December wrap-up of data protection cases (Google, Österreichische Datenschutzbehörde and Pankki S)

The end of the month (and the end of the year as well) is a good moment for summaries. This time we are taking a closer look at events in the area of data protection law. December was a month with a couple of interesting events, so here is a brief recap. 

Dereferencing allegedly inaccurate content (C-460/20 Google)

The case concerned two executives of a group of investment companies (a board member and a proxy) who asked Google to remove search results linking their names to certain articles criticising the group's investment model. They exercised the so-called right to be forgotten, guaranteed under Article 17(1) of the GDPR, claiming that the information presented contained false claims and defamatory opinions. They also wanted Google to remove their thumbnail images from the search results. Google rejected these requests, arguing that it does not know whether the information contained in the articles is true or not.

In cases involving the erasure of data from a search engine operator's search results, two rights usually collide: the public's right of access to information (especially about persons holding public positions) and the individual's right to protection of his or her personal data, including the right to erasure, protection of his or her good name, image, etc. The same problems were considered in this case, as we wrote about when reporting on the AG's opinion issued in the proceedings. In the ruling of 8th December 2022 the Court held that the person requesting the deletion of data is obliged to show that the information is manifestly inaccurate. "However, in order to avoid imposing on that person an excessive burden which is liable to undermine the practical effect of the right to de-referencing, that person has to provide only evidence that, in the light of the circumstances of the particular case, can reasonably be required of him or her to try to find in order to establish that manifest inaccuracy" (para. 68). It means that such a person cannot be required to present a judicial decision made against the publisher of the website in question, even in the form of a decision given in interim proceedings, since it would be an unreasonable burden imposed on such a person. At the same time "the operator of the search engine concerned cannot be required to investigate the facts and, to that end, to organise an adversarial debate with the content provider seeking to obtain missing information concerning the accuracy of the referenced content" (para. 71). Therefore, if the person who made a request for de-referencing submits relevant and sufficient evidence showing the manifest inaccuracy of the information found in the referenced content, the operator of the search engine is required to accede to that request for de-referencing. But an operator should not grant a request if the inaccurate character of the information is not obvious in the light of the evidence presented (para. 72&73). 

As regards the thumbnails the Court concluded that "a separate weighing-up of competing rights and interests is required depending on whether the case concerns, on the one hand, articles containing photographs which are published on an internet page and which, when placed into their original context, illustrate the information provided in those articles and the opinions expressed in them, or, on the other hand, photographs displayed in the list of results in the form of thumbnails by the operator of a search engine outside the context in which they were published on the original internet page" (para. 101). The Court also stated that the informative value of those images should be taken into account independently of the context of their publication on the website from which they originate, nevertheless taking into account all the content that directly accompanies the display of those images in the search results and that can explain the informative value of those images (para. 108).

The concept of a "copy of personal data" under the Article 15(3) of the GDPR. AG Pitruzzella opinion on Österreichische Datenschutzbehörde case (C‑487/21)

The dispute arose over the interpretation of Article 15(3) of the GDPR, which provides that a data subject, as part of the right of access to one's personal data, may obtain a copy of that data. The complainant requested an exact copy of the data processed by the controller, including full copies of documents containing his personal data. However, the controller provided only some of the requested information as an aggregate that reproduced the stored personal data of the data subject in a table broken down by name, date of birth, street, postal code, and place, and in a statement summarising corporate functions and powers of representation. As part of the proceedings, the national court decided to refer several questions concerning the interpretation of Article 15(3) of the GDPR to the Court. 

On 15 December 2022, the AG delivered an opinion stating that the concept of “copy” referred to in Article 15(3) of the GDPR must be understood as "a faithful reproduction in intelligible form of the personal data requested by the data subject, in material and permanent form, that enables the data subject effectively to exercise his or her right of access to his or her personal data in full knowledge of all his or her personal data that undergo processing – including any further data that might be generated as a result of the processing, if those also undergo processing – in order to be able to verify their accuracy and to enable him or her to satisfy himself or herself as to the fairness and lawfulness of the processing so as to be able, where appropriate, to exercise further rights conferred on him or her by the GDPR". The AG underlined that this provision does not, in principle, entitle the data subject to obtain a full copy of documents containing the personal data, but, at the same time, does not exclude the need to provide that person with extracts from documents, whole documents or extracts from databases if that is necessary to ensure that the personal data undergoing processing are fully intelligible.

