Merry Christmas!

Merry Christmas Dear Readers!

We hope you are enjoying this festive time with your families and/or friends, as much as the restrictions in the place you live at, allow for this. 

Stay safe and let us hope for the 2021 to be nicer to all of us!

Who is on the nice or naughty list?: Digital Markets Act and Digital Services Act

European Commission published today two potentially game-changing proposals for the digital market: Digital Services Act (see here) and Digital Markets Act (see here). For those of our readers who have not heard about the works on the proposals for these two regulations, the Digital Services Act aims to 'comprehensively' regulate the obligations of digital service providers towards users of their services as well as enforcement authorities, whilst the Digital Markets Act sets out the rules for the digital market, e.g. defining its largest participants as so-called 'gatekeepers' and providing for additional obligations for them. These proposals will now be discussed further by the European Parliament and the Council. Below we provide a summary of the proposals.

Digital Markets Act

The advantage of the Digital Markets Act for consumers lies definitely in the environment this regulation aims to promote: more competitive, encouraging consumers to seek for, access and conclude the best possible deal, not locking them into digital services contracts they conclude. The gatekeepers to the market are companies located anywhere in the world, provided they offer their core platform services to business users in the EU or end users in the EU (Article 1(2)). The end users do not have to be consumers (Article 2(16)) as they may be legal persons, as well as natural persons.

Core platform services could be (Article 2(2)): online intermediation services, online search engines, online social networking services, vide-sharing platform services, number-independent interpersonal communication services, operating systems, cloud computing services, advertising services. 

Gatekeepers are defined (Article 3) as providers of core platform services who have a significant impact on the internal market (e.g. annual EEA turnover exceeds EUR 6.5 billion in the last 3 financial years and they provide the core platform service in min 3 Member States), operate a core platform service which serves as an important gateway for business users to reach end users (e.g. more than 45 million monthly active end users located in the EU and more than 10.000 yearly active business users established in the EU), and enjoy an entrenched and durable position in its operations (or could do so) (e.g. where it was an important gateway for the last 3 financial years). These thresholds are just an example, as the Commission has the power to designate other providers as gatekeepers (Article 3(6)). Generally, it is the gatekeeper who should notify the Commission that they have reached such a position (Article 3(3)).

Articles 5 and 6 specify the main obligations of the gatekeepers. These seem to focus on: limiting the scope in which platforms use personal data, not limiting a possibility for business users to offer the same products or services to end users on different platforms under different conditions, not restricting communication of business and end users outside the platform, allowing end users to un-install any pre-installed software applications on the platform, as well as facilitate installation of third party software applications, not prioritise in ranking products or services offered by the gatekeeper, limit bundling of services, facilitate switching of services, transparency obligations.

Further provisions of the proposal for this regulation are devoted mainly to various monitoring obligations, review processes and consequences for non-compliance (mainly fines).

Digital Services Act 

The main advertised advantage of this act for consumers is that the provisions of the regulation will offer them 'more choice, lower prices', 'less exposure to illegal content' and 'better protection of fundamental rights' (see here). These benefits are to result if the aims of the Regulation as defined in its Article 1(2) are achieved. Similarly to DMA this Act also will apply to providers of intermediary services regardless of their place of establishment, as long as the services are provided to recipients established or located in the EU (Article 1(3)). A recipient of the service again does not need to be a consumer, as it may be a legal person (Article 2(b)).

The obligations imposed by this Act are to bind providers of intermediary information society services (Article 2(f)), that is services where providers are either a: 'mere conduit' (transmitters of information provided by recipients or providing access to the communication network, e.g. Internet access providers), 'caching' service (where they temporarily store the transmitted information to make its transmission more efficient), 'hosting' service (where they store the information provided for and as requested by the recipient of the service, e.g. cloud services).

Articles 3-5 specify when providers of various information society services in the above-mentioned categories may be exempted from the liability for the content of that information, i.e. when it is illegal content. These provisions aim then to ensure that consumers (citizens) are indeed exposed to less illegal content (will they suffice? that is the question that goes beyond providing a short summary here!).

Importantly, if a provider conducts a voluntary own-initiative investigation that does not change the status of their exemption from the liability as determined in Articles 3-5 (Article 6). Thus self-checks are to be encouraged. However, there remains no general obligation to monitor the information which providers transmit or store (Article 7), similarly to the current E-Commerce Directive provision.

Articles 8-9 regulate how providers are to comply with orders about removing illegal content and providing information about users, respectively.

