It is your right to know the actual identity of recipients to whom your personal data have been or will be disclosed (C-154/21 Österreichische Post)

The General Data Protection Regulation (GDPR) provides individuals (data subjects) with a number of rights. These are listed in Chapter III of the GDPR and include, inter alia, the right to be informed of the processing of personal data (Articles 13 and 14 of the GDPR), right of access (Article 15 of the GDPR), right to rectification (Article 16 of the GDPR), right to erasure (Article 17 of the GDPR) etc. In mid-January 2023, the Court of Justice in Case C-154/21 Österreichische Post answered a question concerning one of those rights, namely the right of access.

As stated in Article 15(1) of the GDPR „the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: […]

(c)  the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; […].

The dispute concerned the fact that the data subject requested from the controller the actual identity of the recipients to whom he was disclosing his personal data. However, the controller did not reveal the identity of the recipients, but informed the data subject of the "categories of recipients", indicating that they were „customers, including advertisers trading via mail order and stationary outlets, IT companies, mailing list providers and associations such as charitable organisations, non-governmental organisations (NGOs) or political parties” (para. 20). 

Indeed, doubts arise when applying Article 15(1) of the GDPR in practice. The main question is whether it is necessary to inform about the particular recipients of the data, or would it be enough to notice about general categories of these recipients? Similar doubts arise in the context of Articles 13(1e) and 14(1e) of the GDPR, which oblige the controller, as part of its information obligations performed at the time of data collection, to inform about "the recipients or categories of recipients of the personal data, if any".

In the Court's view, Article 15(1) of the GDPR gives the right to be informed about the specific recipients of personal data and thus to know their actual identity. The Court cites several arguments in this regard:

(1) The data subjects should be guaranteed the right to know and be informed about the processing of their personal data, in particular about the recipients to whom the data are made available. This is emphasised in Recital 63 of the GDPR, which, nota bene, does not refer to the right to information about "categories of recipients of data", but generally to the right to information about "recipients of personal data" (para. 33).

(2) The controller must process personal data in accordance with the principle of transparency, which from the data subject's perspective means that information on how his or her personal data is processed should be easily accessible and comprehensible (para. 35).

(3) „Article 15 of the GDPR lays down a genuine right of access for the data subject, with the result that the data subject must have the option of obtaining either information about the specific recipients to whom the data have been or will be disclosed, where possible, or information about the categories of recipient” (para. 36).

(4) The right of access is often exercised to verify the accuracy of the data or the lawfulness of the processing. In this sense, the right of access frequently determines further actions of the data subject, i.e. the exercise of other rights under the GDPR, e.g. the right to erasure or the right to object to processing. Therefore, the complete and diligent exercise of the right of access is essential to guarantee the effectiveness of the data subject's rights (para. 38).

However, the Court reminded that the right to the protection of personal data is not an absolute right and is subject to limitations. The controller, despite an express request by the data subject, does not have to provide information on the identity of the recipients of the data if "in specific circumstances it is not possible to provide information on specific recipients" (e.g. when it is not possible to identify those recipients - para. 51), and furthermore when the data subject's request is unjustified or excessive in nature [as stated in Article 12(5b) GDPR].

In practice, this means that each request will have to be carefully analysed. It is certainly easier for controllers to provide general information on the categories of recipients rather than precise information on the identity of the recipients. For controllers with large datasets, who share data with many entities and receive many requests of data access, a detailed examination of data flows may be cumbersome. What the judgment lacks, in my view, is a clarification of what the 'special circumstances' that would justify a refusal to disclose the identity of data recipients could consist of. 

It appears from the CJ's reasoning that such a special circumstance may be the lack of knowledge of the future recipients (para. 48). The question is whether such a circumstance could be the difficulty of stating all data recipients due to their large number. In practice, this is a common problem for controllers. Yet, such an interpretation does not seem to be acceptable. It can be said that the Court has spread a protective umbrella over data subjects, obliging controllers to be more accurate, transparent in their processing and to provide reliable and complete information to data subjects. This is a good signal for data subjects, especially consumers of various online services, as the judgment provides clear grounds for demanding detailed information about the processing of personal data. 

