Saturday 20 August 2016

Which data protection and consumer law applies to Amazon? Comments on the VKI v Amazon judgment

Lorna Woods, Professor of Internet Law, University of Essex

The recent CJEU judgment in VKI v Amazon concerns jurisdiction both in the context of conflict of laws (applicable consumer laws) and the Data Protection Directive.  Essentially, the Court of Justice had to decide which Member State’s data protection law should apply where goods are sold across national borders but within the EU. In this, it forms part of a stream of case law (both decided and pending), dealing with the powers of states (and their institutions) to protect those within their boundaries notwithstanding the digital internal market.


The case concerned Amazon, a well-known large company engaged in on-line selling. It has a branch established in Luxembourg.  It has a domain name ending ‘.de’ and there is a German language page.  It concludes sales with customers in Austria. The company has no registered address in Austria.  Whenever a customer buys goods via Amazon the transaction is governed by Amazon’s unilaterally imposed standard terms and conditions. One term in the agreement is that the law applicable to the contract is that of Luxembourg. 

A consumer protection body in Austria (VKI) sought to challenge this: Austrian law provides higher protection for the consumer than the equivalent Luxembourgish law and it sought to injunct Amazon on the basis of Directive 2009/22/EC on injunctions for the protection of consumers’ interests through an action brought before the Austrian courts. Amazon countered that it has no legal connection with Austria – it is not established there.  While there were questions regarding the applicable law and the fairness of the jurisdiction clause in the contract in the light of the Unfair Contract Terms Directive, there was another issue concerning data protection. There were clauses in Amazon’s standard terms and conditions which indicated that data might be exchanged with credit-risk assessment and financial services companies in Germany and Switzerland.  Again VKI argued that Austrian data protection rules should apply.

Questions Referred

While on the face of it, the matter might seem to be one of contract law therefore governed by the Rome I Regulation on the law applicable to contractual obligations, the form of relief sought – the injunction – might seem to bring the question within the Rome II Regulation, which regulates the law applicable to non-contractual obligations – a fact which might affect the outcome in the case.  The national court asked whether an action for an injunction fell within Rome II and if so, where the damage might said to have taken place so as determine jurisdiction.  Irrespective of the outcome to that question, the referring court also asked about the impact of the Unfair Contract Terms Directive on the jurisdiction clause. It likewise also wanted to know whether the processing of data should be regulated by Luxembourg alone, or must the processor ‘also comply with the data protection rules of those Member States to which its commercial activities are directed?’


The ECJ dealt with the questions on Rome I and II together.  It noted that they should be interpreted consistently with one another, as well as the Brussels I Regulation (which concerns the separate question of which country’s court has jurisdiction in cross-border cases).  The Court referred to its previous case law in relation to the previous Brussels Convention, and the Brussels I Regulation replacing the Convention, to conclude that an action for injunction within the terms of Directive 2009/22/EC (on the protection of consumers’ interests) falls within the meaning of a non-contractual obligation for the purposes of Rome II.  Article 6 of the Rome II Regulation deals with unfair competition.  In that circumstance, the law applicable is that ‘of the country where competitive relations or the collective interests of consumers are, or are likely to be, affected’.  The Court followed the Advocate General (Opinion, para 73) to hold that Article 6(1) covers the use of unfair terms inserted in standard terms and conditions, as ‘this is likely to affect the collective interests of consumers as a group and hence to influence the conditions of competition on the market’ (para 42). Here the relevant country is that where the consumers to whom the undertaking directs its activities reside and who are protected by the relevant consumer protection body (para 43).

Article 4(3) of the Rome II Regulation states that the law of another country applies if it is clear that the tort is manifestly more closely connected with it.  The ECJ approved the approach of the Advocate General (para 77) where he advised that Article 4(3) is not well suited to unfair competition. Article 6 is aimed at protecting collective interests and cannot be displaced by individual agreement (para 45).  Allowing the term of a contract to constitute ‘closer connection’ for the purposes of Article 4(3) would mean that such parties would be able to avoid the conditions for ‘freedom of choice’ set down in Article 14 Rome II.

The question of which law applies to the assessment of the unfairness of the contractual terms, however, falls under Rome I, whether or not it applies to a collective or individual action.

