Merry Christmas!

Merry Christmas Dear Readers!

We hope you are enjoying this festive time with your families and/or friends, as much as the restrictions in the place you live at, allow for this. 

Stay safe and let us hope for the 2021 to be nicer to all of us!

Who is on the nice or naughty list?: Digital Markets Act and Digital Services Act

European Commission published today two potentially game-changing proposals for the digital market: Digital Services Act (see here) and Digital Markets Act (see here). For those of our readers who have not heard about the works on the proposals for these two regulations, the Digital Services Act aims to 'comprehensively' regulate the obligations of digital service providers towards users of their services as well as enforcement authorities, whilst the Digital Markets Act sets out the rules for the digital market, e.g. defining its largest participants as so-called 'gatekeepers' and providing for additional obligations for them. These proposals will now be discussed further by the European Parliament and the Council. Below we provide a summary of the proposals.

Digital Markets Act

The advantage of the Digital Markets Act for consumers lies definitely in the environment this regulation aims to promote: more competitive, encouraging consumers to seek for, access and conclude the best possible deal, not locking them into digital services contracts they conclude. The gatekeepers to the market are companies located anywhere in the world, provided they offer their core platform services to business users in the EU or end users in the EU (Article 1(2)). The end users do not have to be consumers (Article 2(16)) as they may be legal persons, as well as natural persons.

Core platform services could be (Article 2(2)): online intermediation services, online search engines, online social networking services, vide-sharing platform services, number-independent interpersonal communication services, operating systems, cloud computing services, advertising services. 

Gatekeepers are defined (Article 3) as providers of core platform services who have a significant impact on the internal market (e.g. annual EEA turnover exceeds EUR 6.5 billion in the last 3 financial years and they provide the core platform service in min 3 Member States), operate a core platform service which serves as an important gateway for business users to reach end users (e.g. more than 45 million monthly active end users located in the EU and more than 10.000 yearly active business users established in the EU), and enjoy an entrenched and durable position in its operations (or could do so) (e.g. where it was an important gateway for the last 3 financial years). These thresholds are just an example, as the Commission has the power to designate other providers as gatekeepers (Article 3(6)). Generally, it is the gatekeeper who should notify the Commission that they have reached such a position (Article 3(3)).

Articles 5 and 6 specify the main obligations of the gatekeepers. These seem to focus on: limiting the scope in which platforms use personal data, not limiting a possibility for business users to offer the same products or services to end users on different platforms under different conditions, not restricting communication of business and end users outside the platform, allowing end users to un-install any pre-installed software applications on the platform, as well as facilitate installation of third party software applications, not prioritise in ranking products or services offered by the gatekeeper, limit bundling of services, facilitate switching of services, transparency obligations.

Further provisions of the proposal for this regulation are devoted mainly to various monitoring obligations, review processes and consequences for non-compliance (mainly fines).

Digital Services Act 

The main advertised advantage of this act for consumers is that the provisions of the regulation will offer them 'more choice, lower prices', 'less exposure to illegal content' and 'better protection of fundamental rights' (see here). These benefits are to result if the aims of the Regulation as defined in its Article 1(2) are achieved. Similarly to DMA this Act also will apply to providers of intermediary services regardless of their place of establishment, as long as the services are provided to recipients established or located in the EU (Article 1(3)). A recipient of the service again does not need to be a consumer, as it may be a legal person (Article 2(b)).

The obligations imposed by this Act are to bind providers of intermediary information society services (Article 2(f)), that is services where providers are either a: 'mere conduit' (transmitters of information provided by recipients or providing access to the communication network, e.g. Internet access providers), 'caching' service (where they temporarily store the transmitted information to make its transmission more efficient), 'hosting' service (where they store the information provided for and as requested by the recipient of the service, e.g. cloud services).

Articles 3-5 specify when providers of various information society services in the above-mentioned categories may be exempted from the liability for the content of that information, i.e. when it is illegal content. These provisions aim then to ensure that consumers (citizens) are indeed exposed to less illegal content (will they suffice? that is the question that goes beyond providing a short summary here!).

Importantly, if a provider conducts a voluntary own-initiative investigation that does not change the status of their exemption from the liability as determined in Articles 3-5 (Article 6). Thus self-checks are to be encouraged. However, there remains no general obligation to monitor the information which providers transmit or store (Article 7), similarly to the current E-Commerce Directive provision.

Articles 8-9 regulate how providers are to comply with orders about removing illegal content and providing information about users, respectively.

