text: This Opinion relates to the EDPS' mission to advise the EU institutions on the data protection implications of their policies and foster accountable policymaking - in line with Action 9 of the EDPS Strategy: 'Facilitating responsible and informed policymaking'. The EDPS considers that compliance with data protection requirements will be key to the success of EU consumer protection law in the Digital Single Market.

text: OJ L 119, 4.5.2016, p. 1. OJ L 8, 12.1.2001, p. 1. OJ L 119, 4.5.2016, p. 89. Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee “A New Deal for Consumers”, COM(2018) 183 final. Proposal for a Directive of the European Parliament and of the Council amending

text: Council Directive 93/13/EEC of 5 April 1993

text: , Directive

text: of the European Parliament and of the Council, Directive

text: of the European Parliament and of the Council and Directive

text: of the European Parliament and of the Council as regards better enforcement and modernisation of EU consumer protection rules, COM(2018) 185 final. Proposal for a Directive of the European Parliament and of the Council on representative actions for the protection of the collective interests of consumers and repealing Directive

text: , COM(2018) 184 final. EDPS Opinion 8/2016 on coherent enforcement of fundamental rights in the age of big data, 23 September 2016, p. 8. “There might well be a market for personal data, just like there is, tragically, a market for live human organs, but that does not mean that we can or should give the market the blessing of legislation”, EDPS Opinion 4/2017 on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content, 14 March 2017, p. 7. EDPS Preliminary Opinion on Privacy and competitiveness in the age of big data: The interplay between data protection, competition law and consumer protection in the Digital Economy, March 2014. EDPS Opinion 8/2016 on coherent enforcement of fundamental rights in the age of big data, 23 September 2016; EDPS Opinion 3/2018 on online manipulation and personal data, 19 March 2018. Directive

text: of the European Parliament and of the Council of 25 October 2011 on consumer rights, amending

text: Council Directive 93/13/EEC

text: and Directive

text: of the European Parliament and of the Council and repealing

text: Council Directive 85/577/EEC

text: and Directive

text: of the European Parliament and of the Council. For further information on Digital Single Market see: https://ec.europa.eu/commission/priorities/digital-singlemarket_en. Proposal for a Directive of the European Parliament and of the Council on certain aspects concerning contracts for the supply of digital content, COM/2015/0634 final - 2015/0287 (COD). Recital 22 of the Proposal. See: Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee “A New Deal for Consumers”, COM(2018) 183 final, p. 5. Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee “A New Deal for Consumers”, COM(2018) 183 final, p. 5. Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee “A New Deal for Consumers”, COM(2018) 183 final, p. 4. Treaty on the Functioning of the European Union, OJ C 2012/26, 47, Art. 16 (2) TFEU: “The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities”. Treaty on European Union, OJ C 2012/326, p. 13. Z v Finland, no 22009/93, ECHR 1997-I, paragraph 95. EDPS Opinion 8/2016 on coherent enforcement of fundamental rights in the age of big data, 23 September 2016, p. 6.

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88. On the rights-based European approach to privacy and data protection with close relations to human dignity and self-determination, see for example, Consumer Privacy in Network Industries, A CERRE Policy Report, 26 January 2016, pp. 35-36.

text: See: Opinion of Advocate General Cruz Villalón in joined cases

text: and

text: Digital Rights Ireland and Seitlinger delivered 12 December 2013, par 57, ECR [2013] I-0000. Recital 7 of the GDPR. EDPS Opinion 4/2017 on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content, 14 March 2017, p. 9. “Personal data is the currency of today's digital market” speech by Vice Commissioner Reding, „The EU Data Protection Reform 2012: Making Europe the Standard Setter for Modern Data Protection Rules in the Digital Age – Innovation Conference Digital, Life, Design”, Munich, 22 January 2012. “Profit maximising firms do not provide products for free unless it helps them make money somewhere else”; Evans, D., S. (2011), The Antitrust Economics of Free, University of Chicago Working Paper No 555, 2011. EDPS Preliminary Opinion Privacy and competitiveness in the age of big data: The interplay between data protection, competition law and consumer protection in the Digital Economy, March 2014, p. 9. EDPS Opinion 4/2017 on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content, 14 March 2017. EDPS Opinion 4/2017 on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content, 14 March 2017, p. 9. See i.e. the German investigation into Facebook’s possible abuse of market power by infringing data protection rules, mentioned in the EDPS Opinion 8/2016, p. 13. Articles 12 and 13 of the Directive

text: . EDPS Opinion 7/2015 Meeting the challenges of big data, A call for transparency, user control, data protection by design and accountability, 19 November 2015, p. 12. EDPS Opinion 4/2017 on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content, 14 March 2017.

text: Article 7

text: (b) provides a legal ground in situations where “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.

text: Article 6(1)

text: (b) of the GDPR states that the processing shall be lawful only if “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”. EDPS Opinion 4/2017 on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content, 14 March 2017, p. 10. Directive

text: of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (“Directive on electronic commerce”), OJ L 178, 17.7.2000, p. 1. The definition of information society service already exists in Directive

text: of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations and of rules on information society services and in Directive

text: of the European Parliament and of the Council of 20 November 1998 on the legal protection of services based on, or consisting of, conditional access; this definition covers “any service normally provided for remuneration, at a distance, by means of electronic equipment for the processing (including digital compression) and storage of data, and at the individual request of a recipient of a service”. Indeed, EU law recognises a broad definition of a “service”. According to

text: Article 57

text: TFEU, “services shall be considered to be ‘services’ within the meaning of the Treaties where they are normally provided for remuneration”. Nevertheless, what is clear is that the CJEU recognised that the remuneration does not always have to be paid by the consumer(See: CJUE,

text: , Bond van Adverteerders and Others vs. The Netherlands State, 26 April 1988). This approach has been adopted in the above-mentioned e-commerce Directive.

text: Article 3 (2)

text: (a) of the GDPR states that “This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union(...)”. Article 3 (1) of the Council General Approach 9901/17 ADD 1 reads as follows: “This Directive shall apply to any contract where the supplier supplies or undertakes to supply digital content or a digital service to the consumer (…). It shall not apply (…) to the supply of digital content or a digital service for which the consumer does not pay or undertake to pay a price and does not provide or undertake to provide personal data to the supplier.