Right to know the identity of the persons who had access to one's personal data. AG Campos Sánchez-Bordona on Pankki S case (C-579/21)

The third case also concerned the right of access to personal data, but from a different perspective. Data subject wanted to know who exactly (among the employees of the financial institution) had access to his personal data at the time when he was a customer of that institution and an employee thereof. The controller refused to provide names of the employees arguing that Article 15 of the GDPR does not apply to log data of the institution's data processing system and that the information requested does not relate to personal data of the data subject, but to the personal data of the employees. 

The AG approved the controller's view and stated that Article 15(1) of the GDPR "does not give the data subject the right to know, from among the information available to the controller (where applicable, through records or log data), the identity of the employee or employees who, under the authority and on the instructions of the controller, have consulted his or her personal data". In justifying his opinion, he pointed out that "the identity of individual employees who have handled the processing of customer data is particularly sensitive information from a security point of view, at least in certain economic sectors" (para. 76). Disclosure of employees' data could expose them to attempts by customers of the banking institution to exert pressure and influence. Nevertheless, the AG noted that if a data subject has reasonable doubts about the integrity or impartiality of an individual who has participated on behalf of the controller in the processing of his or her data, this could justify the interest of that customer in knowing the identity of the employee in order to exercise the customer's right to take an action against that employee (para. 78; nb. in the relevant case the data subject made his request, in particular, in order to clarify the reasons for his dismissal).

Pre-contractual information in multi-party settings: mobilizing legitimate interests to restrict consumer protection? (C-179/21 absoluts-bikes)

Today we come back to the judgment in C-179/21, absoluts-bikes, issued by the Court of Justice earlier this year. The decision may have passed under many radars, particularly as it was not preceded by the opinion of the Advocate-General. However, it is worth taking a closer look at it, as the judgment is not just interesting at the theoretical level, but also quite alarming in its implications. 

 

Facts of the case

 

The judgment was triggered by a dispute between two German traders offering consumer goods for sale online: the-trading-company and absoluts-bikes. According to the former, the latter failed to provide sufficient information about the products which it sold with help of Amazon. More specifically, the dispute concerned the listing of a pocket knife of the Swiss manufacturer Victorinox. In that listing, under the subheading labelled “Further technical information”, the consumers could find a link described as “Operating instructions”. The link led to a two-page information sheet, drafted by the knife’s manufacturer and referring, among others, to the ‘Victorinox guarantee’, describing the damage covered and the relevant time period. 

 

The claimant argued that the information provided by the defendant was not sufficiently specific. In particular, absoluts-bikes failed to inform the consumers that the manufacturer’s guarantee did not affect their statutory rights, neither did it describe the territorial scope of the guarantee. This – following the claimant – constituted an infringement of the German act on unfair competition. Since the relevant provisions had their background in the EU law, namely the Consumer Rights and Consumer Sales Directives, the national court decided to stay the proceedings and refer preliminary questions to the Court of Justice.

 

Guarantees in the Consumer Rights Directive

 

The Court began its analysis by turning to Directive 2011/83/EU on consumer rights and I will also limit this blog post to this part, as it is most developed and most consequential.

 

To recall, Article 6(1)(m) of the CRD requires traders to inform the consumers before concluding distance contracts, where applicable, about “the existence and the conditions of after sale customer assistance, after-sales services and commercial guarantees”. The relevant question in the present case was whether the information requirement arises “merely through the existence of that guarantee or whether it is only in certain circumstances that the trader is required to inform the consumer of the existence and conditions of such a guarantee” (para. 24).

 

The Court began its reasoning by recalling the purpose of pre-contractual information duties laid down in the Directive. The relevant provision, it remarked, “seeks to ensure the communication to consumers, before the conclusion of a contract, both of information concerning the contractual terms and the consequences of that conclusion, allowing consumers to decide whether they wish to be contractually bound to a trader, and of information necessary for proper performance of that contract and, in particular, for the exercise of their rights” (para. 26). It follows that the information duties aim to allow consumers to, firstly, make informed decisions about the contracts they wish to enter into and, secondly, effectively exercise their rights after contract conclusion.

 

These two main functions of information duties have previously been remarked upon in the scholarship and testify to the importance of mandatory disclosure beyond the moment of the contract conclusion. Indeed, the paradigm of consumer protection that focuses primarily on allowing consumers to make informed decisions has long been questioned in the light of behavioural findings showing that consumers may suffer from information overload and take account only of certain details communicated to them by the traders. Such details may nonetheless prove rather valuable at a later stage, e.g. when a problem related to the contract arises. This also seems to be the case for the producer’s guarantees, discussed in the present context.