Other interesting for us provision may be:

- Article 12 - which obliges providers to transparently outline any content moderation procedures and tools in their terms and conditions;

-  Article 13 - requiring providers to publish an annual report on past year's content moderation; Article 23  adds also an obligation to provide reports on the number of disputes submitted to ADR, number of suspensions (Art 20) and any use of automatic means for the purpose of content moderation;

- Article 14 - providers of hosting services are required to facilitate users notifying them about illegal content and allowing them to act upon such notifications (notice and action);

- Article 15 - requires hosting services providers to notify, in a reasoned and transparent manner, users if their content is removed/disabled/etc as illegal;

- Article 17 - sets out rules on an internal complaint-handling system for online platforms, which they are to provide to recipients of services for min 6 months following either removal or disabling of access to the information provided by recipients, suspension or termination of the service, suspension or termination of the account;

- Article 17(4) and Article 18 - recipients of services should be informed about and have access to ADR;

- Article 19 - specifies rules for processing of notifications of trusted flaggers;

- Article 20 - determines when providers could suspend users' accounts due to misuse, i.e. frequent posting of illegal content;

- Article 22 - specifies that online platforms are required to obtain information from traders allowing to trace identity and location of such traders and should check the reliability of this information;

-  Article 24 - online advertising has to be clearly displayed as such, together with parameters used to determine the recipient to whom the advertisement is displayed;

- Articles 26-33 - contain obligations for very large online platforms, in the same categories as described above, but with stricter provisions.

Further provisions pertain to various enforcement and penalties issues, as well as the plans to encourage adoption of standards and codes of conduct.

The New Consumer Protection Agenda 2020-25

Last month, on November 13 2020 the EU Commission adopted its new Consumer Protection Agenda 2020-25 that will provide the strategic framework of consumer protection policy  for the next five years. The Agenda identified 5 key priority areas:

1) Green transition: empower consumers to behave 'green' to purchase sustainable and circular products.

2) Digital transformation: increase online consumer protection; this aim will entail the revision of several well established directives: General Product Safety Directive, Consumer Credit Directive and Distance Marketing of Financial Services Directive.

3) Effective enforcement and redress: places emphasis on the CPC Regulation. 

4) Consumer vulnerability: means addressing the needs of different groups, including debt advice and safety of products designed for children.

5) Consumer protection in the global context: aims to promote overall high level of protection, including the safety of products sold online. 

The strategy seems to have addressed the most pressing consumer protection issues of our everyday lives. Not surprisingly it is significantly influenced by the COVID pandemic and the ways in which it reshaped our lives.

CJEU agrees with the AG in the Uber follow-up case - Star Taxi App

Last week the Court of Justice delivered its judgment in another case highly relevant to the platform economy - C-62/19 Star Taxi App. The English version of the judgment is not available at the time of this writing, yet the analysis of other language versions shows that the Court largely followed the opinion of the Advocate General Szpunar, on which we reported earlier this year (see AG opinion in Star Taxi App...). Like in several other judgments on online platforms analysed on this blog - from Uber Spain and Uber France to Airbnb Ireland - the focus remained on the classification of services provided by platform operators and its regulatory implications. The Court continued to rely on the analytical framework developed in the Uber cases, but - similarly to the Airbnb ruling - applied it more favourably to the platform provider. The judgment confirms that the classification of services of platform operators as activities falling outside of the scope of Directive 2000/31/EC on electronic commerce is not to be made too promptly. Moreover, the judgment addressed several other aspects of the EU regulatory framework - in a way which was not as favourable to the platform providers as they may have hoped.

Facts of the case and the questions referred

As we recounted in our previous post, the case involved a provider of a mobile application connecting drivers and passengers in urban transport. The business model of Star Taxi App was, however, not identical to the Uber platform. Firstly, the provider did not automatically select two parties for a ride, but rather displayed a list of drivers available for a journey, from whom the passenger was free to choose a party. Secondly, the fare was not set by and collected through the app, but was paid directly to the driver. Thirdly, only taxi drivers authorised and licensed to provide taxi services were allowed on the platform and no additional steps were taken to control the quality of the vehicles and drivers. Finally, unlike Uber, Star Taxi App was a Romanian platform, operating on the Romanian market.