text: It shall also not apply where personal data are exclusively processed by the supplier for supplying the digital content or digital service, or for the supplier to comply with legal requirements to which the supplier is subject, and the supplier does not process these data otherwise.”. Article 3(7) of the Digital Content Proposal states that “If any provision of this Directive conflicts with a provision of another Union act governing a specific sector or subject matter, the provision of that other Union act shall take precedence over this Directive”. Article 6 of the GDPR states that: 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

text: Article 29

text: Working Party Opinion 15/2011 on the definition of consent,

text: WP 187

text: Article 29

text: WP 187

text: . EDPS Opinion 4/2017 on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content, 14 March 2017, p. 13. See for example the EDPS blogpost: “Accept and continue”: billions are clocking into digital sweat factories without realising it, 30 April 2018. The Italian Autorità Garante della Concorrenza e del Mercato assessed that WhatsApp had, inter alia, led consumers to grant broader consent than was necessary to continue using the service, and induced consumers to believe that they would not have access to the application should they have failed to accept the new terms and conditions. For further information see: Decision 11 May 2017, http://www.agcm.it/component/joomdoc/allegati-news/PS10601_scorrsanz_omi.pdf/download.html . Norwegian Consumer Council, Deceived by Design. How tech companies use dark patterns to discourage us from exercising our rights to privacy, 27 June 2018, p. 7.

text: Article 6(1)

text: (a) of the GDPR. The

text: Article 29

text: Working Party, “Guidelines on consent under Regulation 2016/679”,

text: rev.01. See also EDPS Opinion 4/2017 on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content, 14 March 2017, p. 17. Article 12 of the GDPR. Article 15 of the GDPR. Article 17(1) of the GDPR. Recital 68 and Art. 20 (1) of the GDPR. Directive

text: of the European Parliament and of the Council of 23 April 2009 on injunctions for the protection of consumers' interests, OJ L 110, 1.5.2009, p. 30. Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (“Directive on privacy and electronic communications”),OJ L 201, 31.7.2002, p. 37, specifically

text: Article 13

text: . Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive

text: (“Regulation on Privacy and Electronic Communications”), COM(2017) 010 final. EDPS Opinion 6/2017 on the Proposal for a Regulation on Privacy and Electronic Communications (ePrivacy Regulation), 24 April 2017, p. 35 EDPS Opinion 3/2018 on the online manipulation and the personal data, 19 March 2018, p. 21-22.

text: Article 21

text: (1a) of the Council document 9958/18, Examination of the Presidency text - Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive

text: (Regulation on Privacy and Electronic Communications), 12 June 2018, 2017/0003 (COD). The Digital Clearinghouse (DCH) is a voluntary network of authorities involved in enforcement of laws in digital markets, in particular the laws ensuring data protection, consumer protection and competition. The platform

text: is intended to facilitate cooperation, dialogue and exchange of best practices between authorities so as to achieve a coherent enforcement of laws and a better protection of the citizens in a Big Data and Artificial Intelligence era. EDPS Opinion 8/2016 on coherent enforcement of fundamental rights in the age of big data, 23 September 2016, p. 15.

text: Regulation (EU) 2017/2394

text: of the European Parliament and of the Council of 12 December 2017 on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing

text: Regulation (EC) No 2006/2004

text: , OJ L 345, 27.12.2017, p. 1. See also: https://ec.europa.eu/info/consumers/consumer-protection-cooperation-regulation/review-consumer-protectionregulation_en. The network has met twice in 2017 and a third meeting was held in June 2018. Regulators responsible for the enforcement of laws in the digital economy have discussed topics which include: general fairness of platform privacy policies, unfair or harmful terms and conditions in free online services, relevance of personal data in competition enforcement and merger control, as well as in consumer enforcement, connected things failing to meet basic standards for privacy by design and product safety and unethical, data collection and analysis for targeted marketing purposes. Cooperative scenarios were also explored including cooperation between consumer protection authorities, and between consumer and data protection authorities. For further information about the network and the meetings see: https://edps.europa.eu/data-protection/our-work/subjects/big-data-digitalclearinghouse_en . 39th ICDPPC Resolution on Collaboration between Data Protection Authorities and Consumer Protection Authorities for Better Protection of Citizens and Consumers in the Digital Economy, 27 September 2017. European Parliament resolution of 14 March 2017 on fundamental rights implications of Big Data: privacy, data protection, non-discrimination, security and law-enforcement, (2016/2225(INI). See: EDPS Preliminary Opinion “Privacy and competitiveness in the age of big data: The interplay between data protection, competition law and consumer protection in the Digital Economy”, March 2014, p. 36.

identifier: EDPS yttrande 08/2018

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion on the legislative package “A New Deal for Consumers”

serie: yttranden

text: EDPS Opinion 8/2018

type: rubrik

text: on the legislative package “A New Deal for Consumers”

text: 05 October 2018 1 | P a g e

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, ‘when adopting a legislative Proposal relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data...’, to consult the EDPS.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: 2 | P a g e

text: Executive Summary

text: This Opinion outlines the position of the EDPS on the legislative package entitled: “A New Deal for Consumers” that is composed of the Proposal for a Directive as regards better enforcement and modernisation of EU consumer protection rules and the Proposal for a Directive on representative actions for the protection of the collective interests of consumers.

text: The EDPS welcomes the intention of the Commission to modernise existing rules in an area whose goals are closely aligned to those of the recently modernised data protection framework. He recognises the need to fill the gaps in the current consumer acquis in order to respond to the challenge presented by predominant business models for digital services which rely on massive collection and monetisation of personal data and on the manipulation of people’s attention through targeted content. This is a unique opportunity to improve consumer law to redress the growing imbalance and unfairness between individuals and powerful companies in digital markets.

text: In particular, the EDPS supports the aim to extend the scope of Directive

text: in order to allow the consumers, who receive services not rendered against a monetary price, to benefit from the protection framework offered by this Directive, as this reflects today’s economic reality and needs.

text: The Proposal took into account the recommendations of the EDPS Opinion 4/2017 and refrains from using the term “counter-performance” or distinguishing between data “actively” or “passively” provided by consumers to suppliers of digital content. However, the EDPS notes with concern that the new definitions envisaged by the Proposal would introduce the concept of contracts for the supply of a digital content or digital service for which consumers can “pay” with their personal data, instead of paying with money. This new approach does not solve the problems caused by using the term “counter-performance” or by making an analogy between the provision of personal data and the payment of a price. In particular, this approach does not sufficiently take into consideration the fundamental rights nature of data protection by considering personal data as a mere economic asset.