Other interesting for us provision may be:

- Article 12 - which obliges providers to transparently outline any content moderation procedures and tools in their terms and conditions;

-  Article 13 - requiring providers to publish an annual report on past year's content moderation; Article 23  adds also an obligation to provide reports on the number of disputes submitted to ADR, number of suspensions (Art 20) and any use of automatic means for the purpose of content moderation;

- Article 14 - providers of hosting services are required to facilitate users notifying them about illegal content and allowing them to act upon such notifications (notice and action);

- Article 15 - requires hosting services providers to notify, in a reasoned and transparent manner, users if their content is removed/disabled/etc as illegal;

- Article 17 - sets out rules on an internal complaint-handling system for online platforms, which they are to provide to recipients of services for min 6 months following either removal or disabling of access to the information provided by recipients, suspension or termination of the service, suspension or termination of the account;

- Article 17(4) and Article 18 - recipients of services should be informed about and have access to ADR;

- Article 19 - specifies rules for processing of notifications of trusted flaggers;

- Article 20 - determines when providers could suspend users' accounts due to misuse, i.e. frequent posting of illegal content;

- Article 22 - specifies that online platforms are required to obtain information from traders allowing to trace identity and location of such traders and should check the reliability of this information;

-  Article 24 - online advertising has to be clearly displayed as such, together with parameters used to determine the recipient to whom the advertisement is displayed;

- Articles 26-33 - contain obligations for very large online platforms, in the same categories as described above, but with stricter provisions.

Further provisions pertain to various enforcement and penalties issues, as well as the plans to encourage adoption of standards and codes of conduct.

The New Consumer Protection Agenda 2020-25

Last month, on November 13 2020 the EU Commission adopted its new Consumer Protection Agenda 2020-25 that will provide the strategic framework of consumer protection policy  for the next five years. The Agenda identified 5 key priority areas:

1) Green transition: empower consumers to behave 'green' to purchase sustainable and circular products.

2) Digital transformation: increase online consumer protection; this aim will entail the revision of several well established directives: General Product Safety Directive, Consumer Credit Directive and Distance Marketing of Financial Services Directive.

3) Effective enforcement and redress: places emphasis on the CPC Regulation. 

4) Consumer vulnerability: means addressing the needs of different groups, including debt advice and safety of products designed for children.

5) Consumer protection in the global context: aims to promote overall high level of protection, including the safety of products sold online. 

The strategy seems to have addressed the most pressing consumer protection issues of our everyday lives. Not surprisingly it is significantly influenced by the COVID pandemic and the ways in which it reshaped our lives.

CJEU agrees with the AG in the Uber follow-up case - Star Taxi App

Last week the Court of Justice delivered its judgment in another case highly relevant to the platform economy - C-62/19 Star Taxi App. The English version of the judgment is not available at the time of this writing, yet the analysis of other language versions shows that the Court largely followed the opinion of the Advocate General Szpunar, on which we reported earlier this year (see AG opinion in Star Taxi App...). Like in several other judgments on online platforms analysed on this blog - from Uber Spain and Uber France to Airbnb Ireland - the focus remained on the classification of services provided by platform operators and its regulatory implications. The Court continued to rely on the analytical framework developed in the Uber cases, but - similarly to the Airbnb ruling - applied it more favourably to the platform provider. The judgment confirms that the classification of services of platform operators as activities falling outside of the scope of Directive 2000/31/EC on electronic commerce is not to be made too promptly. Moreover, the judgment addressed several other aspects of the EU regulatory framework - in a way which was not as favourable to the platform providers as they may have hoped.

Facts of the case and the questions referred

As we recounted in our previous post, the case involved a provider of a mobile application connecting drivers and passengers in urban transport. The business model of Star Taxi App was, however, not identical to the Uber platform. Firstly, the provider did not automatically select two parties for a ride, but rather displayed a list of drivers available for a journey, from whom the passenger was free to choose a party. Secondly, the fare was not set by and collected through the app, but was paid directly to the driver. Thirdly, only taxi drivers authorised and licensed to provide taxi services were allowed on the platform and no additional steps were taken to control the quality of the vehicles and drivers. Finally, unlike Uber, Star Taxi App was a Romanian platform, operating on the Romanian market.

The operation of the platform was considered to be in violation of applicable national rules, most notably as regards prior authorisation. The provider contested the sanctions imposed on him, arguing that the relevant norms were contrary to the EU law. Against this background, the Regional Court in Bucharest decided to stay the proceedings and ask the Court of Justice for an interpretation of the notions of "information society services" under Directive 2000/31/EC and "technical regulations" under Directive 2015/1535 on the provision of information in the field of technical regulations. Moreover, the reference provided the Court with an opportunity to clarify specific norms on freedom of establishment, contained in Directive 2000/31/EC (principle excluding prior authorisation) and Directive 2006/123/EC on services (conditions for establishing authorisation schemes and for granting authorisations).

Judgment of the Court

Finding 1: Star Taxi App provides information society services

Like the AG, the Court found that services provided Star Taxi App fulfil the criteria of "information society services", to which Directive 2000/31/EC applies (para. 42-48), and cannot be seen as "inherently linked" to the underlying transport services. Key to the latter finding was the fact that Star Taxi App did not create a new market for non-professional drivers, but was limited to licensed taxi drivers, i.e. a market for services which existed before (para. 52), and did not organise the general functioning of underlying transport services, as it did not select the drivers, set or charge prices or control vehicles or drivers (para. 53). Consequently, unlike in Uber cases, classification as "information society services" remained available.