The operation of the platform was considered to be in violation of applicable national rules, most notably as regards prior authorisation. The provider contested the sanctions imposed on him, arguing that the relevant norms were contrary to the EU law. Against this background, the Regional Court in Bucharest decided to stay the proceedings and ask the Court of Justice for an interpretation of the notions of "information society services" under Directive 2000/31/EC and "technical regulations" under Directive 2015/1535 on the provision of information in the field of technical regulations. Moreover, the reference provided the Court with an opportunity to clarify specific norms on freedom of establishment, contained in Directive 2000/31/EC (principle excluding prior authorisation) and Directive 2006/123/EC on services (conditions for establishing authorisation schemes and for granting authorisations).

Judgment of the Court

Finding 1: Star Taxi App provides information society services

Like the AG, the Court found that services provided Star Taxi App fulfil the criteria of "information society services", to which Directive 2000/31/EC applies (para. 42-48), and cannot be seen as "inherently linked" to the underlying transport services. Key to the latter finding was the fact that Star Taxi App did not create a new market for non-professional drivers, but was limited to licensed taxi drivers, i.e. a market for services which existed before (para. 52), and did not organise the general functioning of underlying transport services, as it did not select the drivers, set or charge prices or control vehicles or drivers (para. 53). Consequently, unlike in Uber cases, classification as "information society services" remained available.

Finding 2: Notification requirements under Directive 2015/1535 do not apply

The Court then reversed the order of the questions referred and moved to the assessment of notification requirements under Directive 2015/1535. Like the AG, the Court concluded that the Romanian requirements imposed on operators of taxi "dispatching" services did not constitue technical regulations as they were not specifically aimed at information society services. Whether or not this finding remains in line with the Court's previous case law can be a matter of debate. To recall, the Court was not equally generous to the national regulator in VG Media, where it found that the German copyright rules (introducing publisher rights) were aimed, at least in part, at regulating information society services (the use of snippets on search engines). In Star Taxi App, the Court was satisfied with the fact that "taxi dispatching" have long been defined more broadly and referred to the activity consisting in receiving customer bookings by telephone "or other means" and forwarding them to a taxi driver. The fact that more recent local rules in Bucharest explicitly mentioned "IT applications" among those "other means" was deemed irrelevant. To support this conclusion the Court observed that the analysed requirements, for example to obtain a two-way radio, applied equally to all types of dispatching services (para. 65). The latter argument seems rather shaky, considering that the Court later (rightly) argues that such a requirement, applied to the providers of information society services, could, in fact, be contrary to Directive 2006/123/EC. An alternative reading of Directive 2015/1535 could, however, be difficult to reconcile with the subsequent interpretation of Article 4(2) of Directive 2000/31/EC, which was likely a consideration in this part of judgment.

Finding 3: Article 4 of Directive 2000/31/EC does not apply to the scheme at hand, but Articles 9 and 10 of Directice 2006/123/EC do

The last part of the judgment concerns the applicability of the principle excluding prior authorisation in Article 4(1) of Directive 2000/31/EC to the case at hand. Similarly to the AG, the Court found that the analysed scheme was not covered by this provision and instead fell under the exception set out in the subsequent paragraph. To recall, pursuant to Article 4(2) of Directive 2000/31/EC, the principle excluding prior authorisations for information society services remains without prejudice to authorisation schemes which are not specifically and exclusively targeted at such services. Like the AG, the Court observed that a mere clarification (extension?) of the scope of pre-existing rules to dispatching services relying on IT applications does not consistute an authorisation scheme which is specifically and exclusively targeted at such services (paras. 81-82). Accordingly, a conflict between Directives 2000/31/EC and 2006/123/EC did not arise and provisions of the latter were deemed applicable.

The Court then moved to the interpretation of Articles 9 and 10 of Directive 2006/123/EC on freedom of establishment, referring numerously to its recent judgment in Cali Apartments. Like in the Cali case, the Court underlined that a separate and consecutive assessments must be made of, firstly, whether the very principle of establishing that scheme is justified, and, secondly, the criteria for granting the authorisations provided for by that scheme (para. 87). Since the information provided by the referring court in this regard was not sufficient (e.g. so as to assess if the scheme could be justified by reasons of consumer protection), the Court limited itself only to brief observations regarding the criteria apparent from the file. Most notably, it shared the view expressed by the AG that an obligation, imposed on service providers, to comply with technical requirements which are not appropriate for the service in question and thus generate unjustified burdens and costs for service providers could not be deemed compatible with Article 10(2) of Directive 2006/123/EC (para. 90). This could be the case for the requirement to obtain a two-way radio, which was nonetheless for the referring court to verify (paras. 91-92).

