Merry Christmas to all our readers!

All the best wishes for the upcoming festive season to our readers! Enjoy your Christmas shopping, delicious meals and family time. Be aware of your consumer rights, too!

Burden of proof of fulfilment of pre-contractual information duties on credit provider - CJEU judgment in Case C-449/13 CA Consumer Finance

Today, the Court of Justice of the EU delivered its judgment in the case of CA Consumer Finance v Bakkaus and Bonato, concerning the pre-contractual obligations of credit providers. For a summary of the facts of the case, I refer to an earlier blog post on AG Wahl's opinion in the case ('Evidence of disclosure in consumer cases').

In line with the AG's opinion, the Court places the burden of proof of having fulfilled pre-contractual information duties on the credit provider. Moreover, the credit provider cannot shift the burden of proof to the consumer through a standard term. 

The Court rules:

'1.      The provisions of Directive 2008/48/EC of the European Parliament and of the Council of 23 April 2008 on credit agreements for consumers and repealing Council Directive 87/102/EEC must be interpreted to the effect that:

–        first, they preclude national rules according to which the burden of proving the non-performance of the obligations laid down in Articles 5 and 8 of Directive 2008/48 lies with the consumer; and

–        secondly, they preclude a court from having to find that, as a result of a standard term, a consumer has acknowledged that the creditor’s pre-contractual obligations have been fully and correctly performed, with that term thereby resulting in a reversal of the burden of proving the performance of those obligations such as to undermine the effectiveness of the rights conferred by Directive 2008/48.

2.      Article 8(1) of Directive 2008/48 must be interpreted to the effect that, first, it does not preclude the consumer’s creditworthiness assessment from being carried out solely on the basis of information supplied by the consumer, provided that that information is sufficient and that mere declarations by the consumer are also accompanied by supporting evidence and, secondly, that it does not require the creditor to carry out systematic checks of the veracity of the information supplied by the consumer.

3.      Article 5(6) of Directive 2008/48 must be interpreted to the effect that, although it does not preclude a creditor from providing the consumer with adequate explanations before assessing the financial situation and the needs of that consumer, it may be that the assessment of the consumer’s creditworthiness means that the adequate explanations provided need to be adapted, and that those explanations must be communicated to the consumer in good time before the credit agreement is signed, without this, however, requiring a specific document to be drawn up.'

See also the CJEU's press release.

European scrutiny of data processing by natural persons - CJEU judgment in Case C-212/13 Ryneš

This morning, the Court of Justice of the EU handed down a judgment that has important implications for the processing of personal data by private persons. In the Czech case of Ryneš v Úřad pro ochranu osobních údajů the Court established that the European Data Protection Directive applies to a video recording made with a surveillance camera installed by a person on his family home and directed towards the public footpath. It thus clarified to what extent horizontal legal relationships among natural persons fall within the sphere of scrutiny of the Directive.

The case concerned Mr Ryneš, whose family and home had been subject to attacks by unknown individuals between 2005 to 2007. In response to the attacks, he installed a surveillance camera under the eaves of his home, which recorded the entrance to his home, the public footpath and the entrance to the house opposite. A video recording made it possible for the police to identify two people who attacked Ryneš's home in October 2007, breaking a window by a shot from a catapult. In the criminal proceedings against the two suspects the question arose whether the Data Protection Directive applied to Ryneš's use of the camera. This question is of relevance for private legal relationships, since the 'processing of data in the course of a purely personal or household activity' is excluded from the scope of the Directive and, therefore, not subject to the rules on data protection laid down in this instrument.

The CJEU reaches the conclusion that Mr Ryneš's use of the surveillance camera cannot be included in the exemption and, therefore, falls within the scope of the Directive:

'The second indent of Article 3(2) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the operation of a camera system, as a result of which a video recording of people is stored on a continuous recording device such as a hard disk drive, installed by an individual on his family home for the purposes of protecting the property, health and life of the home owners, but which also monitors a public space, does not amount to the processing of data in the course of a purely personal or household activity, for the purposes of that provision.'

According to the Court, the use of the camera does not qualify as 'processing of data in the course of a purely personal or household activity', since this provision should be narrowly interpreted:

'27. As is clear from Article 1 of that directive and recital 10 thereto, Directive 95/46 is intended to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data (see Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 66)

28. In that connection, it should be noted that, according to settled case-law, the protection of the fundamental right to private life guaranteed under Article 7 of the Charter of Fundamental Rights of the European Union (‘the Charter’) requires that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary (see IPI, C‑473/12, EU:C:2013:715, paragraph 39, and Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238, paragraph 52).

29. Since the provisions of Directive 95/46, in so far as they govern the processing of personal data liable to infringe fundamental freedoms, in particular the right to privacy, must necessarily be interpreted in the light of the fundamental rights set out in the Charter (see Google Spain and Google, EU:C:2014:317, paragraph 68), the exception provided for in the second indent of Article 3(2) of that directive must be narrowly construed.'

Natural persons can, therefore, not easily escape scrutiny of data processing under the Directive. Only such activities as correspondence or keeping an address book are exempted. Camera surveillance, insofar as it, even partially, covers a public space is 'directed outwards from the private setting of the person processing the data in that manner' and is therefore not excluded from the Directive's scope.

Importantly, the Court adds that the national court, when assessing the data processing, should take into account legitimate interests pursued by the data controller (in casu, Mr Ryneš) in protecting the property, health and life of his family and himself. Thus, it is up to the national court to balance the interests of the parties within the legal framework set out by the Data Protection Directive. An interesting example of both Europeanisation and constitutionalisation of private legal relationships.

See also AG Jääskinen's Opinion in the case and the CJEU's press release.