In Verein fur Konsumenteninformation v Amazon EU Sarl (Case C-191/15), the Court of Justice of the European Union has reaffirmed the position with regards to which Member State’s data protection laws should apply in a situation where there is a company established in one Member State who provides services to consumers based in various other Member States. The CJEU also held that a contractual standard term which chose a supplier’s Member State law as the governing law, rather than the consumer’s, was unfair towards consumers.
Amazon EU Sarl, a company incorporated in Luxembourg, conducted sales with Austrian consumers remotely through a website called amazon.de. Amazon had no registered office or branch in Austria. The standard terms utilised allowed Amazon to use personal data supplied by the consumers when purchasing, including information such as customer reviews, and furthermore, stated that the contractual governing law was that of Luxembourg. Verein fur Konsumenteninformation (VKI), a consumer protection body, applied to the Austrian court for an injunction to prevent the use of these standard terms. The case travelled up to the Austrian Supreme Court which decided to stay the proceedings and referred three questions to the CJEU for a preliminary ruling as follows.
How should the Rome I Regulation (Regulation EC 593/2008) and the Rome II Regulation (Regulation EC 864/2007) be interpreted in a case where an injunction action is brought against the usage of contractual terms by an entity established in one Member State which during the course of e-commerce activity concludes contracts with consumers who are resident in different Member States?
The CJEU held that both Rome Regulation I (Rome I) and II (Rome II) should be interpreted as meaning that the law applied where injunction action is brought against the use of unfair contractual terms between Member States should be determined in accordance with the Rome II. Article 6(1) of Rome II provides that the law applicable to a non-contractual obligation arising out of an act of unfair competition shall be the law of the country where the interests of consumers are, or are likely to be, affected – in this case, Austria. The CJEU also held that the law applicable to an assessment of a specific contractual term should be determined in accordance with Rome I, whether that assessment is made due to an individual or collective action.
Whether a term (to the effect that the contract was to be governed by the law of the Member State that the supplier is established in) included in the general terms and conditions under which a contract is concluded in the course of e-commerce activity between a supplier and a consumer, is unfair within the meaning of the Unfair Terms in Consumer Contracts Directive (EU Directive 93/13).
The CJEU answered the second question by stating that, where a contract has not been individually negotiated, a governing law term is unfair insofar as it gives the consumer the incorrect impression that only the law of the supplier Member State governs the contract and does not inform the consumer that under the Rome I, s/he also has the benefit of the mandatory provisions of law that would apply in the absence of a governing law term, which is an issue for the national court to determine. These provisions are Article 6(2) and Article 4 of Rome I which provide that law applicable to an obligation arising from tort shall be the law of the country in which the damage occurs, in this case Austria rather than Luxembourg. This part of the VKI v Amazon decision will lead to companies having to consider whether their choice of standard governing clause is sufficiently fair to consumers going forward.
Whether Article 4(1)(a) of the Data Protection Directive (EU Directive 95/46) means that the treatment of personal data by an entity engaged in e-commerce activity was exclusively governed by the law of the Member State in which the undertaking is established or whether the undertaking must also comply with the data protection laws of the Member States in which its commercial activities are conducted.
Article 4(1)(a) of the Data Protection Directive (Directive 95/46/EC) provides that each Member State shall apply its own data protection legislation to the processing of personal data where data processing is carried out in the context of the activities of an establishment of the data controller in the territory of the Member State. The Austrian court sought guidance on whether this meant that the processing of personal data by an undertaking in the context of e-commerce should be governed by the law of the Member State to which that undertaking directs its commercial activities, or where the undertaking itself was established. The CJEU provided further guidance as to how the law should be applied, but ultimately referred the decision back to the national court.
The CJEU has previously given guidance on the concept of ‘establishment’ in Weltimmo s.r.o. v Nemzeti Adatvedelmi es Informacioszabadsag Hatsosag – Case C-230/14 , where it was held in the judgment that the concept of ‘establishment’ extends to any “real and effective activity, even a minimal one, exercised through stable arrangements”. Furthermore it was held in Weltimmo that the processing of personal data does not have to be carried out specifically by the establishment, simply “in the context of activities” of the establishment will be enough. The CJEU also held that in order to decide whether an establishment exists, the degree of stability of the arrangements and the effective exercise of activities should be assessed. Further guidance given included the fact that an establishment does not exist merely because the service provider’s website is available in that Member State, but conversely a permanent branch or subsidiary is not needed in order to have an establishment. The CJEU referred to the judgment given in Weltimmo and held that it is for the national court of the relevant Member State to decide whether data processing was carried out in the context of an establishment situated in a Member State. Therefore, in VKI v Amazon it will be for the Austrian court to decide whether Amazon carried out the relevant data processing in the context of activities of an establishment situated in a Member State other than Luxembourg and we await that decision.
This decision means that companies, especially global ones, will need to consider whether their standard form of governing law clause is unfair towards consumers. If so, and these clauses need to be updated, they should be drafted so as to clearly inform the consumer that they have the benefit of the mandatory consumer protections in their country of residence. Regarding the data processing aspect of the judgment, the CJEU affirmed the decision in Weltimmo, although by referring the ultimate decision back to the national courts, it is clear that cases such as these will continue to turn on the individual circumstances and facts.
For the full judgment in the case, click here.
Robert Bond is a Partner at Charles Russell Speechlys. Robert has over 37 years’ experience in advising national and international clients on the legal and regulatory aspects of commercial, IP, technology, data protection and information security.