Concluding thoughts

Overall, the judgment in Star Taxi App is a reasonable ruling, seeking to strike a balance between the internal market goals and the public interest goals pursued by national regulators. One cannot fail to note, however, that the Court has taken a long way to arrive at this outcome. As apparent from the Star Taxi case, the EU rules at hand provide for significant safety vaults, which Members States can rely upon to regulate the provision of information society services in the public interest. The principle excluding prior authorisation in Article 4(1) of Directive 2000/31/EC does not apply to authorisation schemes which are not specifically and exclusively targeted at information society services and notification requirements in Directive 2015/1535 do not apply to rules which are not specifically aimed at this kind of services. Also the country of origin principle, which is laid down in Article 3(1) of Directive 2000/31/EC and was analysed in the Airbnb Ireland case, is not without limitaitons. Admittedly, the development of the platform economy has pushed some of these norms to its boundaries and a case could be made, for example, for making Article 4(1) of Directive 2000/31/EC less categorical. This, however, is a task for the EU legislature and a potential subject for the Digital Services Act. For the time being, the judgment in Star Taxi App shows, together with Airbnb Ireland, that classification of services of platform operators as activities falling outside of the scope of Directive 2000/31/EC should not be made too lightly and that EU free movement rules are to be reckoned with.

* The author carries out a research project on consumer protection in the collaborative economy, financed by the National Science Centre in Poland on the basis of decision no. DEC-2015/19/N/HS5/01557.

New Digital Markets Unit in the UK - putting (some/few) platforms on notice

Another interesting piece of news from the past few days is the UK government announcing the setting up of the Digital Markets Unit ('New competition regime for tech giants to give consumers more choice and control over their data, and ensure businesses are fairly treated') within the Competition and Markets Authority (CMA). The Unit's main task will be to introduce and enforce 'a new code to govern the behaviour of platforms that currently dominate the market'. Is the UK attempting to follow the example of the German Federal Cartel Office (Bundeskartellamt) that has been cracking the whip against the potential abuses of the dominant position on the market of such digital service providers like Facebook (see The Facebook Decision: First Thoughts by Podszun)?

Perhaps, the government's announcement draws attention to the risks associated with the concentration of power in the tech sector, bluntly giving notice to the dominant players on the digital marketplace that they will be under enhanced surveillance in the foreseeable future. They will be expected to follow the new rules for behaviour set out in the code, which will likely require more transparency (as to the use of consumer data?), opt-in options for personalised advertising (the issue that was at play in the German Facebook case), facilitating users' swapping to use any rival platforms.

The DMU is to start their work in April and is supposed to be able to 'suspend, block and reverse decision of tech giants, order them to take certain actions to achieve compliance with the code, and impose financial penalties for non-compliance'. What is of interest to us, of course, is to what extent this new unit will be able to benefit consumer protection in the UK? This is uncertain at the moment, but it seems that any consumer protection benefits may be coincidental rather than intentional here. First, the Guardian reported that the new unit will have oversight only over platforms funded by digital advertising and having 'strategic market status' (Digital Market Unit: what powers will new UK tech regulator have?). This would limit the unit's purview, possibly even only to Facebook's and Google's activities. Second, the DMU will focus on preventing damage to news media... which suggests that the interests of UK news outlets may play out more centrally, over consumers' interests.

A lot will depend on the new code of conduct set by/for the DMU. We will then definitely let our readers know when the new code for the behaviour of these digital platforms is adopted!

GDPR complaints v Google: Will the (long) wait be worth it?

The European Consumer Organisation (BEUC) drew attention in the last week to the fact that when the national consumer organisations file complaints for infringements of the GDPR rules, the procedure is loooooong (Commercial surveillance by Google. Long delay in GDPR complaints). 

 

We have reported back in 2018 that several national consumer organisations have filed a complaint about Google's deceptive design (the use of dark patterns) to acquire their users' consent to constant tracking of their 'location history' (Google tracks every step you take). The complaints were lodged in various national data protection authorities in November 2019. It took until July 2019 for the decision to be made that the Irish Data Protection Commission will lead the investigation into the complaints. After another six months, in February 2020, we have found out that the Irish Data Protection Commission have also opened an investigation of their own motion (own volition inquiry). This means that there are two separate, but interlinked as they pertain to the similar reported infringements, procedures ongoing at the moment. 