Evaluating the unfairness of immediate repayment clauses in loan contracts: the CJEU in Case C-600/21 (QE v Caisse régionale de Crédit mutuel)

Case C-600/21

Facts 

In 2006, QE was granted a loan to purchase immovable property from Caisse régionale de Crédit mutuel de Loire-Atlantique et du Centre Ouest to be repaid over 20 years. The contract established that Caisse was entitled to accelerated and immediate repayment of the outstanding amount in case of a delay in the payment of more than 30 days by QE. According to the agreement, this repayment could be triggered without the need for the bank to present a formal written demand. QE could however ‘request an amendment to the payment schedule’ to avoid non-payment (para 7). In late January 2013, the bank triggered accelerated repayment, without any formal written demand, when QE did not pay the instalments of December 2012 and January 2013. In 2015, QE’s home was repossessed by Caisse régionale and the former brought an action before the court during the enforcement proceedings lamenting irregularities of the report of repossession. In 2019, the Court of Appeals of Versailles, rejecting QE’s claim, denied that the term establishing that the accelerated repayment procedure did not require a formal written demand was unfair in light of the criteria established in CJEU’s ruling Banco Primus. 

Questions 

The referring Court de cassation presented five questions, three of which are most relevant. It asked whether: .

1. Under Articles 3(1) and 4 of Directive 93/13/EEC (UCTD) it is necessary to have a formal written demand even when the contract expressly excluded it 
2. Under Banco Primus the 30 days of delay can be considered serious non-compliance, in light of the term and amount of the loan 
3. The same provisions prohibit the accelerated repayment clause when national law ‘which requires a formal written demand (…) permits the parties to dispense with that step, in which case reasonable notice is required’ (para 18) 

Ruling 

It shall be recalled that Banco Primus (at 66) laid down four non-exhaustive criteria to determine if ‘a term in a contract causes a significant imbalance to the detriment of the consumer’ (para 29 of QE). The national court must consider whether: 

1. The right of the bank to request the totality of the loan depends on whether the non-compliance by the consumer concerns an obligation of essential importance within the contract 

2. The right ‘is provided for in cases in which such non-compliance is sufficiently serious in the light of the term and amount of the loan’ (para 29) 

3. The right, absent a specific contractual provision, derogates from the ordinary law 4. national law establishes ‘adequate and effective means’ which enable the consumer to ‘remedy the effects of the loan being called in’ (para 29). 

Because in Banco Primus the Court also ruled that Article 3(1) and 4 of UCTD must be interpreted as meaning that the unfairness of a term must be assessed considering all the circumstances which surround the conclusion of the contract, the criteria cannot be interpreted as being either cumulative or alternative. 

Coming to the substance of the ruling, the Court answers by observing that – as it is evident from Banco Primus’ second criterion – determining the seriousness of the non-compliance depends on the overall evaluation of the terms and amount of the specific loan at issue. Since a debtor’s failure to comply with her obligation needs to be evaluated in the context of her contract, Articles 3(1) and 4 of the UCTD must be interpreted as meaning that a delay of more than 30 days in the payment ‘may, in principle (…) constitute, in itself, sufficiently serious non-compliance’ (para 41). 

The first and third questions of the French supreme court then concerned whether Articles 3(1) and 4 of the UCTD must be interpreted as preventing the parties from inserting into their contract a term which allows automatic accelerated repayment once a certain period of time is over. The court asked, in essence, whether the term would be subjected and would fail the unfairness test. The CJEU first noted that the unfairness test aims to verify whether there exists a significant imbalance in the parties’ rights and obligations to the detriment of the consumer and that such test applies whenever a term has not been individually negotiated. Further, because, pursuant to Article 4(2), a term would escape the unfairness review exclusively if considered related to the main subject matter of the contract, the question is whether the term under analysis does relate to it or can be rather considered ancillary. The CJEU noted that a term relates to the main subject matter of an agreement whenever it lays down the essential obligations of the contract and thus characterises it. While this evaluation is for the referring court to carry out, the Court also observed that the clause at issue does not appear to fall within that definition. The answer to the questions is therefore that the provisions must be interpreted as precluding the parties from inserting such a term wherever the term a) does not concern the essential obligations of the contract; b) has not been individually negotiated; c) creates an imbalance to the detriment of the consumer. 

With QE v Caisse régionale the CJEU essentially reiterates those which are the fundamental principles related to the so called ‘unfairness test’. Relevantly, it provided guidance as to the interpretation that a national court should give of what constitutes an ‘essential obligation’ in a loan contract.