 

Against this background, the attention paid by the Court to the two functions of information duties is be welcomed. Unfortunately, it is not subsequently translated to the remaining part of the judicial reasoning. Instead, the Court appears to focus primarily on the influence of pre-contractual disclosure on consumers’ decisions to enter into contracts, and views it through a particularly narrow lens, namely the lens of a possible deception. This lens, however, is not an obvious one in the context of the Consumer Rights Directive, but rather seems aligned with the perspective of (certain provisions of) the Unfair Commercial Practices Directive.

 

How then, did the Court proceed with its analysis? First, rather typically, it attempted the decode the meaning of Article 6(1)(m) of the CRD by looking at its wording, context and objectives. Referring to Article 2(14) of the CRD it concluded that the concept of a ‘commercial guarantee’, within the meaning of Directive 2011/83/EU, covers both commercial guarantees offered by traders (sellers) and by manufacturers. The trader is thus required, at least in certain circumstances, to provide the consumer with details concerning not only its own commercial guarantee, but also that of the manufacturer. So far, so good.

 

Turning to the objectives of the CRD the Court understandably referred to establishing “a high level of consumer protection”, also pointing to Article 169 TFEU and Article 38 of the Charter of Fundamental Rights (para. 38).  Having said that, however, the Court went on to emphasizing the need of ensuring “the right balance between a high level of consumer protection and the competitiveness of enterprises, while respecting the enterprise’s freedom to conduct a business”, as also set out in the Charter (para. 39). The Charter was thus invoked primarily to set the scene as one in which competing interests must be balanced.

 

Focusing on the interests of traders, the judgment concluded that an unconditional obligation to provide information about commercial guarantees, in all circumstances, “seems to be disproportionate, in particular in the economic context of the functioning of certain undertakings, in particular small undertakings” (para. 40). This seems rather uncontroversial: it would indeed be burdensome for traders to have to continuously collect and update information about any potential guarantees, when they are not the ones providing them, nor pointing at them in their offer. However, according to the Court, the balancing exercise should go even one extra step in favour of the traders. And interestingly, the Court did so by referring to the notion of legitimate consumer interests – and mobilizing it to the consumers’ disadvantage. 

 

To illustrate this point consider the following passage of the judgment:

In those circumstances, the weighing up of a high level of consumer protection and the competitiveness of enterprises, as set out in recital 4 of Directive 2011/83, must lead to the conclusion that the trader is required to provide the consumer with pre-contractual information on the manufacturer’s commercial guarantee only where the legitimate interest of the average consumer, who is reasonably well informed and reasonably observant and circumspect to a high level of protection must prevail in the light of his or her decision whether or not to enter into a contractual relationship with that trader. (para. 41)

As is apparent from the cited passage, the Court seems to forget about the double function of information duties referred to earlier in the judgment. This is additionally harsh for consumers considering the subsequent reasoning, whereby the Court considers a legitimate interest in being informed about producers’ guarantees to exist “where the trader makes the manufacturer’s commercial guarantee a central or decisive element of its offer” (para. 44). The latter is supposedly the case “where the trader expressly draws the consumer’s attention to the existence of a manufacturer’s commercial guarantee for sales or advertising purposes and, accordingly, to improve the competitiveness and attractiveness of its offer in comparison with its competitors’ offers” (para. 45). When this is not the case, the information on the guarantee is not likely to mislead the consumer, and thus their legitimate interest does not seem to exist.

 

In so doing, the Court essentially limits consumer protection not only to the pre-contractual phase and to the contested idea of informed decision-making, but also to the protection from being “misled by unclear, ambiguous or incomplete information”. As mentioned, that seems to rather be the domain of the Unfair Commercial Practices Directive, in which a link with the CRD is indeed established (cf. Article 7(5) UCPD). Moreover, the way in which the “average consumer” notion is constructed in the case at hand appears at least debatable. As a reference point for undertaking the balancing exercise the Court refers to the consumer, “who is reasonably well informed and reasonably observant and circumspect with respect to the different rights which he or she may exercise under a guarantee or to the real identity of the guarantor” (operative part). However, information about those very factors is precisely what the consumer should be equipped with by means of mandatory disclosure. Overall, it can be questioned, in my view, whether the reading adopted by the Court in the case at hand corresponds with the requirement of a “high level” of consumer protection.