 

Why? That is a very good question. What is the benefit of the opening up of a new procedure with/by the same authority? Supposedly, the own inquiry of the data protection authority will provide insights necessary to further resolve the submitted complaints. The date of any decision/report is unknown at the moment. Which raises the question whether submitting the GDPR complaints actually makes sense from the perspective of consumer protection. After all, whilst the procedure is ongoing and the complaints are pending, the reported practices have not been suspended.

Restoring an effective balance through court-guided negotiations? CJEU in Banca B.SA v A.A.A (C-269/19)

 Dear readers, 

if you were hoping for some inspiring CJEU news to keep your mind away from pandemics, impending festivities and other disasters, we may this week have just what you were looking for - or not, but only time will tell :)

Yesterday, the CJEU's first chamber delivered a judgement sparked by the creativity of Romanian courts which could make courts in other Member States take a closer look at their potential role in unfair terms dispute. To understand the case, it is useful to take a small step back.

As you may remember, in a string of cases culminating famously in the Dziubak decision, the court had established that unfair terms may not be replaced unless two+1 conditions are fulfilled:

a) the contract must, under the applicable national law, not be capable of existence without the unfair term 

and

b) the invalidity must be to the consumer's disadvantage. 

If these two conditions apply, the term may be replaced with otherwise applicable non-mandatory rules - the existence of which is a third condition. What if there are no otherwise applicable rules?

In the case at stake, Romanian courts were struggling with exactly this problem. While on occasion, as in Dziubak, a consumer may actually prefer the whole contract to be invalidated, in several Romanian cases courts were left alone with the prospect of invalidating contracts or facing a stalemate. Some courts had sought to apply non-mandatory rules which had entered in force at a later stage and were thus not applicable to the contentious contracts, but other courts had decided to instate "regulated" negotiations between the parties. In its decision, the CJEU endorses - and, to a certain extent, even requires, this approach, making space for a new wave of procedural innovation in unfair terms adjudication. To what extent this will materialise, though, will of course depend on a number of factors, including importantly national legislation. Let's see what the court says. 

According to the CJEU, the Directive's article 6 does not seek to "prescribe uniform solutions" after a term has been declared unfair [see para 39]. However, once it has found a term unfair, the national court invested with the dispute must, "while taking into account all of its national law, take all the measures necessary to protect the consumer from the particularly unfavourable consequences which could result from the annulment of the loan, notably the fact that the seller or supplier could immediately claim the debt from the consumer" [para 41]. 

The above means that, in circumstances such as the ones at stake, nothing precludes a court from instating negotiations between the parties in order to establish a viable method for calculating the interest rate "provided that it sets out the framework for those negotiations" and that the negotiations themselves seek to establish "an effective balance" between the parties' rights an obligations, considering in particular the objective of consumer protection underlying the Unfair Terms Directive [see para 42]. In doing so, however, they should keep in mind that their intervention should not go beyond "what is strictly necessary to restore the contractual balance", which in turn means "to protect the consumer from the particularly unfavourable consequences" that annulment would bring about. A more substantive intervention would undermine the achievement of the paramount objectives pursued by the directive, namely restoring equality between the parties and deterring professionals from using unfair terms [para 44, para 38] 

Combined, the elements in the reasoning seem to suggest not only that the Directive does not preclude the instigation of "regulated" negotiations, but even that courts are required to take action in this way when this is allowed [or not prohibited] under the applicable national rules. While the CJEU's caveat against substantive intervention leaves open questions as to what courts should do in case negotiations stall, the decision seems mainly aimed at moderating the possibly harsh effects of the case-law which came to be epitomised in Dziubak while preventing consumer-unfriendly readings which some MS courts may be a bit too eager to embrace. 

Professional assignees of consumer claims may rely on the UCTD - CJEU in DelayFix (C-519/19)

The CJEU issued a judgment today in DelayFix case (C-519/19), which pertained to a dispute under Polish law involving aspects of both substantive and procedural consumer protection. Namely, a flight from Milan (Italy) to Warsaw (Poland) was cancelled and the passenger who was due compensation from the operating air carrier (Ryanair) for this cancellation assigned their claims to DelayFix. When DelayFix filed this claim in a Polish district court, Ryanair invoked a jurisdiction clause from their terms and conditions, which assigned the jurisdiction to Irish courts instead. The questions this situation raises are twofold, really: 1. whether the assignee of the passenger's claim for compensation is bound by a clause from the air carrier's terms and conditions that were incorporated in a contract of carriage between the passenger and the air carrier; 2. if yes, could the assignee invoke the unfairness of such a clause?