text: The GDPR already laid down a balance regarding the circumstances under which the processing of personal data may take place in the digital environment. The Proposal should avoid promoting approaches that could be interpreted in a way inconsistent with the EU commitment to fully protect personal data as laid down in the GDPR. To provide broad consumer protection without risking to undermine the principles of data protection law, an alternative approach could be envisaged, such as based on the broad definition of a “service” from the e-commerce Directive, the provision defining the territorial scope of the GDPR or Article 3(1) of the Council General Approach on the Digital Content Proposal.

text: The EDPS therefore recommends refraining from any reference to personal data in the definitions of the “contract for the supply of digital content which is not supplied on tangible medium” and the “digital service contract” and suggests to rely instead on a concept of a contract under which a trader supplies or undertakes to supply specific digital content or a digital service to the consumer “irrespective of whether a payment of the consumer is required”.

text: 3 | P a g e

text: Furthermore, the EDPS draws attention to several potential interferences of the Proposal with the application of the EU data protection framework, in particular with the GDPR and provides recommendations.

text: First of all, the EDPS stresses that the processing of the personal data can only be done by the traders in accordance with the EU data protection framework, in particular the GDPR.

text: Second, the EDPS is concerned that if the concept of “contracts for the supply of a digital content or digital service for which consumers provide their personal data, instead of paying with money” were introduced by the Proposal, it could mislead service providers who would be led to believing that the processing of data based on consent in the context of a contract is legally compliant in all cases, even where the conditions for valid consent set out in the GDPR are not fulfilled. This would undermine legal certainty.

text: Third, the complex interplay between the right of withdrawal from the contract and the withdrawal of the consent for processing of personal data, as well as the obligation of the trader to reimburse the consumer in the event of withdrawal demonstrates the difficulties of reconciling the concept of “contracts for the supply of a digital content or digital service for which consumers provide their personal data, instead of paying with money” introduced by the Proposal with the fundamental right nature of personal data and the GDPR.

text: Also, the EDPS considers that the Proposal should amend

text: Article 3 of Directive 2011/83/EU

text: and introduce a provision that clearly states that in case of a conflict between the Directive

text: and the data protection legal framework, the latter prevails.

text: Furthermore, the EDPS also welcomes the new Proposal on collective redress, which intends to facilitate redress for consumers where many consumers are victims of the same infringement, in a so-called mass harm situation. The EDPS assumes that the redress mechanism envisaged in the Proposal on collective redress aims to be complementary to the one in Article 80 of the GDPR on representation of data subjects.

text: Nevertheless, to the extent personal data protection-related matters would be included in the scope of the collective action under the Proposal, the EDPS considers that “the qualified entities” that will be able to bring the representative actions in this field under the Proposal should be subject to the same conditions as set out in

text: Article 80

text: GDPR.

text: Along the same lines, the Proposal on collective redress should clarify that the representative actions regarding data protection issues can only be brought before administrative authorities that are the data protection supervisory authority within the meaning of Articles

text: and

text: GDPR.

text: In conclusion, the EDPS considers that the application of two different mechanisms on collective redress, to the GDPR and to the future e-Privacy Regulation, alongside other substantive points of interaction between consumer and data protection, requires more systematic cooperation between the consumer protection and data protection authorities that

text: 4 | P a g e

text: could be done, for instance, within the already existing voluntary network of the enforcement bodies from competition, consumer and data protection areas - the Digital Clearinghouse.

text: Finally, the EDPS welcomes the initiative to update the enforcement of consumer rules: the revision of the Consumer Protection Cooperation Regulation. In this context, the EDPS considers that it is important to further explore the synergies between the data protection and consumer law. The cooperation between the consumer protection and data protection authorities should become more systematic wherever specific issues that are of interest for both side arise, in which consumer welfare and data protection concerns appear to be at stake.

text: 5 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof, Having regard to

text: Regulation (EU) 2016/679

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles

text: and

text: (d) thereof, Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. On 11 April 2018, the European Commission (hereinafter “the Commission”) issued the Communication “A New Deal for Consumers” (hereinafter “the Communication”) together with two following legislative proposals:  proposal for a Directive amending

text: Council Directive 93/13/EEC

text: , Directive

text: , Directive

text: and Directive

text: as regards better enforcement and modernisation of EU consumer protection rules ;  proposal for a Directive on representative actions for the protection of the collective interests of consumers and repealing Directive

text: 2. The two proposals are to be seen as a package with common objectives, notably to:  modernise existing rules and fill the gaps in the current consumer acquis;  provide better redress opportunities for consumers, support effective enforcement and greater cooperation of public authorities in a fair and safe Single Market;  increase cooperation with partner countries outside the EU; 7 | P a g e  ensure equal treatment of consumers in the Single Market and guarantee that national competent authorities are empowered to tackle any problems with 'dual quality' of consumer products;  improve communication and capacity-building to make consumers better aware of their rights and help traders, especially small and medium-sized enterprises, to comply more easily with their obligations;  look at future challenges for consumer policy in a fast evolving economic and technological environment.

text: 3. More specifically, the Proposal as regards better enforcement and modernisation of EU consumer protection rules (hereinafter “the Proposal”) aims at making the improvements outlined below:  More effective, proportionate and dissuasive penalties for widespread crossborder infringements;  Right to individual remedies for consumers;  More transparency for consumers in online marketplaces;  Extending protection of consumers in respect of digital services;  Removing burdens for businesses;  Clarifying Member States' freedom to adopt rules on certain forms and aspects of off-premises sales;  Clarifying the rules on misleading marketing of “dual quality” products.

text: 4. Furthermore, the Proposal for a Directive on representative actions for the protection of the collective interests of consumers (hereinafter “the Proposal on collective redress”) intends to facilitate redress for consumers where many consumers are victims of the same infringement, in a so-called mass harm situation.

text: 5. At the time of the adoption of these two proposals, the EDPS was not consulted by the Commission.

text: 2. CONSUMER AND DATA PROTECTION: THE BROADER PICTURE

text: 6. Persuant to Article 38 of the Charter of Fundamental Right of the EU (hereinafter “the Charter”) Union policies shall ensure a high level of consumer protection. Consumer and data protection law share common goals of redressing imbalances of informational and market power, which have become more and more problematic with rapid development and concentration of digital markets .

