EU consumer protection rules: enforcement and modernisation

OPINION of the European Data Protection Supervisor (EDPS) on the legislative package ‘A new deal for consumers’.

This opinion sets out the EDPS's position on the legislative package entitled 'A new deal for consumers', which consists of (i) a proposal for a Directive as regards better enforcement and modernisation of EU consumer protection rules; (ii) the proposal for a Directive on representative actions for the protection of the collective interests of consumers.

The EDPS welcomes the intention of the Commission to modernise existing rules and fill the gaps in the current consumer acquis in order to respond to current challenges such as emerging new business models, in which personal data is being demanded from consumers wishing to access digital content or make use of digital services.

However, the EDPS notes with concern that the new definitions envisaged by the proposal would introduce the concept of contracts for the supply of a digital content or digital service for which consumers can ‘pay’ with their personal data, instead of paying with money.

The EDPS considers that the proposal should avoid promoting approaches that could be interpreted in a way that is incompatible with the European Union's commitment to fully protect personal data, as provided for in the General Data Protection Regulation (GDPR).

The EDPS therefore recommends refraining from any reference to personal data in the definitions of the ‘contract for the supply of digital content which is not supplied on tangible medium’ and the ‘digital service contract’ and suggests to rely instead on a concept of a contract under which a trader supplies or undertakes to supply specific digital content or a digital service to the consumer ‘irrespective of whether a payment of the consumer is required.

In addition, the EDPS draws attention to several potential interferences of the proposal with the application of the EU data protection framework, in particular with the GDPR, and makes recommendations in this respect:

(1) the EDPS stresses that only traders may process personal data in accordance with the Union for Data Protection framework, in particular the GDR;

(2) the EDPS is concerned that the introduction, by the proposal, of the concept of ‘contracts for the supply of a digital content or digital service for which consumers provide their personal data, instead of paying with money’ may cause confusion for service providers;

(3) there is a complex interaction between the right of withdrawal from the contract, the withdrawal of consent to the processing of personal data and the obligation of the trader to reimburse the consumer in the event of withdrawal;

(4) the EDPS considers that the Proposal should amend Article 3 of Directive 2011/83/EU and introduce a provision that clearly states that in case of a conflict between the Directive 2011/83/EU and the data protection legal framework, the latter prevails.