Finding 2: Notification requirements under Directive 2015/1535 do not apply

The Court then reversed the order of the questions referred and moved to the assessment of notification requirements under Directive 2015/1535. Like the AG, the Court concluded that the Romanian requirements imposed on operators of taxi "dispatching" services did not constitue technical regulations as they were not specifically aimed at information society services. Whether or not this finding remains in line with the Court's previous case law can be a matter of debate. To recall, the Court was not equally generous to the national regulator in VG Media, where it found that the German copyright rules (introducing publisher rights) were aimed, at least in part, at regulating information society services (the use of snippets on search engines). In Star Taxi App, the Court was satisfied with the fact that "taxi dispatching" have long been defined more broadly and referred to the activity consisting in receiving customer bookings by telephone "or other means" and forwarding them to a taxi driver. The fact that more recent local rules in Bucharest explicitly mentioned "IT applications" among those "other means" was deemed irrelevant. To support this conclusion the Court observed that the analysed requirements, for example to obtain a two-way radio, applied equally to all types of dispatching services (para. 65). The latter argument seems rather shaky, considering that the Court later (rightly) argues that such a requirement, applied to the providers of information society services, could, in fact, be contrary to Directive 2006/123/EC. An alternative reading of Directive 2015/1535 could, however, be difficult to reconcile with the subsequent interpretation of Article 4(2) of Directive 2000/31/EC, which was likely a consideration in this part of judgment.

Finding 3: Article 4 of Directive 2000/31/EC does not apply to the scheme at hand, but Articles 9 and 10 of Directice 2006/123/EC do

The last part of the judgment concerns the applicability of the principle excluding prior authorisation in Article 4(1) of Directive 2000/31/EC to the case at hand. Similarly to the AG, the Court found that the analysed scheme was not covered by this provision and instead fell under the exception set out in the subsequent paragraph. To recall, pursuant to Article 4(2) of Directive 2000/31/EC, the principle excluding prior authorisations for information society services remains without prejudice to authorisation schemes which are not specifically and exclusively targeted at such services. Like the AG, the Court observed that a mere clarification (extension?) of the scope of pre-existing rules to dispatching services relying on IT applications does not consistute an authorisation scheme which is specifically and exclusively targeted at such services (paras. 81-82). Accordingly, a conflict between Directives 2000/31/EC and 2006/123/EC did not arise and provisions of the latter were deemed applicable.

The Court then moved to the interpretation of Articles 9 and 10 of Directive 2006/123/EC on freedom of establishment, referring numerously to its recent judgment in Cali Apartments. Like in the Cali case, the Court underlined that a separate and consecutive assessments must be made of, firstly, whether the very principle of establishing that scheme is justified, and, secondly, the criteria for granting the authorisations provided for by that scheme (para. 87). Since the information provided by the referring court in this regard was not sufficient (e.g. so as to assess if the scheme could be justified by reasons of consumer protection), the Court limited itself only to brief observations regarding the criteria apparent from the file. Most notably, it shared the view expressed by the AG that an obligation, imposed on service providers, to comply with technical requirements which are not appropriate for the service in question and thus generate unjustified burdens and costs for service providers could not be deemed compatible with Article 10(2) of Directive 2006/123/EC (para. 90). This could be the case for the requirement to obtain a two-way radio, which was nonetheless for the referring court to verify (paras. 91-92).

Concluding thoughts

Overall, the judgment in Star Taxi App is a reasonable ruling, seeking to strike a balance between the internal market goals and the public interest goals pursued by national regulators. One cannot fail to note, however, that the Court has taken a long way to arrive at this outcome. As apparent from the Star Taxi case, the EU rules at hand provide for significant safety vaults, which Members States can rely upon to regulate the provision of information society services in the public interest. The principle excluding prior authorisation in Article 4(1) of Directive 2000/31/EC does not apply to authorisation schemes which are not specifically and exclusively targeted at information society services and notification requirements in Directive 2015/1535 do not apply to rules which are not specifically aimed at this kind of services. Also the country of origin principle, which is laid down in Article 3(1) of Directive 2000/31/EC and was analysed in the Airbnb Ireland case, is not without limitaitons. Admittedly, the development of the platform economy has pushed some of these norms to its boundaries and a case could be made, for example, for making Article 4(1) of Directive 2000/31/EC less categorical. This, however, is a task for the EU legislature and a potential subject for the Digital Services Act. For the time being, the judgment in Star Taxi App shows, together with Airbnb Ireland, that classification of services of platform operators as activities falling outside of the scope of Directive 2000/31/EC should not be made too lightly and that EU free movement rules are to be reckoned with.

* The author carries out a research project on consumer protection in the collaborative economy, financed by the National Science Centre in Poland on the basis of decision no. DEC-2015/19/N/HS5/01557.