Consumer Policy 34 (2011) 337–358.
 See Adams, Ökonomische Analyse des Gesetzes zur Regelung des Rechts der Allgemeinen Geschäftsbedingungen (AGB-Gesetz), in Neumann (ed.), Ansprüche, Eigentums- und Verfügungsrechte, 1983, 655, 664; Basedow in Münchener Kommentar zum BGB, 7th ed., 2016, Vorbemerkung zu § 305, N° 4-5; Beimowski, Zur ökonomischen Analyse Allgemeiner Geschäftsbedingungen, 1989, 15.
 See also Frenzel in Paal/Pauly (ed.), Datenschutz-Grundverordnung, 2017, Art. 7, N° 18-21; Plath, BDSG/DSGVO, 2016, Art. 7, N° 14-16; Schantz NJW 2016, 1841, 1845. Compare also the more restrictive interpretation by Albrecht CR 2016, 88, 91.
 See, e.g., Westermann in Erman (found.), Bürgerliches Gesetzbuch, 14th ed., 2014, Vor § 320, N° 5 et seq.
 See the critical comment of the European Law Institute, Statement on the European Commission's Proposed Directive on the Supply of Digital Content to Consumers, 27-28 for cases in which a digital product is developed to the consumer's specification.
 European Law Institute, Statement on the European Commission's Proposed Directive on the Supply of Digital Content to Consumers, 32; Spindler MMR 2016, 219, 222.
 See the deviating concept of conformity in the Draft Report of the Committee on the Internal Market and Consumer Protection and of the Committee on Legal Affairs 7.11.2016, C8‑0394/2015 – 2015/0287(COD) drafted by MEPs Evelyne Gebhardt and Axel Voss.
 BGH GRUR 2006, 435; see also BGH CR 2007, 75 f.; Hoeren, IT-Vertragsrecht, 2nd ed., 2012, 251 ff.; Marly, Praxishandbuch Softwarerecht, 6th ed., 2014, N° 752 et seq.
 But see supra Fn. 28.
 The portability provision must be read in context with Art. 20 GDPR. See the contribution of Janal in this issue of JIPITEC; see also Spindler MMR 2016, 219, 221-222.
 See also Buchner, Informationelle Selbstbestimmung im Privatrecht, 2006, 272 et seq.; Langhanke/Schmidt-Kessel EuCML 2015, 218, 222; Rogosch, Die Einwilligung im Datenschutzrecht, 2013, 137.
Axel Metzger, Data as Counter-Performance: What Rights and Duties do Parties Have?, 8 (2017) JIPITEC 2 para 1.

References: Art. 2
 Art. 3
 Art. 3
 Art. 3
 Art. 3
 Art. 3
 Art. 3
 Art. 3
 Art. 6
 Art. 12
 Art. 5
 Art. 11
 Art. 12
 Art. 16
 Art. 13
 Art. 13
 Art. 13
 Art. 16
 Art. 3
 Art. 6
 § 305
 Art. 7
 Art. 7
 § 320
 Art. 20