European Interest

EDPS calls for closer alignment between consumer and data protection rules in the EU

Flickr/European Parliament/CC BY-NC-ND 2.0
"With ‘free’ the preferred price for many digital markets, the consumer should be protected irrespective of whether a contract under which a trade supplies or undertakes to supply digital content or services requires payment," said Giovanni Buttarelli, EDPS.

Consumer law and data protection can no longer afford to work in silos. The EU needs a big-picture approach to addressing systemic harms to individuals in digital markets, involving closer cooperation between enforcers in order to avoid legal uncertainty, the European Data Protection Supervisor (EDPS) said, as he published his Opinion on the legislative package A New Deal for Consumers.

The package is composed of the Proposal for a Directive as regards better enforcement and modernisation of EU consumer protection rules and the Proposal for a Directive on representative actions for the protection of the collective interests of consumers. The Opinion follows consistent calls from the EDPS for coherent enforcement by authorities responsible for the digital economy and society, including consumer, data protection and competition authorities.

“I support the aim of the Proposal to extend benefits to consumers who receive services without paying a monetary price. With ‘free’ the preferred price for many digital markets, the consumer should be protected irrespective of whether a contract under which a trade supplies or undertakes to supply digital content or services requires payment. Consumer law, like data protection law, needs to be effective in dealing with the digitisation of people’s lives. Increasing the concentration and complexity of digital markets has diminished people’s ability, whether as consumers or as data subjects, to control their digital lives, including what happens to data about them. However, the solution is not to pretend that personal data is a mere economic asset. This means ensuring that there is no such reference to personal data in contract definitions for the supply of digital content or a digital service. Therefore, the safeguards under the Charter of Fundamental Rights and the GDPR must be upheld. Closer alignment between consumer and data protection will require policymakers, as well as regulators, to deepen their dialogue and mutual understanding,” said Giovanni Buttarelli, EDPS.

Consumer and data protection law share the common goal of redressing imbalances between the individual and powerful companies. It is therefore essential that the two bodies of law are fully aligned and mutually reinforcing.

The concept of contracts for the supply of digital content or services for which consumers pay with their personal data is problematic. Specifically, it fails to respect the need to protect personal data set out in the Charter of Fundamental Rights and risks being interpreted in a way that is inconsistent with certain GDPR provisions, such as those relating to valid consent for data processing and the necessity of data processing for the performance of a contract.

Furthermore, the EDPS recommends that the proposal on collective redress be adjusted to complement the provisions in the GDPR for the representation of data subjects in exercising their rights. This requires more systematic cooperation between consumer protection and data protection authorities, which could be done, for instance, within the already existing voluntary network of enforcement bodies from competition, consumer and data protection areas – the Digital Clearinghouse.

The rules for data protection in the EU institutions, as well as the duties of the European Data Protection Supervisor (EDPS), are set out in Regulation (EC) No 45/2001. The EDPS is a relatively new but increasingly influential independent supervisory authority with responsibility for monitoring the processing of personal data by the EU institutions and bodies, advising on policies and legislation that affect privacy and cooperating with similar authorities to ensure consistent data protection.

Giovanni Buttarelli (EDPS) and Wojciech Wiewiórowski (Assistant EDPS) are the members of the institution, appointed by a joint decision of the European Parliament and the Council. Assigned for a five year term, they took office on 4 December 2014.

Explore more