text: 7. Together with competition law, whose function in the EU includes the prohibition of abuse of dominance by directly or indirectly imposing unfair purchase or selling prices or other unfair trading conditions, data protection and consumer protection need to work in a consistent manner to ensure that people are treated fairly. This should 8 | P a g e include deepening of dialogue and cooperation on cases of alleged violation of both consumer and data protection rules.

text: 8. Such dialogue and cooperation will, in the EDPS views, be of more practical benefit to individuals than any attempt to confuse the nature of personal data, as an aspect of human freedom and dignity to be treated at all times with respect, with assets to be traded in exchange for services or currency used to purchase services.

text: 9. While it appears to have become normal for personal data to be sought after as a commodity to be accumulated and monetized in the provision of digital, such practices should not gain any sort of de jure endorsement or recognition in a legislative act of the EU . Such a provision would be incompatible with the Charter, and it could have the effect of further entrenching unfairness and exacerbating imbalances. The commendable goal of redressing imbalances in these markets should rather be addressed through measures that increase, on the part of traders, accountability for actions and transparency about the transaction where digital services are offered, and the ability of consumers to control their personal data and to negotiate more favorable contractual terms.

text: 10. Since 2014 the EDPS has highlighted that “consumers are also data subjects, whose welfare may be at risk where freedom of choice and control over one’s own personal information is restricted” by the behavior of commercial companies. He has also pointed to evidence that presenting services as “free” is “deceptive and blinds consumers to the actual costs which they will experience “downstream” and distorts decision making, thereby harming both consumers and competition”. Although “price zero” has become a standard for web-based services, reducing personal data to a nonmonetary currency also risks oversimplifying how these markets function, failing to take into account the actual value exchange between consumer and trader. In modern digital markets, consumers appear to be not only surrendering their personal data but also their attention and freedom of expression.

text: 11. Authorities active in consumer protection and competition enforcement should be encouraged to work together and build on the experience of the Data Protection Authorities to ascertain the nature of this transaction between consumers and traders in digital markets where money is not the medium of exchange. They should collaborate to assess whether such transactions are “fair” under consumer, data protection and also potentially competition law, given that the notion of fairness is central to each of those legal regimes . Such transactions and the contracts governing them typically involve a requirement to disclose personal information or other terms which may prejudice the freedom or choice of the consumer. Arbitrary and unilateral and non-negotiable changes in contractual terms on the side of the trader should therefore be assessed by consumer and other authorities including data protection authorities and, in the case of dominant undertakings, antitrust authorities, in order to ascertain whether those changes are fair.

text: 12. The following analysis responds to specific concerns triggered by the Proposal and the Proposal on collective redress and should be understood in conjunction with the EDPS 9 | P a g e wider position on smarter and coherent cooperation among authorities in the digital economy .

text: 3. THE CONCEPT OF “CONTRACT FOR THE SUPPLY OF DIGITAL CONTENT OR DIGITAL SERVICE, FOR WHICH CONSUMERS PROVIDE THEIR PERSONAL DATA, INSTEAD OF PAYING WITH MONEY”

text: 3.1. Extending consumer protection to so-called “free services”

text: 13. The Proposal introduces a series of amendments to Directive

text: aiming in particular at completing the Digital Single Market and ensuring the consistency between the scope of application of Directive

text: and the Commission’s proposal for a Directive on certain aspects of contracts for the supply of digital content (hereinafter “the Digital Content Proposal”) .

text: 14. In particular,

text: Article 2 (1)

text: (d) of the Proposal amends

text: Article 2 of Directive 2011/83/EU

text: by adding a point 16 defining a “contract for the supply of digital content which is not supplied on tangible medium” as “a contract under which a trader supplies or undertakes to supply specific digital content to the consumer and the consumer pays or undertakes to pay the price thereof”. Furthermore, it also includes in the above definition “contracts where the consumer provides or undertakes to provide personal data to the trader, except where the personal data provided by the consumer is exclusively processed by the trader for the purpose of supplying the digital content, or for the trader to comply with legal requirements to which the trader is subject, and the trader does not process this data for any other purpose”.

text: 15. In similar way, the Proposal defines a “digital service contract” as a “contract under which a trader supplies or undertakes to supply a digital service to the consumer and the consumer pays or undertakes to pay the price thereof. This also includes contracts where the consumer provides or undertakes to provide personal data to the trader, except where the personal data provided by the consumer is exclusively processed by the trader for the purpose of supplying the digital service, or for the trader to comply with legal requirements to which the trader is subject, and the trader does not process this data for any other purpose”.

text: 16. As clarified in the explanatory memorandum of the Proposal, “these definitions bring within the scope of application of Directive

text: also contracts for the provision of digital services under which the consumer does not pay with money but provides personal data”.

text: 17. As such, Directive

text: already applies to contracts for the supply of digital content which is not supplied on a tangible medium, “regardless of whether the consumer pays a price in money or provide personal data”, but it does not apply to 10 | P a g e contracts for digital services “under which the consumer provides personal data to the trader without paying a price” . Therefore, the Proposal aims at extending the scope of Directive

text: to cover also contracts under which the trader supplies or undertakes to supply a digital service to the consumer, and the consumer provides or undertakes to provide personal data.

text: 18. Consequently, the intention of the Commission is to include in the scope of application of Directive

text: the so-called “free services” (e.g. cloud storage, social media and email accounts) and ensure that they are subject to the same requirements in terms of consumer protection .

text: 19. The Commission in its Communication considers that those services cannot be regarded as simply “free” given the increasing economic value of personal data. According to the aim of the Proposal in the Communication: “Another gap in consumer protection occurs in “free” digital services for which consumers provide their personal data, instead of paying with money. These 'free' services include cloud storage, social media and email accounts. Given the increasing economic value of personal data, those services cannot be regarded as simply 'free'. Consumers should therefore have the same right to pre-contractual information and to cancel the contract within a 14- day 'cooling off' period, regardless of whether they pay for the service with money or by providing personal data” .

text: 20. The EDPS recognises that, for the same services, consumers who receive services not rendered against a monetary price, which therefore fall outside the scope of EU consumer law, may face a lower level of consumer law protection than consumers who pay a monetary price for the service and therefore benefit from the EU consumer law protection. This differentiation seems unfair, taking into account the economic value that is extracted from consumers in digital markets.

text: 21. The EDPS welcomes the intention of the Commission to modernise existing rules and fill the gaps in the current consumer acquis in order to respond to current challenges such as emerging new business models, in which personal data and attention is being demanded from consumers wishing to access digital content or make use of digital services. In this context, the EDPS supports the aim to extend the scope of Directive

text: in order to allow the consumers, who receive services not rendered against a monetary price, to benefit from the protection framework offered by this Directive, as this reflects today’s economic reality and needs. 3.2. The existing data protection legal framework in the context of the Proposal

text: 22. With Article 16 (2) of the Treaty on the Functioning of the European Union (hereinafter “TFEU”) , the EU received a clear mandate and legal base to issue rules for the protection of personal data. As the right to data protection is also enshrined in Article 8 of the Charter of Fundamental Right of the EU (hereinafter “the Charter”), the EU legislator is required by Articles

text: and

text: Treaty on European Union (hereinafter “TEU”) to promote data protection in its external and internal policies. 11 | P a g e

text: 23. According to the case law of the European Court of Human Rights , the processing of personal data requires protection to ensure a person’s enjoyment of the right to respect for private life and freedom of expression and association . Detailed rights and obligations relating to the exercise of this fundamental right are regulated in the General Data Protection Regulation (hereinafter “GDPR”) .

text: 24. Without denying the existence of business models based on monetisation of (personal) data of internet users in today’s economy, the EDPS stresses that in the EU legal system, personal data cannot be conceived as a mere economic asset . It is one thing to recognise data personal data is highly valued by operators, their shareholders and investors. However, basing legislative definitions which treat personal data as “currency” is misguided. The EDPS considers that by introducing the concept of a contract that treats personal data just like a payment for the supply of digital content or digital service, the Proposal does not sufficiently take into consideration the nature of personal data under EU law as something to be protected. Individuals have a right to the protection of personal data because control over data concerning them is necessary for them to have freedom to develop their own personality. Given the rapid digitisation of the economy, individuals are entitled to an equivalent control over their digital personalities .

text: 25. In particular, it must be stressed that the conditions under which personal data can be used in the context of the supply of services, including the so-called “free services”, are already envisaged in the GDPR. The GDPR aims to enhance legal and practical certainty for natural persons and economic operators . The Proposal does not appear to sufficiently preserve the implementation of the GDPR and therefore may create legal uncertainty and undermine the full coherence of the legal framework applicable to the digital economy in the EU.

text: 26. As already stated in the EDPS Opinion 4/2017 , the EU legislator in the GDPR already laid down a careful balance regarding the circumstances under which the processing of personal data may take place in the digital environment. The Proposal should avoid promoting approaches that could be interpreted in a way inconsistent with the EU commitment to fully protect personal data as laid down in the GDPR. 3.3. Assessment of the analogy made between the payment of a price and the provision of personal data in a consumer contract

text: 27. With many digital services like email or search engines which are used by almost every internet user, providers foster the perception that those services are delivered “for free”. In reality, many such services are highly profitable to their providers, typically through related (targeted) advertising and other data monetisation models. However, individuals are in practice required to disclose valuable personal information to enjoy them. Consumers provide, often unwittingly, richly detailed information about their preferences through their online activities which permits individuals, not groups, to be 12 | P a g e targeted with far greater precision than ever before . Consequently, as already recognised by the EDPS in the past, personal information operates as a sort of indispensable “currency” used to pay for those services . However, the EDPS considers that even if personal data is de facto compared to the “currency”, it cannot, under EU law, be reduced by a formal view point to a means of exchange such as money (“a trader supplies or undertakes to supply” a specific digital content/digital service to the consumer and “the consumer provides or undertakes to provide personal data to the trader”).

text: 28. The EDPS recalls in this context the Digital Content Proposal, which intends to cover all contracts for the supply of digital content or digital services not only when consumers pay a price in exchange for such contents or services, but also when consumers do not pay a price but “actively provide personal data or other data as counter-performance”.

text: 29. In his Opinion 4/2017 , the EDPS expresses serious doubts about the use of the notion of “counter-performance” and of “actively provide personal data” in the context of the relationships between the consumers and the suppliers and sets out why this approach posed serious risks in relation to the GDPR.

text: 30. It is important to underline that while consumers are aware of the exact amount that they are paying when they pay with money, the same cannot be said about data . Markets for personal data are far from being transparent or fair. Problems of transparency and fairness in terms and conditions of several online services have been raised through some national investigations into social media and other online services .

text: 31. Furthermore, customers are generally unaware of the precise value of the personal data that they give away in exchange for “free” digital services. As a result, there is little possibility to evaluate the value of personal data , and therefore to “reimburse” the customers on the basis of the value of these data. In consequence, customers are many times not fairly compensated for their personal information .

text: 32. That is why the EDPS welcomes the fact that the Commission took into account the recommendations of the EDPS Opinion 4/2017 and refrains from using the term “counter-performance” or distinguishing between data “actively” or “passively” provided by consumers to suppliers of digital content. However, the EDPS notes with concern that the new definitions envisaged by the Proposal would introduce the concept of contracts for the supply of a digital content or digital service for which consumers can “pay” with their personal data, instead of paying with money.

text: 33. The EDPS would like to stress that this new approach does not solve the problems caused by using the term “counter-performance” or by making an analogy between the provision of personal data and the payment of a price. In particular, he considers that this new approach does not sufficiently take into consideration the 13 | P a g e fundamental rights nature of data protection by considering personal data as a mere economic asset.

text: 34. In conclusion, the EDPS considers that the proposed definitions of a “contract for the supply of digital content which is not supplied on tangible medium” and a “digital service contract” should be amended in order to avoid an explicit or implicit comparison of the provision of personal data to the payment of a price.

text: 35. In particular, such a comparison could circumvent the GDPR by potentially introducing a broad interpretation of the “processing necessary for the performance of the contract”, which is one of the legal grounds for processing personal data envisaged in

text: Article 6(1)

text: (b) of the GDPR (see section 3 below).

text: 36. As already set out in the EDPS Opinion 4/2017 , the broad definition of a “service” from Directive

text: (so-called “e-commerce Directive” ) that includes services where a price is not directly paid by the consumer, could be a possible solution to provide broad consumer protection at EU level while avoiding unnecessary tensions with the data protection principles .

text: 37. Another approach could take inspiration from the provision defining the territorial scope of the GDPR which refers to “the offering of goods and services, irrespective of whether a payment of the data subject is required”. Alternatively, the legislators could take on board Article 3 (1) of the Council General Approach on the Digital Content Proposal .