We read *that* preliminary ruling request so you don't have to

Dear readers, 

as many others, I was mesmerised yesterday when a twitter user shared a preliminary reference (Italian version here - the English translation contains some mistakes so it's not super reliable right now) from the Italian Consiglio di Stato (that is the highest court in administrative matters, competent for final decisions on actions of the Italian Competition and consumer authority) bluntly asking the CJEU to renege on the UCPD definition of "average consumer". 

This is the bit from the reference that almost got viral: 

Should the concept of ‘average consumer’ referred to in Directive 2005/29/EC, understood as a consumer who is reasonably well informed and reasonably observant and circumspect — given that it is vague and flexible — be worded according to the best science and experience and thus refer not only to the classic concept of homo economicus, but also to the findings of the latest theories on bounded rationality, which have shown how people often act by limiting the information they need through decisions which appear ‘irrational’ when compared with those that would be taken by a hypothetically observant and circumspect person; findings that impose a need for greater consumer protection where — as is increasingly the case in modern market dynamics — there is a risk of cognitive influence?

Now, of course one could wonder whether the CJEU would want to venture into theoretical debates on appropriate consumer images. Utrecht colleague Catalina Goanta has suggested that the Court could answer the question in typical CJEU style, by referring to the margin of appreciation for national courts (+ statement that average consumer is not a statistical test) in the Directive's recital 18 and somehow quoting own case-law. 

One could also expect the Court to go around the question, depending on the underlying issue. What was it, then? Based on the preliminary reference, which contains four more questions, it seems that the following has happened: 

- the authority has ordered Compass Banca, a credit institution offering jointly some consumer credit and an unrelated insurance, to grant consumers a 7-day "cooling off period" between signing the two contracts;

- this on the assumption/theory that selling the two products together would make consumers falsely believe that entering the insurance contract is a mandatory requirement for obtaining the desired credit;

- the Authority thus considers the practice as always unfair because, in essence, it appears to exploit a cognitive bias that the Authority has connected to "framing" - whereby the presentation of a product alongside a different one gives the consumer a different impression compared to a situation in which the product would be offered on its own (see question 2);  

- it seems that in this case the Authority has claimed that the bundling as such would be an aggressive practice, which the defendant company must have challenged, claiming that the contracts being signed at the same time should be consider as unproblematic considered that consumers get the express opportunity to withdraw from the insurance contract or confirm their choice during a devoted phone call (see the authority decision - in Italian - here); the defendant company's actions (hinted to at question 4) to limit the potential effects of the practice were not considered sufficient commitments to prevent the issuance of a fine;

- hence the Consiglio di Stato seems unsure whether the prohibition needs to be seen as a move akin to "blacklisting" the bundling practice, without considering whether the concrete practice at hand should be considered aggressive, or whether indeed the specific form of bundling - combining insurance and credit - can be considered as so bad that it would be for the company concerned to show that it does not concretely affect the autonomy of the average consumer (see question 5). Should it be seen as blacklisting, the Authority would have gone beyond the space left to national authorities under the Directive's maximum harmonisation standard. 

Looking at the case, it seems that there could be several ways for the CJEU to answer the question without entering into the specifics of the debate hinted to in the first preliminary question that caught all our attention yesterday - also depending on the submissions by the parties during the preliminary ruling proceedings. 

Concern with the overall "environment" in which consumers make decisions concerning, in particular, distance credit contracts is something that is really not specific to the Italian AGCM - the Dutch financial markets authority for instance has been for years advocating for a responsible "choice environment" in the provision of credit to consumers (see eg here), with a specific focus on framing effects. 

At the same time, should we wish for the CJEU to embrace "bounded rationality" as "best science" and "most recent insights"? Current debates in consumer psychology and social sciences seem to have already gone far beyond the idea of bounded rationality to account not only for cognitive limitations but also for social constraints, habits, motivations... not to mention, as Martijn Hesselink has observed in passing, of reinforcing the idea that when no obvious exploitation of cognitive bias is at stake, "homo oeconomicus" could actually be a viable standard. 

Opening 2023 in style: CJEU C‑395/21, transparency of hourly fees in contracts for legal assistance

Dear readers, 

you may have noticed this already if your social media feed looks anything like mine: the CJEU has issued a decision on the transparency of lawyers' fee under Directive 93/13, which is all but sure to make us talk in the coming times. While the most remarkable element in the decision concerns the application of transparency to a new - and potentially quite ripe for expansion! - set of circumstances, the decision also further testifies to the CJEU's struggle to deal with its own strict approach to the consequences of unfairness under the Directive. 