The Court then considered the Unfair Contract Terms Directive (Directive 93/13). That Directive contains the principle that a contractual term which has not been individually negotiated – that is, drafted in advance by the seller/supplier - must be regarded as unfair if it causes a significant imbalance to the detriment of the consumer. The Court agreed with the Advocate General (Opinion para 84) that the terms in issue here fell within that definition (para 63). The question of unfairness is to be determined on the facts by the national court within the scope of criteria determined by the Court of Justice. Since choice of law clauses are in principle permissible, such clauses are only unfair if its wording or context creates an imbalance – so if it is not drafted in intelligible language or if it seeks to deprive consumers of protections from which it would not be possible to derogate.  Here, this means that in relation to an Austrian consumer, the national court will ‘have to apply those Austrian statutory provisions which, under Austrian law, cannot be derogated from by agreement’ (para 70).

The Court then turned to Article 4 of the Data Protection Directive. Under Article 4, each Member State regulates processing carried out in the context of activities of an establishment in that Member State. Essentially the question is whether Amazon was established in Austria. The Court referred to its recent Weltimmo judgment, discussed here, which ruled that an undertaking does not need to have a branch or establishment.  Rather, it is a question of the stability of the arrangement and the effective exercise of activities (para 77) that is important.  Further, Article 4 does not require that the processing is carried out by the undertaking itself; the test is whether processing is carried out in the context of its activities (para 78).  This is a question of fact for the national court.


In terms of the importance of this judgment, we should note that the facts in issue are not uncommon – many on-line businesses have headquarters in one Member State but conclude contracts across multiple Member States. 

As regards the questions relating to applicable laws generally, we are now in a situation where national courts may have to assess questions pertaining to injunctions according to a different law from that relating to the contract itself.  This is not surprising, given case law in other fields, but it is the first confirmation of this point in the e-commerce context.  As an aside, it is also the first judgment on the Directive on injunctions for the protection of consumers’ interests.  It is worth noting that the Court seemed critical of attempts to bypass the protection in Article of 6 Rome II through the notion of ‘manifestly closer connection’ in Article 4(3).  It also specifically excluded the choice of law clause in the agreement as a determining factor in this regard too.

Perhaps the most interesting aspect is, however, the data protection aspect.  The Court did not go into much detail (perhaps signalling behind the scenes disagreement) and there are some curious silences as to some points touched upon by the Advocate General.  The Advocate General had in fact suggested that Article 4 had a ‘dual role’ (Opinion para 110).  So while Weltimmo might apply to determine applicable law, the broad approach to ‘establishment’ found in GoogleSpain to determine the outer territorial limit of the Data Protection Directive did not apply to the intra-EU setting.  The driver for the decision in GoogleSpain was a desire to ensure that the Data Protection Directive applied at all; it was therefore relevant to external processors (Opinion, para 124).  In this case, if the Austrian laws did not apply then the laws of one of the other Member States would and so the extensive approach would not be necessary.  This distinction was an innovation on the part of the Advocate General; it was certainly not visible in Weltimmo in which the Court relied on its reasoning in GoogleSpain, and nor was it apparent from GoogleSpain.  Further, the Advocate General seemed to be more stringent about finding ‘establishment’ than the Court in Weltimmo.  For example, the fact that Amazon may provide an aftersales service in Austria on its own was insufficient in his view (Opinion, paras 121 and 125); he also discounted the possibility that the accessibility of a website was likewise insufficient for this purpose (Opinion, paras 117 and 120). 

Against this background, the silence of the ECJ on the internal/external point is striking, especially given the repeated references to the Opinion through the rest of its judgment.  So is its silence on the subject of GoogleSpain. The Court’s reasoning is grounded only on Weltimmo.  On the one hand, we could argue that the Court has not agreed with the distinction put forward by the Advocate General, but by not applying GoogleSpain directly here, it has not ruled it out either. Note that the Article 29 Working Party (the advisory body set up by the data protection Directive) had applied the extensive interpretation from GoogleSpain in its updated Opinion 8/2010. The Court here also gave no further guidance on the topic of establishment, taking convenient refuge no doubt in the point that its role is to interpret EU law and not to assess facts.

Photo credit: 

1 comment: