ECJ Decision VKI v Amazon

In Verein für Konsumenteninformation v Amazon EU Sarl (Case C-191/15), the Court of Justice of the European Union (CJEU) has reaffirmed the position with regards to which member state’s data protection laws should apply in a situation where there is a company established in one member state that provides services to consumers based in various other member states. The CJEU also held that a contractual standard term which chose a supplier’s member state law as the governing law, rather than the consumer’s, was unfair towards consumers.

Amazon EU Sarl (“Amazon”), a company incorporated in Luxembourg, conducted sales with Austrian consumers remotely through a website called amazon.de. Amazon had no registered office or branch in Austria. The standard terms, which allowed Amazon to use personal data supplied by the consumers when purchasing, including information such as customer reviews and the like, stated that the contractual governing law was that of Luxembourg. Verein fur Konsumenteninformation (“VKI”), a consumer protection body, applied to the Austrian court for an injunction to prevent the use of these standard terms. The case travelled up to the Austrian Supreme Court on appeal. The Austrian Supreme Court was uncertain about the interpretation of certain laws applicable to the proceedings and referred several question to the CJEU.

The CJEU held that both Rome Regulation I and II should be interpreted such that the law which applies, where injunction action is brought against the use of unfair contractual terms between member states, should be determined in accordance with the Rome II Convention. Article 6(1) of the Rome II Convention provides that the law applicable to a non-contractual obligation arising out of an act of unfair competition shall be the law of the country where the interests of consumers are, or are likely to be, affected, which in this case is Austria. The CJEU also held that the law applicable to an assessment of a specific contractual term should be determined in accordance with the Rome I Convention, whether that assessment is made as a result of an individual or collective action.

The CJEU stated that, where a contract has not been individually negotiated, a governing law term is unfair insofar as it gives the consumer the incorrect impression that only the law of the supplier member state governs the contract and does not inform the consumer that under the Rome I Regulation, the consumer also has the benefit of the mandatory provisions of law that would apply in the absence of a governing law term, which is an issue for the national court to determine.

Article 4(1)(a) of the Data Protection Directive (Directive 95/46/EC) provides that each member state shall apply its own data protection legislation to the processing of personal data where data processing is carried out in the context of the activities of an establishment of the data controller in the territory of the member state. The Austrian court sought guidance on whether this meant that the processing of personal data by an undertaking in the context of e-commerce should be governed by the law of the member state to which that undertaking directs its commercial activities, or where the undertaking itself was established.

The CJEU has previously given guidance on the concept of ‘establishment’ in Weltimmo s.r.o. v Nemzeti Adatvedelmi es Informacioszabadsag Hatsosag - Case C-230/14 (“Weltimmo”) where it was held in the judgment that the concept of ‘establishment’ extends to any “real and effective activity, even a minimal one, exercised through stable arrangements”.  

The CJEU referred to the judgment it gave in Weltimmo and held that it is for the national court of the relevant member state to decide whether data processing was carried out in the context of an establishment situated in a member state. Therefore, in VKI v Amazon it will be for the Austrian court to decide whether Amazon carried out the relevant data processing in the context of activities of an establishment situation in a member state other than Luxembourg and we await that decision.

Companies will need to consider whether their standard form of governing law clause is unfair towards consumers. If so, and these clauses need to be updated, they should be drafted so as to clearly inform the consumer that they have the benefit of the mandatory consumer protections in their country of residence. Regarding the data processing aspect of the judgment, the CJEU affirmed the decision in Weltimmo, although by referring the ultimate decision back to the national courts, and it is clear that cases such as these will continue to turn on the individual circumstances and facts. 

This post come to us from Robert Bond of Charles Russell Speechlys.