Assigning of claims and jurisdiction clauses

The CJEU reminds in this judgment that "(...)in principle, a jurisdiction clause incorporated in a contract may produce effects only in the relations between the parties who have given their agreement to the conclusion of that contract" (para 42). This results from the need to protect third parties who have not consented to such specific clauses. However, if, and only if, national law provides that when a third party, not privy to the original contract, succeeds the original contracting party in all their original rights and obligations, then that third party could be bound by the jurisdiction clause (para 47).

Validity of jurisdiction clauses

The CJEU reminds again that the validity of a jurisdiction clause needs to be assessed in light of the law of the country whose courts are designated in that clause, i.e. Irish law in this case (paras 49-50). This, of course, means that the UCTD remains applicable, as well, as it applies to the contracts concluded in the air transport sector (para 52). The interesting observation of the CJEU comes from paras 53-54, where the CJEU invokes a previous judgment in the Lexitor case (see our comment here) as setting a precedent to apply EU consumer law regardless the identity of the parties in the dispute, but on the basis of the capacity of the parties to the agreement. The CJEU further states that this should be applicable to the UCTD. The following parts of the judgment are unsurprising, as the CJEU reminds that jurisdiction clauses are likely to be considered unfair as they may hinder the consumers' rights to take legal action (paras 55-59).

Interpretations of PSD2 in C-287/19 DenizBank AG

On November 11^th the CJEU delivered a judgment in C-287/19 DenizBank AG v Verein für Konsumenteninformation on the interpretation of  Directive 2015/2366 on Payment Services (PSD2).

The facts

VKI an Austrian consumer protection organization brought proceeding for a prohibitory injunction infront of Handelsgericht Wien asking the court to prohibit DenizBank from using several clauses in their standard terms with consumers on grounds that they are null and void. The validity of these clauses were questions in relation to the card’s NFC (Near Field Communication) functionality that enables customers to use contactless payment for low value transactions. The case provided an opportunity to the CJEU to provide interpretation on several aspects of PSD2.

Validity of tacit consent to contract variation

With the first question the Austrian Supreme Court asked whether Article 52(6)(a) of Directive 2015/2366, read in conjunction with Article 54(1), should be interpreted to mean that the payment service providers may agree with the payment service users (who are in this case also consumers) in the framework contract to include a presumption that when the conditions laid down in the contract are satisfied, the payment service users tacitly consented to contract variation.

The CJEU reminded that the tacit consent that is provided for and thus agreed between the parties in advance at the point of contract conclusion of the framework contract is only valid if the change in terms and conditions is of minor importance to the contract. The court emphasized that in case of changing any of the essential terms that would result in a new contract, tacit consent would not be enough. Although the CJEU does not specify, it might be important to note that a framework contract here should be the contract that provides the card, in case of debit cards, this would be the bank account.

The CJEU confirmed that the provision indeed provide for a freedom of payment service providers and users to include these kind of clauses into their contracts, because PSD2 does not lay down restrictions regarding the status of the user or the type of contractual terms that may be the subject of such tacit consent. In principle therefore the validity of tacit consent could not be ruled out. However, in transactions with consumers, the clause should also be subject to an independent review under the Directive 1993/13/EC on unfair terms and may thus be removed from the contract for being unfair.

Meaning of a ‘payment instrument’

With the second question the referring national court asked for clarifying meaning of payment instrument in Article 4(14). More specifically, whether the NFC functionality of personalised multifunctional bank cards by means of which low-value payments are debited from the bank account associated with that card constitutes a ‘payment instrument’.

Under Article 4(14) a ‘payment instrument’ is ‘a personalised device(s) and/or set of procedures agreed between the payment service user and the payment service provider and used in order to initiate a payment order’.

According to the CJEU, the NFC functionality of a multifunctional bank card associated with a specific bank account does not constitute a ‘personalised device’, since the use of that function, in itself, does not allow the payment service provider to verify that the payment order was initiated by a user authorised for that purpose, unlike the other functions of that card which require the use of personalised security data, such as a PIN code or a signature. However, the NFC functionality is capable of constituting, in itself, a non-personalised ‘set of procedures’, within the definition and can thus be considered a ‘payment instrument’ for the purposes of the application of PDS2.

