SOME NEW NUANCES OF FAIRNESS IN CONSUMER LAW THE CASE OF PROTECTING CONSUMERS’ PERSONAL DATA
V. FINAL THOUGHTS
As I already pointed out, I am rather sceptical when it comes to the application of consumer law for regulating the processing of personal data when this processing is understood as some kind of payment.[69] However, if consumer law is to apply even in this case, the above analysis shows that the introduction of “payments with data” in consumer law may open up for some novel and interesting interpretations that could change the way we understand consumer law and finally make possible the use of social considerations when it comes to the assessment of fairness in consumer law.
Most importantly, even if the arguments on why to apply the UCPD and the UTD when traders process personal data in order to create direct revenues, still use to an extent the narrative of the economic value provided by consumers to traders and the need for protecting the interests related to such a value, the fact that personal data are strongly connected to fundamental rights considerations opens up for the inclusion of such considerations in consumer law.
[1] V. REDING, ‘President of the European Commission, EU Justice Commissioner - The EU Data Protection Reform 2012: Making Europe the Standard Setter for Modern Data Protection Rules in the Digital Age
Innovation’ (European Commission, 22 January 2012)
<https://ec.europa.eu/commission/presscorner/detail/en/SPEECH_12_26 > accessed 11 July 2022.
[2] See here in general G. González Fuster, The Emergence of Personal Data Protection as a Fundamental Right of the EU, Springer 2014, p. 34, where it is presented that a number of national attempts to data protection in the beginning were very much related to the protection of individuals from private entities, presumably because these data could be used in order to create revenues. Similarly, the very influential “OECD Guidelines Governing the Protection of Privacy and Transboder Flows of Personal Data” in the 1980’s were also focusing on the importance of personal data as an element of the international market.
130
[3] World Economic Forum, "Personal Data: The Emergence of a New Asset Class" (2011); World Economic Forum, "Unlocking the Value of Personal Data: From Collection to Usage" (2013). See also William D Eggers,
"Data as the New Currency’ (Deloitte Insights, 24 July 2013) <https://www2.deloitte.com/us/en/insights/deloitte-review/issue-13/data-as-the-new-currency.html> accessed 6 December 2021; Simon Taylor, ‘Data: The New Currency’ (2014) <https://www.politico.eu/wp-content/uploads/2014/10/Data-report.pdf> accessed 6 December 2021. For a legal overview on the commercialization of data see Sebastian Lohsse, Reiner Schulze and Dirk Staudenmayer (eds), Trading Data in the Digital Economy: Legal Concepts and Tools: Münster Colloquia on EU Law and the Digital Economy III, 1st edition, Nomos, 2017.
[4] H. ZECH, ‘Data as a Tradeable Commodity–Implications for Contract Law’; ‘The World’s Most Valuable
Resource Is No Longer Oil, but Data’ [2017] The Economist
<https://www.economist.com/leaders/2017/05/06/the-worlds-most-valuable-resource-is-no-longer-oil-but-data>.
[5] M. V. LIESHOUT, ‘The Value of Personal Data’ in Jan Camenisch, Simone Fischer-Hübner and Marit Hansen (eds), Privacy and Identity Management for the Future Internet in the Age of Globalisation, vol 457, Springer International Publishing, 2015, <http://link.springer.com/10.1007/978-3-319-18621-4_3> accessed 17 September 2018.
[6] S. LOHSSE, R. SCHULZE and D. STAUDENMAYER (eds), Trading Data in the Digital Economy: Legal Concepts and Tools: Münster Colloquia on EU Law and the Digital Economy III, 1st edition, Nomos, 2017, p.
15; Recital 13 of the ‘Proposal for a Directive of The European Parliament and of the Council on Certain Aspects Concerning Contracts for the Supply of Digital Content COM(2015) 634 Final’.
[7] Recital 13 of the ‘Proposal for a Directive of The European Parliament and of the Council on Certain Aspects Concerning Contracts for the Supply of Digital Content COM(2015) 634 Final’.
[8] ‘Proposal for a Directive of The European Parliament and of the Council on Certain Aspects Concerning Contracts for the Supply of Digital Content COM(2015) 634 Final’.
[9] Recital 6 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L 119/1 (hereinafter the GDPR). See also the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter the DPD).
[10] Data Act, Data Governance Act, Digital Services Act and Digital Markets Act.
[11] The previous DPD and its successor the GDPR as well as the Charter of Fundamental Rights of the European Union (hereinafter the Charter).