text: 38. The EDPS therefore recommends refraining from any reference to personal data in the definitions of the “contract for the supply of digital content which is not supplied on tangible medium” and the “digital service contract” and suggests to rely instead on a concept of a contract under which a trader supplies or undertakes to supply specific digital content/a digital service to the consumer “irrespective of whether a payment of the consumer is required”.

text: 4. THE INTERPLAY BETWEEN THE CONSUMER LAW AND THE DATA PROTECTION LEGAL FRAMEWORK

text: 4.1. The challenge of ensuring consumer law and data protection law are enforced in tandem in the context of the Proposal

text: 39. The Proposal illustrates the importance of ensuring that consumer law and data protection law are enforced in a mutually enhancing manner, particularly within the EU's online environment. The proposed amendments to Directive

text: should therefore complement and reinforce the GDPR.

text: 40. For example, in relation to the scope of Directive

text: Article 3(2) of Directive 2011/83/EU

text: provides that: “If any provision of this Directive conflicts with a provision 14 | P a g e of another Union act governing specific sectors, the provision of that other Union act shall prevail and shall apply to those specific sectors”. Despite the fact that the above mentioned provision aims to make clear the relationship between the Directive

text: and other Union acts, it does not take into account the existence of the Union acts that are not “governing specific sectors”, but still shall prevail.

text: 41. Such situation exists in case of the GDPR, which cannot be considered as “[u]nion act governing specific sectors” as it affects all organisations across all industries and sectors. In this regard, the EDPS notes that the Digital Content Proposal provides for an

text: Article 3(7)

text: which refers not only to Union act governing specific sectors but also governing a “subject matter”. In addition, the Council in its General Approach on the Digital Content Proposal introduces a paragraph 8 to the above mentioned Article according to which, “Union law on the protection of personal data applies to any personal data processed in connection with contracts referred to in paragraph 1. Union law on the protection of personal data applies to any personal data processed in connection with contracts referred to in paragraph 1.In particular, this Directive is without prejudice to the provisions of

text: Regulation (EU) 2016/679

text: and Directive

text: . In case of conflict between the provisions of this Directive and Union law on the protection of personal data, the latter prevails”.

text: 42. The EDPS considers that the Proposal should amend

text: Article 3 of Directive 2011/83/EU

text: 43. Furthermore, the EDPS notes that some elements of the Proposal could interfere with the application of the EU data protection framework, in particular the GDPR, as set out in the sections below. The EDPS would emphasise the importance of resolving these potential conflicts arising from the Proposal. 4.2. Legal grounds for processing of data in the context of the Proposal

text: 44. The processing of personal data can only take place according to principles laid down in Articles 8 of the Charter of Fundamental Rights and 16 TFEU, as further specified in the GDPR. Among other things, controllers are required to demonstrate that all processing activities have a valid legal basis. Under Article 6 of the GDPR, there are six legal bases for processing personal data .

text: 45. Understanding the correct lawful ground for all processing activity is an essential element of GDPR compliance. As stated in the

text: Article 29

text: Working Party Opinion 15/2011 , “any data processing must at all times be in conformity with one or more legal grounds. This does not exclude the simultaneous use of several grounds, provided they are used in the right context.” .

text: 46. The EDPS in his Opinion 4/2017 already provides an analysis of the possible grounds for processing of personal data in the context of a contract, and more 15 | P a g e specifically for the supply of digital content or digital service: the consent of the data subject (

text: Article 6(1)

text: (a)), the legitimate interest of the data controller (

text: Article 6(1)

text: (f)), the compliance with a legal obligation (e.g. compliance with obligations of conformity or data retention obligations) (

text: Article 6(1)

text: (c)) or the strictly interpreted performance of the contract (

text: Article 6(1)

text: (b)). The result of this analysis remains valid in the context of the Proposal.

text: 47. In particular, the EDPS considers the apparent reliance of data controllers offering digital services on necessity for the performance of a contract as a legal basis for processing personal data, evidenced by multiple communications with users requiring their acceptance of terms and conditions and privacy policies revised in the light of the GDPR, to be an urgent problem . It has been reported that many digital service providers are deploying “design tactics” or “dark patterns” to manipulate or deceive consumers into “consenting” to the new contractual term, although “consent” under data protection is a distinct legal basis for data processing which must be informed and freely given and, in the case of sensitive data, explicit . The EDPS considers the practice is of equal concern for the effectiveness of consumer and data protection law in the EU.

text: 48. In consequence, the EDPS recommends to include in the Proposal clear statement that the processing of the personal data by the traders will be done according to the EU data protection framework, in particular in line with the GDPR. The EDPS considers that the Recital 24 of the Proposal stating that “Any processing of personal data should comply with

text: Regulation (EU) 2016/679

text: ” is, in this context, not sufficient. 4.3. Consent for processing of data in the context of the Proposal

text: 49. One of the possible ground for processing of personal data in the context of a contract for the supply of digital content or digital service could be the consent of the data subject .

text: 50. Article 4 (11) of the GDPR defines “consent” as “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”. Consent is subject to additional requirements under the GDPR. Among other things,

text: Article 7(2)

text: provides that “when the data subject’s consent is given in the context of a written declaration which also concerns other matters”, for example a contract, consent must be separate from the consent needed for the conclusion of the contract. The EDPS stresses that contracts for the supply of digital content or digital service would also need to comply with Article 7(4) of the GDPR: “When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.”. The rule seems to provide a clear restriction of contracts that 16 | P a g e establish a link between the consent of the data subject and the provision of a service. Recital 43 of the GDPR specifies that “Consent is presumed not to be freely given (…) if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.”.

text: 51. In this context, the

text: Article 29

text: Working Party in its Guidelines on consent under the GDPR states in relation to

text: Article 7(4)

text: that tying or bundling consent with the acceptance of terms and conditions is “highly undesirable”. This kind of “conditionality” leads to a presumption of lack of freedom to consent (Recital 43 of the GDPR), which is only capable of being rebutted in “highly exceptional” circumstances. The Guidelines state that “to assess whether such a situation of bundling or tying occurs, it is important to determine what the scope of the contract or service is”. Furthermore, Recital 42 of the GDPR provides that “consent should not be regarded as freely given if the data subject has no genuine or free choice (to) consent” free consent signifies that a decision to agree is not under the control or influence of the data controller.

text: 52. In conclusion, the EDPS is concerned that if the concept of “contracts for the supply of a digital content or digital service for which consumers provide their personal data, instead of paying with money” were introduced by the Proposal, it could mislead service providers who would be led to believing that the processing of data based on consent in the context of a contract is legally compliant in all cases, even where the conditions for valid consent set out in the GDPR are not fulfilled . This would undermine legal certainty. 4.4. The interplay between the right of withdrawal from the contract and the withdrawal of the consent for processing of personal data

text: Article 9(1) of Directive 2011/83/EU

text: refers to the “right of withdrawal” and states that“(...) the consumer shall have a period of 14 days to withdraw from a distance or off-premises contract (...)”. However, the EDPS would like to stress that in case of a contract where “a trader supplies or undertakes to supply” a specific digital content or digital service to the consumer and “the consumer provides or undertakes to provide personal data to the trader” and which is based on consent of the data subject as the legal ground for processing of personal, the consequences of the withdrawal of the consent for processing of personal data may imply the withdrawal from or termination of a distance or off-premises contract, on condition that consent was already considered as free when it was provided to the trader.

text: 54. Article 7(3) of the GDPR prescribes that the data controller must ensure that consent can be withdrawn by the data subject as easy as giving consent and at any time. Consequently, the EDPS would like to stress that a period of 14 days to withdraw from the contract introduces by the Proposal cannot be considered as a restriction on the right to withdrawal of the consent at any time provided for in the GDPR. It is, therefore, not clear for the EDPS how the period of 14 days to withdraw from a 17 | P a g e distance or off-premises contract envisaged under the Proposal would interact with the right to withdraw consent for processing of personal data under the GDPR. 4.5. Obligations of the trader in the event of withdrawal

text: 55. The EDPS would like to recall that the GDPR provides the data subject (i.e. the consumer) with certain rights regarding the processing of the personal data: - the “right to be informed”, which gives every data subject the right to information about the collection and use of his or her personal data. This is a key transparency requirement under the GDPR ; - the “right to access” one’s data, which entails every data subject to access his or her personal data and certain information about the processing, which the controllers must provide. The data controller must also provide the data subject with a copy of the personal data being processed. This provision of the GDPR shall apply to any processing, including cases where no contract relationship exists, and without considerations pertaining to the use of data. Moreover, the information shall be provided for free and “in a commonly used electronic form”; - the “right to erasure” without undue delay applies, inter allias, where “the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed” and where “the data subject withdraws consent on which the processing is based according to point (a) of

text: Article 6(1)

text: , or point (a) of

text: Article 9(2)

text: , and where there is no other legal ground for the processing” ; - the “right to data portability”, which gives the right to retrieve one’s data “in a structured, commonly used and machine-readable format” but also to “transmit those data to another controller without hindrance”. However, the right to data portability does not apply in situations where the personal data processing is based on a legal ground other than consent or when it is necessary for the performance of a contract .

text: 56. In this context, the EDPS welcomes the introduction by the Proposal in the

text: Article 13

text: “Obligations of the trader in the event of withdrawal” [from the contract] of the Directive

text: point 4, which states that: “In respect of personal data of the consumer, the trader shall comply with the obligation applicable under

text: Regulation (EU) 2016/679

text: 57. Nevertheless,

text: Article 13 of Directive 2011/83/EU

text: refers also to the possible reimbursement for the consumer. In this context, the EDPS observes that it may not be possible to evaluate the value of personal data in the event of withdrawal from the contract. It is therefore questionable whether the Proposal could indeed ensure that consumers are fairly compensated. 18 | P a g e

text: 5. COLLECTIVE REDRESS MECHANISM

text: 58. The EDPS welcomes the new Proposal on collective redress repealing Directive

text: , which intends to facilitate redress for consumers where many consumers are victims of the same infringement, in a so-called mass harm situation. Article 2(1) of the Proposal on collective redress provides that “[t]his Directive shall apply to representative actions brought against infringements by traders of provisions of the Union law listed in Annex I that harm or may harm the collective interests of consumers. (...)”.Thus, its scope would cover all infringements by traders of Union law listed in Annex I that harm or may harm the collective interests of consumers in a variety of sectors such as financial services, energy, telecommunications, health and the environment.

text: 59. The EDPS welcomes that the GDPR and the Directive

text: concerning the processing of personal data and the protection of privacy in the electronic communications sector (hereinafter “Directive on privacy and electronic communications”) are included in the list of all EU legislative acts covered by the Proposal on collective redress in Annex 1 to the Proposal.

text: 60. In this context, the EDPS observes that the GDPR already contains elements of representative actions.

text: Article 80

text: GDPR grants data subject the right to “mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data”, under certain conditions, to exercise certain rights on behalf of the data subject. There is also the possibility for Member States to provide that these organisations may perform similar functions independently of a data subject’s mandate, at their own initiative if they consider that the rights of a data subject under the GDPR have been infringed as a result of the processing.

text: 61. With regard to the Directive on privacy and electronic communications, it is expected to be replaced by a proposal for a Regulation concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive

text: (hereinafter “Proposal for the e-Privacy Regulation”) , currently under negotiations. In the EDPS Opinion 6/2017 on the Proposal for a Regulation on Privacy and Electronic Communications (ePrivacy Regulation) as well as in the Opinion 3/2018 on the online manipulation and the personal data , the EDPS has recommended to introduce an explicit provision for collective redress and effective remedies or otherwise clarify the text of a Proposal for the e-Privacy Regulation, inter alia, by explicitly confirming the applicability of Article 80 of the GDPR. In this context, discussions are currently on-going on the possibility to introduce for the end-users the right to representation as provided for under Article 80 of the GDPR . 19 | P a g e

text: 62. The EDPS assumes that the redress mechanism envisaged in the Proposal on collective redress aims to be complementary to the one in Article 80 of the GDPR on representation of data subjects. As already mentioned, the scope of the Proposal on collective redress covers “representative actions brought against infringements by traders of provisions of the Union law listed in Annex I”, so all infringements by traders, and “that harm or may harm the collective interests of consumers”. Under the GDPR, a complaint can only be lodged when “the rights of a data subject under this Regulation have been infringed as a result of the processing”.

text: 63. Nevertheless, to the extent personal data protection-related matters would be included in the scope of the collective action under the Proposal, the EDPS considers that “the qualified entities” that will be able to bring the representative actions in this field under the Proposal should be subject to the same conditions as set out in

text: Article 80

text: GDPR. More specifically, pursuant to the GDPR, Member States may only allow the organisations that are “active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data” to represent the data subjects. However, the Proposal on collective redress currently does not give such guarantees as regards the data protection competencies of “the qualified entities”. This discrepancy should be rectified.