Meaning of ‘anonymous’ use

Further on, the CJEU also had an opportunity in this case to interpret the meaning of ‘anonymous’ within Article 63(1)(b), specifically, whether contactless low-value payment using the NFC functionality of a personalised multifunctional bank card constitutes ‘anonymous’ use of the payment instrument.

Article 63 allows for contracting parties to agree to several important derogations from the protective framework of PDS2 for low value  individual payment transactions not exceeding EUR 30 or which either have a spending limit of EUR 150, or store funds which do not exceed EUR 150 at any time. These include derogation from Article 72 which requires the provider to prove the authentication and execution of payment transactions; from Article 73 which establishes the principle that the service provider is liable for unauthorised payment transactions; and from Article 74(1) and (3) which enables the parties to confer some responsibility for unauthorised payments on the payer for up to EUR 50. These derogations are only possible under Article 63(1)(b) where ‘the payment instrument is used anonymously’ or where ‘the payment service provider is not in a position for other reasons which are intrinsic to the payment instrument to prove that a payment transaction was authorised’.

The CJEU held that despite the facts that the card itself is personalized, connected to a bank account of a particular customer, the use of the NFC functionality for the purpose of making low-value payments constitutes ‘anonymous’ use, within the meaning of Article 63(1)(b). The payment service provider is objectively unable to identify the person who paid using that functionality and thus unable to verify, or even prove, that the transaction was duly authorised by the account holder.

Consequently, contactless low-value payment using the NFC functionality of a personalised multifunctional bank card constitutes ‘anonymous’ use of the payment instrument in question, within the meaning of Article 63(1)(b).

The ways to prove impossibility to block or prevention of future use of payment instrument

Article 63(1)(a) allows the payment service provider and the user to agree on further derogations from the protecting framework of PDS2, that is, from Article 69(1)(b) which requires the user to inform the provider without delay of the loss, theft, misappropriation or any unauthorised use of the payment instrument concerned; from Article 70(1)(c) and (d) of which requires the provider to make available to the user means to make that notification free of charge or to request unblocking of that instrument; and from Article 74(3) which relieves the payer, except where he or she has acted fraudulently, from the financial consequences of any use of the lost, stolen or misappropriated instrument that takes place after that notification.
These derogations are possible to achieve if the payment instrument does not allow its blocking or prevention of its further use. So the question infront of the CJEU was whether payment service providers may simply declare that it is impossible to block the payment instrument concerned or to prevent its continued use, where, in the light of the objective state of available technical knowledge, that impossibility cannot be established.

The CJEU concluded that this is not the case. The ‘payment service provider wishing to exercise the option provided for in Article 63(1)(a) … may not, in order to relieve itself from its own obligations, simply state, in the framework contract relating to the payment instrument concerned, that it is unable to block that instrument or to prevent its further use. That service provider must establish, with the burden of proof being on that provider in the event of a dispute, that that instrument in no way allows, on account of technical reasons, its blocking or prevention of its further use. If the court hearing those proceedings considers that it would have been physically possible to carry out such blocking or to prevent such use, having regard to the objective state of available technical knowledge, but that the provider did not make use of that knowledge, Article 63(1)(a) may not be applied to the benefit of that provider’ (para 98).

Dark patterns and conditions for a valid consent to data processing - judgment of the CJEU in C‑61/19 Orange Romania

Earlier this week, the Court of Justice delivered a judgment in case C-61/19 Orange Romania, concerned with the conditions for a valid consent to the processing of personal data under EU data protection law (the Data Protection Directive 95/46/EC and the General Data Protection Regulation 2016/679, which remains in effect as of May 2018). The case follows up on the previous ruling in C-673/17 Planet49, on which we commented last year (see also: Planet49: Pre-Ticked Checkboxes Are Not Sufficient...). Aside from confirming the importance of an "active" consent, the Court elaborates on the requirement for consent to be informed, specific, unambiguous and freely given, building bridges to important categories known from consumer law, such as transparency and misleading practices.

Facts of the case

The dispute goes back to a fine imposed by the Romanian data protection authority on the provider of mobile telecommunications services, Orange România, for an allegedly unlawful storage of the copies of customers' identity documents. In particular, the authority argued, the data controller failed to demonstrate that the data subjects had given their valid consent to the contested processing. What makes the case interesting is that the storage of ID cards was, in fact, explicitly mentioned in the contracts which Orange concluded with its customers. Specifically, the following wording is cited:

"The customer states that: ... (ii) Orange România has provided the customer with all the necessary information to enable him or her to give his or her unvitiated, express, free and specific consent to the conclusion and express acceptance of the contract; (iii) he or she has been informed of, and has consented to [numerous types of processing, including the storage of copies of documents containing personal data for identification purposes]."