[12] See O. LYNSKEY, The Foundations of EU Data Protection Law, Oxford University Press, 2016. ProQuest Ebook Central, as well as Case C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989 where it was declared that ‘insofar as [the provision of the DPD] govern the processing of personal data liable to infringe fundamental freedoms … [they] must necessarily be interpreted in light of fundamental rights’..
[13] Hungarian Competition Authority, ‘Competition Proceeding against Google Is Closed with Commitment
Decision’ (GVH, 31 August 2018)
<gvh.hu/en/press_room/press_releases/press_releases_2018/competition_proceeding_against_google_is_closed
> accessed 15 March 2021, Commission, ‘Facebook Changes Its Terms and Clarifies Its Use of Data for Consumers’ (4 September 2019) <https://ec.europa.eu/commission/presscorner/detail/en/IP_19_2048> accessed 16 March 2021, Italian Competition Authority, ‘Facebook Fined 10 million Euros by the ICA for Unfair Commercial Practices for Using Its Subscribers’ Data for Commercial Purposes’ (2018) Press Release
<https://en.agcm.it/en/media/pressreleases/2018/12/Facebook-fined-10-million-Euros-by-the-ICA-for-unfaircommercial-practices-for-using-its-subscribers%E2%80%99-data-for-commercialpurposes>
accessed 16 March 2021
[14] Commission, ‘Staff Working Document - Guidance on the Implementation/Application of Directive 2005/29/EC on Unfair Commercial Practices - Accompanying the Document Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the
131
Committee of the Regions - A Comprehensive Approach to Stimulating Cross-Border e-Commerce for Europe’s Citizens and Businesses’ COM(2016) 320 final <https://eur-lex.europa.eu/legalcontent/
EN/TXT/PDF/?uri=CELEX:52016SC0163&from=EN> accessed 20 May 2021.
[15] Tribunal de Grande Instance de Paris, NÅã RG 14/07300 (n 30); Tribunal de Grande Instance de Paris jugement du 9 avril 2019; Tribunal de Grande Instance de Paris jugement du 9 février 2019, LG Frankfurt aM, Urteil vom 10.06.2016 – 2-03 O 364/15
[16] M. RHOEN, ‘Beyond Consent: Improving Data Protection through Consumer Protection Law’, 2016, 5 Internet Policy Review <https://policyreview.info/node/404> accessed 16 March 2021; N van Eijk, C Jay Hoofnagle and E Kannekens, ‘Unfair Commercial Practices’, 2017, 3 European Data Protection Law Review 325;
Natali Helberger, Frederik Zuiderveen Borgesius and Agustin Reyna, ‘The Perfect Match? A Closer Look at the Relationship between EU Consumer Law and Data Protection Law’, 2017, 54 Common Market Law Review 1427; Natali Helberger and others, ‘Surveillance, Consent and the Vulnerable Consumer. Regaining Citizen Agency in the Information Economy’, EU Consumer Protection 2.0 - Structural Asymmetries in Digital Consumer Markets, BEUC, 2021; BJ Koops, ‘The Trouble with European Data Protection Law’, 2014, 4 International Data Privacy Law 250.
[17] With regard to consumer law, the first piece of law related to consumer protection has been the Consumer Bill of Rights in the 1962 after the famous speech by Kennedy about the need to protect the consumer, ‘President Kennedy: Consumer Bill of Rights, March 15, 1962 – Chris Hoofnagle | UC Berkeley School of Law, School of Information’ <https://hoofnagle.berkeley.edu/2015/05/07/president-kennedy-consumer-bill-ofrights-march-15-1962/> accessed 25 March 2021. See also Iain Ramsay, Consumer Law and Policy: Text and Materials on Regulating Consumer Markets, 2nd ed, Hart 2007, p. 2. Similarly in Europe, even though we find some mention to consumers in the Treaty of Rome in 1957, it was after 1975, the soft law initiative, the Council Resolution of 14 April 1975 – the First Consumer Protection Programme, that brought consumers to the forefront. After the Treaty of Maastricht in 1993 a clear policy for consumer protection was defined and a number of directives were adopted, such as the UTD. Similarly, when it comes to data protection law, even though the first national attempts to data protection legislation can be traced back to the 1970’s and in the 1980’s the OECD Guidelines and the Council’s Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) emphasised the importance of data protection law in general the first data protection legislation in the EU was adopted, the DPD, was adopted in the mid 1990’s...
[18] For data protection law see Damian Clifford, ‘The Legal Limits to the Monetisation of Online Emotions’, doctoral thesis, 2019; Damian Clifford, Inge Graef and Peggy Valcke, ‘Pre-Formulated Declarations of Data Subject Consent—Citizen-Consumer Empowerment and the Alignment of Data, Consumer and Competition Law Protections’, 2019, 20 German Law Journal 679, while for consumer law see for example Bradgate R, Brownsword R and Twigg-Flesner C, ‘The Impact of Adopting a Duty to Trade Fairly’, Department of Trade and Industry, Consumer and Competition Policy Directorate, 2003.