So, to start with the facts: the case arose between a Lithuanian consumer and their lawyer and concerned several contracts concluded between the two. Each of the contracts included a relatively unsophisticated remuneration clause, according to which the client stood to pay 100 EUR per hour of work by the lawyer. 

After several years and a series of partial payments, it appears that a dispute had arisen between lawyer and client as to the amount of the overall fee - with the former asking for roughly double, in total, of what the client had paid until then. This controversy led to a court case, during which successive Lithuanian courts found the remuneration term unfair for its failure to provide the consumer sufficient clarity on the likely significance of their financial commitment. To make things worse for the lawyer, Lithuanian law (article 6.2284(6) of the Civil Code)  has implemented the transparency requirement "the German way", that is by specifying that terms can be deemed unfair for the sole fact that they are not transparent. The Lithuanian supreme court, thus, turned to the CJEU to know, in particular: a) whether indeed a term only indicating an hourly fee should be considered as lacking transparency; b) whether indeed they should follow the letter of Lithuanian law and consider that the term should be invalidated; c) what the consequences should be in such case, given the fact that the contract would obviously not stand without the unfair term. [other questions need not be addressed here]

As to the first question, which is also the most interesting, the Court [para 41] ]had to acknowledge that identifying and indicating with certainty what the final cost of legal services will be poses serious hurdles and cannot be expected of lawyers (interesting to think: what other professions could this apply to and how?); at the same time, it concludes, there can be several ways for the professional to provide the consumer, before concluding the contract, ways to estimate future expenses or anyway know how they can expect to be able to keep them under their purview. A mere indication of an hourly fee, without information as to the rough expected amount of hours to be invested or as to ways in which the consumer will be kept informed of the hours worked and fees due, does not comply with the transparency requirement. This is, according to the Court, necessary in order to allow the consumer to take a prudent decision. [paras 44-45]

As to the second question, it should surprise no-one that indeed, opting for a higher level of consumer protection is expressly allowed under the Directive and hence – while the Directive itself does not require terms lacking transparency to be declared unfair, it certainly allows for this consequence when so established under national law. [see paras 51-52]. This means that the court did not elaborate, in this case, on how courts in systems that do notautomatically connect lack of transparency and unfairness would have to go and investigate whether the term caused a significant imbalance, contrary to good faith, under the Directive’s article 3. 

As to the third question, finally, the Court reiterated its standpoints articulated in a vast (if complex) body of case-law: an unfair contract must be disapplied; when a contract cannot survive without the unfair term, the concerned court must consider whether the contract’s ocverall invalidity would cause a significant disadvantage for the consumer. Only in that case, the term can be replaced by “a supplementary provision of national law or a provision of national law applied by mutual agreement of the parties to those contracts. ”The provision in question, however, must be “intended to apply specifically to contracts concluded between a seller or supplier and a consumer and […] not so general in scope that its application would be tantamount to allowing the national court, in essence, to set, on the basis of its own estimate, the remuneration due for the services provided” [para 63]. Otherwise, the court says, it is ultimately to be accepted that the contract may be invalidated, even though that may entail some “legal uncertainty” – which I understand to open to an action for unjustified enrichment? In the case at hand, it appears that the national court may be able to identify a suitable provision, which leads me to close with an appeal to our Lithuanian readers: please keep an eye on this and let us know what the final bill was!

Trivia and curiosity aside, it seems to me (but I may be biased as I have argued it elsewhere) that the decision marks a new step towards transparency as determinacy or at least some constraint on uncertainty and arbitrariness. This move is enabled in particular by the Court’s relatively nonchalant use of parameters originally articulated in the specific context of variation clauses (Invitel, RWE, foreign currency loans etc) outside of their original context – see for instance para 37 in the decision, where the court recalls how transparency entails that the contract (in context) must set out transparently “the specific functioning of the mechanism to which the relevant term relate” – which in those old cases were all variation mechanisms, not at hand in this case.

This my first take of course – I must admit to not having checked AG Szpunar’s opinion yet, so there may be more to be said as to the first answer has come about, also in particular with reference to this last point. To be continued!