text: 64. Along the same lines, Article 5 of the Proposal on collective redress should clarify that the representative actions regarding data protection issues can only be brought before administrative authorities that are the data protection supervisory

text: 65. Finally, the EDPS considers that the application of two different mechanisms on collective redress, to the GDPR and to the future e-Privacy Regulation, alongside other substantive points of interaction between consumer and data protection, requires more systematic cooperation between the consumer protection and data protection authorities that could be done, for instance, within the already existing voluntary network of the enforcement bodies from competition, consumer and data protection areas - the Digital Clearinghouse .

text: 6. CONSUMER PROTECTION COOPERATION NETWORK

text: 66. The EDPS welcomes the new Consumer Protection Cooperation Regulation (hereinafter “the new CPC Regulation”) that was revised in order to update the enforcement of consumer rules so they are suitable for the digital age. The new CPC Regulation provides a framework for the co-operation between the different national enforcement authorities responsible for the sector-specific legislation that is covered by the CPC Regulation. The EDPS welcomes the fact that the Commission promotes the co-operation between the relevant national enforcement authorities through joint workshops and possibly in the future coordinated enforcement actions. 20 | P a g e

text: 67. In this context, it is important to mention that the Digital Clearinghouse set up by the EDPS, already brings together authorities from competition, consumer and data protection areas . As a voluntary network of enforcement bodies, the Digital Clearinghouse contributes to enhance their work and their respective enforcement activities and helps to deepen the synergies and the safeguarding of the rights and interests of individuals. The 2017 International Conference of Privacy and Data Protection Commissioners endorsed the Digital Clearinghouse in its resolution and called for greater cooperation between data protection and consumer authorities, as well as the European Parliament in its resolution of March 2017 on the fundamental rights implications of Big Data .

text: 68. Given the challenges related to the further development of the data protection and consumer law, the EDPS considers that it is important to further explore the synergies between both fields. The cooperation between the consumer protection and data protection authorities should become more systematic wherever specific issues that are of interest for both side arises, in which consumer welfare and data protection concerns appear to be at stake .

text: 7. CONCLUSION

text: On the Proposal:

text: 69. The EDPS welcomes the intention of the Commission to modernise existing rules and fill the gaps in the current consumer acquis in order to respond to current challenges such as emerging new business models, in which personal data is being demanded from consumers wishing to access digital content or make use of digital services.

text: 70. However, the EDPS notes with concern that the new definitions envisaged by the Proposal would introduce the concept of contracts for the supply of a digital content or digital service for which consumers can “pay” with their personal data, instead of paying with money. The EDPS would like to stress that this new approach does not solve the problems caused by using the term “counterperformance” or by making an analogy between the provision of personal data and the payment of a price. In particular, he considers that this new approach does not sufficiently take into consideration the fundamental rights nature of data protection by considering personal data as a mere economic asset. To provide broad consumer protection without risking to undermine the principles of data protection law, an alternative approach could be envisaged, such as based on the broad definition of a “service” from the e-commerce Directive, the provision defining the territorial scope of the GDPR or Article 3(1) of the Council General Approach on the Digital Content Proposal.

text: 71. The EDPS therefore recommends refraining from any reference to personal data in the definitions of the “contract for the supply of digital content which is not 21 | P a g e supplied on tangible medium” and the “digital service contract” and suggests to rely instead on a concept of a contract under which a trader supplies or undertakes to supply specific digital content or a digital service to the consumer “irrespective of whether a payment of the consumer is required”.

text: 72. In addition, the EDPS draws attention to several potential interferences of the Proposal with the application of the EU data protection framework, in particular with the GDPR and provides recommendations:  processing of the personal data can only be done by the traders according to the EU data protection framework, in particular in line with the GDPR;  if the concept of “contracts for the supply of a digital content or digital service for which consumers provide their personal data, instead of paying with money” were introduced by the Proposal, it could mislead service providers who would be led to believing that the processing of data based on consent in the context of a contract is legally compliant in all cases, even where the conditions for valid consent set out in the GDPR are not fulfilled. This would undermine legal certainty;  a period of 14 days to withdraw from the contract introduces by the Proposal cannot be considered as a restriction on the right to withdrawal of the consent at any time provided for in the GDPR;  it may not be possible to evaluate the value of personal data in the event of withdrawal from the contract. It is therefore questionable whether the Proposal could indeed ensure that consumers are fairly compensated.

text: 73. Finally, the EDPS considers that the Proposal should amend

text: Article 3 of Directive 2011/83/EU

text: and the data protection legal framework, the latter prevails. On the Proposal on collective redress:

text: 74. The EDPS welcomes the new Proposal on collective redress, which intends to facilitate redress for consumers where many consumers are victims of the same infringement, in a so-called mass harm situation.

text: 75. Nevertheless, to the extent personal data protection-related matters would be included in the scope of the collective action under the Proposal, the EDPS considers that “the qualified entities” that will be able to bring the representative actions in this field under the Proposal should be subject to the same conditions as set out in

text: Article 80

text: GDPR.

text: 76. Along the same lines, the Proposal on collective redress should clarify that the representative actions regarding data protection issues can only be brought before administrative authorities that are the data protection supervisory authority within the meaning of Articles

text: and

text: GDPR. 22 | P a g e

text: 77. The EDPS also considers that the application of two different mechanisms on collective redress, to the GDPR and to the future e-Privacy Regulation, alongside other substantive points of interaction between consumer and data protection, requires more systematic cooperation between the consumer protection and data protection authorities that could be done, for instance, within the already existing voluntary network of the enforcement bodies from competition, consumer and data protection areas - the Digital Clearinghouse. On the revision of the Consumer Protection Cooperation Regulation:

text: 78. The EDPS welcomes the initiative to update the enforcement of consumer rules: the revision of the Consumer Protection Cooperation Regulation.

text: 79. In this context, the EDPS considers that it is important to further explore the synergies between the data protection and consumer law. The cooperation between the consumer protection and data protection authorities should become more systematic wherever specific issues that are of interest for both side arise, in which consumer welfare and data protection concerns appear to be at stake. Brussels, 05 October 2018 Giovanni BUTTARELLI 23 | P a g e

text: Notes

text: 24 | P a g e

text: 25 | P a g e

text: 26 | P a g e

text: 27 | P a g e