Consumer organisations may bring proceedings to defend collective interests of consumers based on the GDPR, if national law so states: AG opinion in C-319/20, Facebook Ireland

Yesterday the Advocate-General Richard de la Tour delivered his opinion in case C-319/20, Facebook Ireland, considering whether consumer organisations can have a standing to bring judicial proceedings against infringements of the General Data Protection Regulation 2016/679, independently of actual infringements of data subjects' rights. Arguably, the importance of the case goes beyond the procedural dimension it involves (not least due to Directive 2020/1828 on representative actions which elaborates on the enforcement framework, including for the GDPR). In the expert report published by BEUC earlier this year, the case was highlighted as a possible "game changer" concerning the relation between consumer and data protection law (see also: New study on consumer protection in the digital age...). The direction of the AG's opinion is likely to be welcomed in the consumer protection community.

Facts of the case

The case involves a number of data processing practices identified by the German federation of consumer organisations (vzvb) on the Facebook platform back in 2012. Most notably, the federation argued that information about the processing of personal data in connection with third-party apps available in Facebook's App Centre failed to meet the appliable requirements. German courts generally agreed that the vzvb had a point on the merits. However, following the entry into force of the GDPR a doubt was raised if the federation continued to have standing in cases that involved violations of data subjects' rights, independently of specific infringements.

Opinion of the AG 

Standing of consumer organisations

The problem sounds familiar? That's because it is. A similar question was considered by the CJEU in 2019, in the context of the previously applicable Data Protection Directive (FashionID case). Back then the Court rejected an argument that consumer organisations should not be entitled to bring claims under data protection rules. According to the AG, this has not changed after the entry into force of the GDPR; quite the contrary, the regulation explicitly provides for collective redress and nothing in Article 80(2) of the act implies that an organisation can only bring proceedings if particular persons affected by the processing have been identified.

The conclusion reached by the AG in respect of the GDPR appears to be well-founded. The reasoning relies on both literal, systematic and teleological interpretation. The AG refers both to the definition of parties entitled to bring representative actions under Article 80 of the GDPR. According to the AG, that definition extends to "all entities which pursue an objective in the public interest that is connected with the protection of personal data", which also applies to consumer protection associations (para. 61). As regards further conditions for bringing representative actions, the AG found it sufficient for an entity to demonstrate "an infringement of the provisions of Regulation 2016/679 designed to protect the subjective rights of data subjects", without the necessity to verify if the rights of one or more specific persons have been infringed (para. 63). In addition, arguments concerning the effectiveness of the GDPR, its consistency with Directive 2020/1828, and a high level of protection of personal data have been cited.

Two broader points

Aside from the above, two further aspects of the opinion merit attention. Firstly, the AG considers the "particular characteristics" of the GDPR as a regulation and connects it to discussions on full harmonisation. The AG notes that while the GDPR "seems, at first sight, to tend towards full harmonisation ... the truth is more complex" (paras. 50-51). According to the AG:

"[T]he legal basis of Regulation 2016/679, namely Article 16 TFEU, precludes the view that in adopting that regulation the European Union would have pre-empted all the ramifications which the protection of personal data may have in other areas relating, in particular, to employment law, competition law or even consumer law, by depriving Member States of the possibility of adopting specific rules in those areas, more or less independently, depending on whether the area in question is governed by EU law. In that sense, although the protection of personal data is by nature cross-sectoral, the harmonisation implemented by Regulation 2016/679 is limited to the aspects specifically covered by that regulation in that area. Apart from those aspects, the Member States remain free to legislate, provided that they do not undermine the content and the objectives of that regulation." (para. 51)

One can wonder to what extent the above finding depends on the legal basis chosen. This is particularly important in the context of the ongoing legislative developments at EU level which equally take form of regulations, but are also based on Article 114 TFUE. A prominent case in point is the proposed Artificial Intelligence Act and the more recent proposal on political targeting. Arguably, doubts about the Member States' discretion can best be resolved by way of careful drafting that makes adequate use of 'opening clauses'.

Secondly, the opinion touches upon the broader relationship between consumer and data protection law. The AG admits that "unlike ... in the United States of America, in EU law the regulations relating to unfair commercial practices and those relating to the protection of personal data have developed separately" and "are thus the subject of different regulatory frameworks" (para. 79). The opinion further observes that unlike EU consumer law, the GDPR "is not based on a consumerist concept of the protection of natural persons in relation to the processing of personal data, but on the concept that that protection is ... a fundamental right" (para 82). A number of important connections between consumer and data protection law are nonetheless recognized, as illustrated below:

"[T]here is some interaction between the two areas, so that actions falling within the framework of the regulations relating to the protection of personal data may, at the same time and indirectly, contribute to putting an end to an unfair commercial practice. The opposite is also true." (para. 80)  

"[I]n the age of the digital economy, data subjects often have the capacity of consumers. It is for that reason that the rules designed to protect consumers are often relied on to ensure that consumers are protected against a processing of their personal data that is contrary to the provisions of Regulation 2016/679." (para. 83)

and finally

[T]here may be an overlap between the representative action provided for in Article 80(2) of Regulation 2016/679 and that provided for in Directive 2020/1828 in order to obtain injunctive relief when ‘data subjects’, within the meaning of that regulation, also have the capacity of ‘consumer’, within the meaning of Article 3(1) of that directive. I see there the sign of complementarity and convergence of the law relating to the protection of personal data with other areas of law, such as consumer law and competition law. With the adoption of that directive, the EU legislature went even further and expressly linked the protection of the collective interests of consumers with compliance with Regulation 2016/679. The effective application of the rules contained in that regulation cannot but be strengthened as a result." (para. 83)

Concluding thought

Overall, the AG not only speaks out in favour of consumer organisations' standing in cases involving data protection violations, but also supports a close relationship between consumer and data protection law. Arguably, both fields can also be aligned conceptually and, indeed, complement each other in the attainment of a high level of consumer and data protection. A judgment endorsing the AG's point of view would thus be very welcome.

Consumer organisations join forces against 'no show' practices by air carriers

A recent communication from BEUC informs about a coordinated initiative by several national consumer organisations directed against the so-called 'no show' clauses used by air carriers. Pursuant to these clauses air carriers are authorised to cancel complete multi-flight bookings if passengers miss parts of their journey. This can lead to cancellations of connecting flights or return flights in round-trip itineraries (already paid for by the passengers). According to BEUC, such clauses are contrary to national laws implementing Directive 93/13/EEC on unfair terms. Arguably, this interpretation has already found support from several national courts (e.g. in Germany, Spain and Austria).

Two aspects of this development are worth highlighting.

Firstly, it is not the first time 'no show' clauses have been brought to public attention. Most notably, partial ban of 'no show' clauses in contracts between air carriers and passenger (i.e. not just consumers) was envisaged in the proposed reform of Regulation 261/2004, put forward in 2013. The proposal, however, got stuck in the legislative pipeline. BEUC is now calling on the Commission to revisit the matter.

Noteworthy are furthermore the two types of strategies pursued by consumer organisations. On the one hand, there are measures taken directly against the companies concerned (formal requests to cease the practice, (threats of) taking legal action). Besides the abovementioned proceedings in Germany, Spain and Austria (interestingly, no requests for a preliminary ruling as far as I can see), this has reportedly been the case in Greece, Malta, Belgium, Denmark and the UK. On the other hand, there are complaints to national consumer authorities and calls for a CPC action.

It will be interesting to see whether and if so, which of these different avenues will prove successful. Equally relevant are, of course, the possible legislative developments at the EU level, including as part of the 2018 'New Deal for Consumers' package. It is far from certain, however, whether EU-wide proposals on collective redress will not suffer the same fate as the 2013 passenger rights reform. For the time being, consumers and consumer organisations have to make do with existing enforcement mix.

Google tracks every step you take

Norwegian Consumer Council and seven European consumer organisations have filed a complaint today against Google, arguing that Google uses deceptive design and misleading information in order to acquire users' consent to constant tracking (New study: Google manipulates users into constant tracking). How would the users be tracked? Well, if you have an Android phone or use Google accounts on other devices, then it is likely that you are one of the victims of constant tracking, as Google accounts have 'location history' and 'web&app activity' integrated in their settings. You may have been prompted/manipulated to switch on such location history, without having realised that. Having read the above information you may think that Google has 'simply' access to your GPS data. Would you know though how detailed this data is (incl. determining which floor you are at in a particular building, which room in the house) and that it may be linked to other information, e.g., your online search results? The combined data may, of course, then be used for targeted advertising, increasing its effectiveness. Would you know how to switch it off and how to avoid having it be switched on again? If this short post does not make you want to check your phone and its settings, maybe you should look up the whole report on the study of Google tracking practices that has been published: Every step you take.

EU Commission on its way to place barriers to the ban of harmful substances from cosmetics

On 22^nd June, the EU Standing Committee on Cosmetic Products met to discuss amendments on Regulation (EC) No 1223/2009 of the European Parliament and of the Council on cosmetic products. The Commission is required to submit its proposed measures to the Committee for scrutiny, as per art.32 of Regulation 1223/2009.

Regulation No 1223/2009 is designed to harmonise the rules as well as terminology on cosmetics in the EU with the double objective of promoting the internal market while ensuring a high level of protection of human health. The Regulation has been revised multiple times; what are the changes brought by this draft regulation and what dangers do they hide for consumers?

One of the proposed changes is on the use of carcinogenic, mutagenic or toxic for reproduction (CMR) substances. CMR substances are highly toxic and present lasting dangers for human health (for more info on CMR see OSH wiki). Relaxing the protection against CMR substances can have profoundly negative effects on the health of consumers, especially in the case of cosmetics which are everyday widely used products.

Art 15 of Regulation 1223/2009 prohibits the use of substances classified as CMR, as those are listed in ANNEX VI of the Regulation with some exceptions, as for example when there is no other suitable alternative or when the substance complies with food safety requirements. As stated in minutes of the Working Group on Cosmetic Products, the Commission now considers that adding a new substance to the CMR list requires amendment of the annex of the regulation via a new act. This presents a departure from the previous position where the ban was automatic as soon as the substance was placed on the list by the European Chemicals Agency.

The opinion of the Committee on the issue is not yet made available; yet BEUC in one of its press releases has drawn attention to the matter and the potential harm for consumers from such a reform. It is not an easy task to balance between innovation and protection of human health, hopefully the EU Commission will in this case demonstrate its commitment to maintaining a high level of protection by not allowing delays in the banning of harmful substances.

The Netherlands helping other Europeans out with its collective action tool

In the context of consumer claims being lined up against VW, the Dutch WCAM - Collective Settlement Act - is attracting the attention of consumer lawyers Europe-wide. With the help of this instrument a consumer representative can negotiate an out-of court settlement with a company regarding widespread damage. Afterwards this settlement can be declared binding by the court.

Group litigation is a scarce phenomenon in Europe. Therefore, not only Austria but also Germany are discussing to litigate with the help of the WCAM in the Netherlands. Such a stretch is legally possible. Already in a previous case the WCAM has served without many Dutch citizens actually being affected by the harmful behaviour: see for details the Converium litigation in Dutch and English.

It remains to be seen if these moves give sufficient incentives to other European governments to reform the national systems for collective redress.

What will the future bring? The new consumer programme 2014 - 2020

With some delay, the EU announced its priorities in consumer law for the period from 1st January 2014 to 31st December 2020.  The consumer programme takes the form of a Regulation based on Art 169 TFEU and explains how the Union will complement, support and monitor the Member States' policies. This is mainly achieved through financing actions taken either by national authorities or thirds, such as consumer organisations, e.g..

The consumer programme details four main objectives (Art 3): product safety (I), consumer information and education, and support of consumer organisations (II), rights and redress (III) and enforcement (IV). The short Regulation (only 19 articles) as well as its Annexes elaborate these objectives and the types of actions to be taken. Although not directly granting rights to consumers, the Regulation is an important indicator of the EU's current view on and future priorities in consumer law.  

The ball remains in the Member State's court - CJEU judgment in Case C-470/12 Pohotovost'

More news from the CJEU today, as the Court handed down its judgment in the Pohotovost' case. The question at issue here concerned the (im)possibility for a consumer organisation to join in a case regarding the enforcement of an arbitration award against an individual consumer. Please refer to our earlier post on Advocate-General Wahl's opinion in this case for a more detailed summary of the facts ('Who decides who decides').

The CJEU follows the AG in ruling that the Slovak procedural law applicable to the case does not infringe upon EU law:

'Council Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts, in particular Articles 6(1), 7(1) and 8 of that directive, read in conjunction with Articles 38 and 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as not precluding national legislation which does not allow a consumer protection association to intervene in support of a consumer in proceedings for enforcement, against the latter, of a final arbitration award.'

The Court bases its decision on the fact that the Unfair Terms Directive does not cover the issue of consumer organisations' participation in enforcement proceedings and that, therefore, it is up to national legal systems to provide rules on this, taking into account the principles of equivalence and effectiveness. The principle of equivalence is not infringed upon, as Slovak law does neither allow a consumer organisation to join in enforcement proceedings that are governed by national law nor those involving EU law. The principle of effectiveness, moreover, is not breached, since the Slovak law does not make the application of EU law impossible or excessively difficult by excluding consumer organisations from enforcement proceedings. The Court finds no points of reference in Articles 38 (consumer protection) and 47 (right to an effective remedy) of the EU Charter of Fundamental Rights to alter that conclusion.

Who decides who decides - Opinion of AG Wahl in Case C-470/12 Pohotovost'

What position do consumer organisations hold under EU law when it comes to assisting consumers in pursuing their claims in court? While the Court of Justice of the EU (CJEU) recently clarified the conditions under which a consumer organisation may bring an independent claim regarding unfair contract terms (ACICL v. ASE), a case that is currently pending concerns the possibilities for an organisation to join in a procedure regarding the enforcement of an arbitration award. Today, Advocate-General Wahl handed down his Opinion in this case, C-470/12 Pohotovost'.

The case concerns a Slovak credit supplier, Pohotovost', who had concluded a consumer credit contract with a certain client. Subsequently, as a result of arbitration proceedings concerning this contract, an arbitration tribunal ordered the consumer/client to pay the credit company a certain amount of money. The arbitration award became final and execution proceedings followed. At this stage, consumer organisation HOOS asked to be added to the proceedings, in particular in order to challenge the impartiality of the bailiff involved in the case, who earlier had been employed by Pohotovost'. 

Slovak procedural law prevents the consumer organisation from joining the proceedings. The referring court is in doubt as to the validity of this national rule of procedure in light of the consumer protection offered by EU Directive 93/13 jo. Articles 38 and 47 of the EU Charter of Fundamental Rights (consumer protection and the right to an effective remedy).

According to AG Wahl, EU law does not preclude a provision of national law that prevents a consumer organisation from joining in enforcement proceedings. At the same time, the relevant provisions of EU law do not stand in the way of a judge allowing a consumer organisation to join such proceedings. In other words, in the AG's opinion the question referred to the CJEU is neither directly nor indirectly governed by EU law: Directive 93/13 does not address the role of consumer organisations joining in individual proceedings, nor does it prohibit Member States from adopting a higher level of consumer protection by allowing judges to accept consumer organisations being added to such proceedings. Articles 38 and 47 of the Charter do not lead to a different conclusion, since they do not support an interpretation of the Directive in the sense that it would lay down a right for consumer organisations to join in individual enforcement proceedings.

In sum, whereas this opinion does not promote a further extension of EU legislative competences (and thus respects the procedural autonomy of the Member States), it does offer a clear illustration of the process of constitutionalisation of EU consumer law (visible in the growing number of references to the Charter in preliminary reference procedures).