[19] Article 8(2) of the Charter.
[20] D. CLIFFORD, ‘The Legal Limits to the Monetisation of Online Emotions’, doctoral thesis, 2019.
[21] Council Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts [1993] OJ L 95/29 [22] Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, Directives 97/7/EC, 98/27/EC and 2002/65/EC of the European Parliament and of the Council and Regulation (EC) No 2006/2004 of the European Parliament and of the Council [2005] OJ L 149/22.
[23] Directive (EU) 2019/770 of the European Parliament and of the Council of 20 May 2019 on certain aspects concerning contracts for the supply of digital content and digital services
[24] BJ KOOPS, ‘The Trouble with European Data Protection Law’, 2014, 4 International Data Privacy Law 250 [25] ‘Proposal for a Directive of The European Parliament and of the Council on Certain Aspects Concerning Contracts for the Supply of Digital Content COM(2015) 634 Final’
<http://ec.europa.eu/justice/contract/files/digital_contracts/dsm_digital_content_en.pdf> accessed 25 January 2017. The proposal contained the term counter-performance while the final text abandoned this term. However, the framing of the final text creates a clear connotation between paying with money and paying with personal data.
132
[26] However, for the DPD the processing of personal data is only an enabler for its application, meaning that if personal data are processed, consumers should have some protection related to the product that is “purchased”
with these data while any matters of data protection are to be regulated under the data protection law framework [27] It is indicative that before 2012 it is difficult to find any references to consumer law with regards to personal data – except for a case in Italy where the national consumer protection authority found that an advertisement regarding a free subscription to online services is misleading on the grounds that it ‘omitted to specify those terms of use, which played a significant role in the overall evaluation of the convenience of the offer’ AGCM, PI2686 – Libero Infostrada [2000] Provvedimento n 8051; while it is also very difficult to find any literature on the matter before 2016.
[28] Article 169 of the TFEU
[29] A. METZGER, ‘Data as Counter-Performance: What Rights and Duties for Parties Have’, 2017, 8 J. Intell.
Prop. Info. Tech. & Elec. Com. L. 2
[30] A. KOTSIOS, Paying with Data: A Study on EU Consumer Law and the Protection of Personal Data, Doctoral thesis, 2022.
[31] Commission, ‘Staff Working Document - Guidance on the Implementation/Application of Directive 2005/29/EC on Unfair Commercial Practices - Accompanying the Document Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions - A Comprehensive Approach to Stimulating Cross-Border e-Commerce for Europe’s
Citizens and Businesses’ COM(2016) 320 final
<https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CELEX:52016SC0163&from=EN> accessed 20 May 2021, para 88-89; Hungarian Competition Authority, ‘Competition Proceeding against Google Is Closed with Commitment
Decision’ (GVH, 31 August 2018)
<gvh.hu/en/press_room/press_releases/press_releases_2018/competition_proceeding_against_google_is_closed
> accessed 15 March 2021.
[32] Opinion of Advocate General Sharpston in Case C-515/12 ‘4finance’ UAB v Valstybinė vartotojų teisių apsaugos tarnybaand Valstybinė mokesčių inspekcijaprie Lietuvos Respublikos finansų ministerijos [2013]
EU:C:2013:868 para 32.
[33] See, however, the decision of the Italian Council of State that ended up to the opposite outcome, namely that such a practice constitutes a misleading practice, Consiglio di Stato, esenzione 6, IT:CDS:2021:2631SENT.
[34] The connotations created because of the framing are of course impossible to disregard but nevertheless the legislator was very careful to not define the provision of personal data as a counter-performance and neither did it indicate a specific type of contract that should be adopted by MS.
[35] European Commission ‘Staff Working Document - Guidance on the Implementation/Application of Directive 2005/29/EC on Unfair Commercial Practices - Accompanying the Document Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions - A Comprehensive Approach to Stimulating Cross-Border e- Commerce for Europe’s Citizens and Businesses’ COM(2016) 320 final, pp 88-98; Hungarian Competition Authority, ‘Competition Proceeding against Google Is Closed with Commitment Decision’ (GVH, 31 August 2018)
<gvh.hu/en/press_room/press_releases/press_releases_2018/competition_proceeding_against_google_is_closed
> accessed 15 March 2021
[36] N. HELBERGER, F. Zuiderveen Borgesius and A. Reyna, ‘The Perfect Match? A Closer Look at the Relationship between EU Consumer Law and Data Protection Law’ (2017) 54 Common Market Law Review 1427. See also Michiel Rhoen, ‘Beyond Consent: Improving Data Protection through Consumer Protection Law’, 2016, 5 Internet Policy Review where even if the author makes a case for the use of consumer law in case personal data are processed as a payment he nevertheless talks about privacy and data protection considerations.
