EXCLUSIVE / Digital services that collect users’ data, like Facebook and Gmail, will be pulled under EU consumer protection rules as part of a European Commission overhaul due next month. Possible sanctions will be raised to up to 4% of a company’s turnover.
A major overhaul of EU consumer rules is set to extend the bloc’s existing laws to services that collect users’ data as payment instead of money, according to a leaked draft of the proposal that EURACTIV has obtained.
The initiative from Brussels comes as Facebook is embroiled in a data privacy scandal of unprecedented magnitude. The European Parliament announced on Monday (19 March) that it will investigate allegations that millions of Facebook users’ data was misused without their knowledge.
European Commission President Jean-Claude Juncker announced the legal change during his annual state of the union speech last September.
The draft was circulated within different Commission directorates this month, although the text is dated “2017” and still does not name a specific day for publication. The Commission is scheduled to announce the overhaul on 11 April.
“Given the increasing economic value of personal data, those services are not simply ‘free’,” the Commission’s proposal said.
Users that have not paid for email and social media, cloud storage, or online subscription platforms, will be given the right to receive information about the services before they sign up. They will also be to cancel their contracts within two weeks.
Current EU consumer rules date back to 2011 and apply only to services that are paid for with money.
But according to the Commission, there are now “similarities and the interchangeability of paid digital services and digital services provided in exchange for personal data”.
Services that collect personal data that is not “exclusively necessary for supplying the digital content or digital service” will be forced to comply with the law.
The Commission wants the rules to exclude services that only collect consumers’ metadata, such as their device’s IP address, but not more personal information. The proposal also exempts services that are required to collect certain data to comply with security laws.
Online marketplace transparency
Another measure in the overhaul requires online marketplaces to inform consumers about how they rank different search results.
This means that ecommerce retailers that sell products from other companies, such as Amazon’s Marketplace, will need to inform shoppers about any “default ranking criteria” that determine what search results they are shown, and in what order.
Online marketplaces will also need to explain whether they are buying from the platform directly or from a third party company. Platforms will not to display that information to shoppers clearly, and cannot bury it in the fine print of their terms and conditions.
Higher post-Dieselgate fines
In a move aimed at avoiding low fines like the ones that have been imposed against Volkswagen in some EU countries, the Commission overhaul will also give national consumer protection authorities the power to impose higher sanctions against companies that break the rules.
EU Justice Commissioner Vera Jourova has called for tougher sanctions against misbehaving firms.
Her proposal next month will step up potential fines to total 4% of a company’s turnover in each EU member state for “widespread infringements”.
The draft bill includes an explicit reference to the need for tougher enforcement measures because of “recent large-scale cross-border infringements of EU consumer law, such as the ‘Dieselgate’ scandal and massive flight cancellations”.
After it emerged in 2015 that Volkswagen used illegal software to cheat on emissions tests, the company was hit with fines in some EU countries, but at much lower rates than the firm was forced to pay in the United States.
The proposal allows EU member states to set the fine at an even higher rate than 4% of a company’s turnover if they want to, or they can determine a “fixed lump-sum, whichever is higher in the specific case”.
The Dutch consumer protection authority fined Volkswagen €450,000 last autumn – the highest amount possible under national law.
Some member states allow for higher sanctions. Italian authorities can impose fines of up to €5 million if a firm breaks national consumer protection law, and Poland can demand up to 10% of a company’s turnover.
The proposal for higher sanctions will likely appeal to consumer watchdog groups.
Last month, the European Consumer Organisation, an umbrella group representing national associations from EU countries, called for the Commission to set a minimum fine punishing consumer violations. The group demanded tougher sanctions in response to Jourova’s announcement that Facebook and Twitter do not comply with EU consumer rules.
The organisation’s director Monique Goyens said fines “should not be symbolic but a real deterrent, going up to a percentage of the company’s annual worldwide turnover”.