With his Opinion n. 8/2018 on the proposal to amend Directive 2011/83/EU, The European Data Protection Supervisor (EDPS) recognises the need to close the regulatory loopholes highlighted by the new business models based on the massive collection and monetization of personal data in order to create targeted advertising content. In particular, the EDPS approved the proposal to extend the scope of the directive to guarantee protection for consumers which is consistent with today’s economic reality and needs.
So, attention was focused on the fact that nowadays various digital services which are (formally) “free” in name only, in reality regard the supply or transfer of personal data as “counter-performance”. Such conduct on the part of digital operators, which is more or less familiar to the user, is difficult to control: in fact any nonacceptance of this practice leads to the consumer being excluded from the service in most cases. Therefore the EDPS considered it appropriate to emphasize that extension of the scope of Directive 2011/83/EU would integrate the rights of consumers with European data protection principles, already widely established and regulated by Reg. 2016/679/EU (GDPR).
The European Supervisor also suggested that any reference to the notion of “contract for the provision of digital content not provided on tangible support” and “Digital service contract” should be avoided in the new text. There might be the risk that such notions mislead digital service providers and lead them to believe that the processing of personal data based on contractual consent is always legitimate, even in situations where contractual consent is not a valid legal basis for processing under the GDPR.
Moreover, according to the Opinion of the EDPS, if the orientation expressed in the draft was adhered to, personal data would be conceived as a mere economic asset, without any recognition of their intrinsic nature as a fundamental right. So, an alternative definition was proposed, based on a specific idea of a contract on the basis of which an economic operator provides, or undertakes to provide, the consumer with specific digital content or services “regardless of whether a payment (of the consumer) is required or not”.
The EDPS also clarified that the planned period of 14 days to withdraw from a distance or off-premises contract cannot be considered under any circumstances, as a limitation to the right to withdraw consent guaranteed by art. 7, par. 3 of Reg. 2016/679/EU.
In addition, the EDPS considered it worthwhile to propose an amendment to art. 3 of Directive 2011/83/UE, introducing a provision which clearly states the prevalence of the GDPR in case of conflict with the amended version of Directive 2011/83/UE.
Finally, the Authority welcomed the new Proposal on class action, which intends to facilitate redress for consumers when many consumers are victims of the same infringement, a so-called “mass harm” situation. It was considered that the redress mechanism envisaged in the Proposal to amend the Directive is complementary to that established by art. 80 of the GDPR.
On the whole, the EDPS has therefore welcomed the Commission’s intention to modernise the existing rules and fill the gaps in the current consumer legislation. In particular, the Authority has welcomed the effort to counter the new emerging contractual models, in which “compensation” for access to digital content or services is identified as the sale and use of personal data of consumers.