[37] See Case C-26/13 .rp.d Kásler, Hajnalka K.slern. R.bai v OTP Jelz.logbank Zrt [2014] EU:C:2014:282, Case C-348/14 Maria Bucura v SC Bancpost SA [2015] EU:C:2015:447, Case C-143/13 Bogdan Matei and Ioana Ofelia Matei v SC Volksbank România SA [2015] EU:C:2015:127 referring to the same consumer as the one in the UCPD, the reasonably well-informed and reasonably circumspect consumer.
133
[38] S. WEATHERILL, ‘Recent Case Law Concerning the Free Movement of Goods: Mapping the Frontiers of Market Deregulation’ (1999) 36 Common Market Law Review 51, 69–70, Geraint Howells and Gert Straetmans,
‘The Interpretive Function of the CJEU and the Interrelationship of EU and National Levels of Consumer Protection’ (2017) 9 Perspectives on Federalism E, 200 with references.
[39] Case C-195/14 Bundesverband der Verbraucherzentralen und Verbraucherverb.nde - Verbraucherzentrale Bundesverband eV v Teekanne GmbH & Co KG [2015] EU:C:2015:361
[40] See for example Böhler when commenting the Purely Creative (Case C-428/11 Purely Creative Ltd and Others v Office of Fair Trading [2012] EU:C:2012:651) where the Court took into consideration the actual behaviour of a consumer, emphasized that we cannot draw the conclusion that the Court pictures the consumer differently than it did before, as a casual consumer or an “impressionable idiot”; Christian Böhler, ‘A Thin Line between the Rationalization of Consumer Choices and Overburdening Market Participants. Are the Courts Able to Keep the Balance?’ (2015) 10 European Food and Feed Law Review 34.
[41] Case C-122/10 Konsumentombudsmannen v Ving Sverige AB [2011] EU:C:2011:299.
[42] Opinion of the Advocate General Trstenjakin Pereničov. in Case C-540/08 Mediaprint Zeitungsund Zeitschriftenverlag GmbH & Co KG v ‘.sterreich’-Zeitungsverlag GmbH [2010] EU:C:2010:161para 99 [43] Case C-540/08 Mediaprint Zeitungs- und Zeitschriftenverlag GmbH & Co KG v‘.sterreich’-Zeitungsverlag GmbH [2010] EU:C:2010:660
[44] Opinion of Advocate General Trstenjak in Case C-540/08 Mediaprint Zeitungsund Zeitschriftenverlag GmbH
& Co KG v ‘.sterreich’-Zeitungsverlag GmbH [2010] EU:C:2010:161 para 102
[45] Remember for example that in 2018 that the US Senator Hatch was mocked when he asked Zuckenberg ‘[s]o, how do you sustain a business model in which users don’t pay for your service?’ and received the answer ‘Senator, we sell ads’ – understood as personalized advertisements, since this question was considered as rather naïve.
[46] S. BARTH & M. DE JONG, ‘The Privacy Paradox – Investigating Discrepancies between Expressed Privacy Concerns and Actual Online Behavior – A Systematic Literature Review’, 2017, 34 Telematics and Informatics 1038
[47] A. FURMAN WESTIN, Privacy and Freedom, IG Publishing, 2015.
[48] G. GONZÁLEZ FUSTER, ‘How Uninformed Is the Average Data Subject? A Quest for Benchmarks in EU Personal Data Protection’ [2014] IDP Revista de Internet Derecho y Política 92, p. 101.
[49] Article 7 of the GDPR.
[50] Articles 6-9 of the UCPD.
[51] Italian Competition Authority, both cases, Goanta and Molders
[52] Joined Cases C-54/17 and C-55/17 Autorit. Garante della Concorrenza e del Mercato v Wind Tre SpA, Vodafone Italia SpA [2018] EU:C:2018:710, Case C-428/11 Purely Creative Ltd and Others v Office of Fair Trading [2012], Case C-628/17 Prezes Urzędu Ochrony Konkurencji i Konsument.w v Orange Polska SA [2019]
EU:C:2019:480 EU:C:2012:651
[53] BEUC, ‘What’s up with WhatsApp? An Assessment of WhatsApp’s Practices in the Light of EU Consumer Protection Rules’, 2021, 12–16 <https://www.beuc.eu/publications/beuc-x-2021-063_report_-_whats_up_with_whatsapp.pdf> accessed 4 October 2021.