As seen from above, both the declaration of "consent" and the confirmation of having received the associated information were pre-forumlated by the trader. At least in certain cases they were also already "pre-ticked". In fact, however, consent to the storage of the copies of ID cards was not necessery for entering into a contract and customers, who refused to consent, were not prevented from the contract conclusion. Data subjects who did not wish their ID cards to be copied, though, were asked to go through additional steps, most notably confirm their refusal in a specific form, which, like pre-ticked checkboxes, can be regarded as an example of dark patterns in action (or, in this case, "sludge"). 

Against this backgroud, doubts have been raised, among others, as to whether the clauses on data processing were sufficiently distinct from the remaining parts of the documents, whether the data subjects were not misled about the possibility of refusing consent to the storage of ID cards and, if so, whether this could have an impact on the validity of their consent.

Legal provisions

Even though the contested fine was imposed on Orange România prior to the date of application of the GDPR, the Court of Justice decided to provide guidance on both Directive 95/46/EC and Regulation 2016/679. Key norms subject to the analysis where those laying down conditions for a valid consent. Focusing on the GDPR, attention should be drawn to its Article 6(1)(a), listing data subject's consent among the grounds for the lawful professing of his or her personal data, and to Article 4(11), which defines "consent" as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Of relevance are further the associated information duties in Article 13 as well as (non-binding) clarification of the above in recitals 32 and 42.

Judgment of the Court

While the specific assessment of the case at hand has been left to the national court (in line with the nature of preliminary reference procedure), the judgment provides important guidance on the legal provisions to be applied. In particular:

• The Court recalls that for consent to be validly expressed (by the data subject) and later demonstrated (by the controller), the corresponding wish of the data subject should be reflected in his or her active behaviour. In particular, unambiguous and informed consent cannot be inferred from the fact that the data subject did not deselect a pre-ticked checkbox (paras. 35-37, 45-46; on the burden of proof, see also paras. 42, 51).
  

• The judgment goes on to discuss the definition of consent as a "specific" indication of data subject wishes, highlighting the requirements of Article 7(2) (presentation of the request for consent in a manner which is clearly distinguishable from the other matters) and recital 42 of the GDPR (presentation of pre-formulated declarations in an intelligible and easily accessible form, using clear and plain language). The latter is especially worth highlighting, as it directly refers to Directive 93/13/EEC on unfair terms in consumer contracts. Transparency of declarations is also considered relevant for establishing whether consent so expressed has been informed. What is more, corresponding information provided by the controller "must enable the data subject to be able to determine easily the consequences of any consent he or she might give", which again brings to mind the requirements for substantive transparency known from consumer law stricto sensu (paras. 38-40, 47-48). The latter may have significant impliactions for the validity of consent to the processing of personal data in the context of automated decision-making.

• Finally, an important part of the judgment concerns the requirement for consent to be freely given (and again informed). In para. 41, the Court observes that "in order to ensure that the data subject enjoys genuine freedom of choice, the contractual terms must not mislead him or her as to the possibility of concluding the contract even if he or she refuses to consent to the processing of his or her data" (similarly para. 49). This brings to mind the notions of misleading actions and ommissions, known from Articles 6 and 7 of Directive 2005/29/EC on unfair commercial practices (note that the Directive refers directly to the "freedom of choice" only in the subsequent provision on aggressive practices). At a later point of the judgment, the Court also questions the free nature of consent in the case at hand in view of the additional burden (sludge) imposed by the controller on the data subjects who wish to refuse consent (para. 50). As in the other instances, however, an assessment is ultimately left to the referring court. 

Concluding thoughts

Overall, the judgment provides for a range of important reference points, which may help to increase the level of consumer and data protection in the EU. Worth noting are the recurring references to the requirement of an "informed" consent, which appears to complement and reinforce all other conditions. The judgment underlines the close connection between data protection and consumer law stricto sensu, which has long been observed in the literature. Recognition of the role of (substantive) transparency and of potentially misleading practices in assessing consent validity is also to be welcomed. Both seem especially relevant in the digital market, where the consequences of consent are often difficult to determine and where dark patterns remain prevalent.