[54] S. MULDERS and C. GOANTA, ‘“Move Fast and Break Things”: Unfair Commercial Practices and Consent on Social Media’, 2019, Journal of European Consumer and Market Law 136, p. 143
[55] See also N. ZINGALES, ‘Between a Rock and Two Hard Places: WhatsApp at the Crossroad of Competition, Data Protection and Consumer Law’, 2017, 33 Computer Law & Security Review 553, p.
[56] N. HELBERGER et al., ‘Surveillance, Consent and the Vulnerable Consumer. Regaining Citizen Agency in the Information Economy’, EU Consumer Protection 2.0 - Structural Asymmetries in Digital Consumer Markets
134
(BEUC 2021), Stephan Mulders and Catalina Goanta, ‘“Move Fast and Break Things”: Unfair Commercial Practices and Consent on Social Media’, 2019, Journal of European Consumer and Market Law 136, p. 143.
[57] N. HELBERGER and others, ‘Surveillance, Consent and the Vulnerable Consumer. Regaining Citizen Agency in the Information Economy’, EU Consumer Protection 2.0 - Structural Asymmetries in Digital Consumer Markets (BEUC 2021), Chris Willett, ‘Fairness and Consumer Decision Making under the Unfair Commercial Practices Directive’ (2010) 33 Journal of Consumer Policy 247, 259
[58] WP29, ‘Opinion 15/2011 on the Definition of Consent’ (2011) (WP187), WP29 Guidelines on Consent under Regulation 2016/679 (2020) Wp259 rev.01 and EDPB Guidelines 05/2020 on Consent under Regulation
2016/679, Version 1.1 (2020)
<https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf> accessed 2 July 2021
[59] EDPB Guidelines 05/2020 on Consent under Regulation 2016/679, Version 1.1 (2020)
<https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf> accessed 2 July 2021, p 9
[60] AGCM, PS10601 – WhatsApp- Trasferimento Dati a Facebook [2017] Provvedimento n. 26597
[61] AGCM, PS10601 – WhatsApp- Trasferimento Dati a Facebook [2017] Provvedimento n. 26597, BEUC,
‘What’s up with WhatsApp? An Assessment of WhatsApp’s Practices in the Light of EU Consumer Protection Rules’ (2021) <https://www.beuc.eu/publications/beuc-x-2021-063_report_-_whats_up_with_whatsapp.pdf>
accessed 4 October 2021 [62] Article 3 of the UTD.
[63] N. JANSEN and R. ZIMMERMANN (eds), Commentaries on European Contract Laws, First edition, Oxford University Press, 2018, p. 945.
[64] M. LOOS and J. LUZAK, ‘Update the Unfair Contract Terms Directive for Digital Services’, Parliament’s Committee on Legal Affairs (JURI), 2021, p. 28.
[65] M. LOOS and C. MAK, ‘Remedies for Buyers in Case of Contracts for the Supply of Digital Content’, 2012, ad hoc briefing paper for the European Parliament’s Committee on Legal Affairs PE 462.
[66] It is indeed very difficult to find the economic value of personal data and many models have been used, see Marc van Lieshout, ‘The Value of Personal Data’ in Jan Camenisch, Simone Fischer-Hübner and Marit Hansen (eds), Privacy and Identity Management for the Future Internet in the Age of Globalisation, vol 457, Springer International Publishing, 2015, p. 2. However, it is interesting that in the black market most of the data records related to a person are below 1 U.S. Dollar, Trustwave, ‘Trustwave Global Security Report’, 2018,
<https://trustwave.azureedge.net/media/15350/2018-trustwave-global-securityreport-prt.pdf?rnd=131992184400000000> accessed 8 November 2021.
[67] D. KENNEDY, ‘Form and Substance in Private Law Adjudication’, 1976, 89 Harvard law review 1685;
Thomas Wilhelmsson, ‘Varieties of Welfarism in European Contract Law’, 2004, 10 European Law Journal 712;
Chris Willett, Fairness in Consumer Contracts - The Case of Unfair Terms, Routledge, 2016; Hugh Collins, Regulating Contracts, Repr, Oxford Univ Press, 2005.
[68] G. HOWELLS, ‘Europe’s (Lack of) Vision on Consumer Protection’ in Dorota Leczykiewicz and Stephen Weatherill (eds), The images of the consumer in EU law: legislation, free movement and competition law, Hart Publishing 2016, p. 440
[69] A. KOTSIOS, Paying with Data: A Study on EU Consumer Law and the Protection of Personal Data, Doctoral thesis, 2022.
135