Lorna Woods, Professor of Internet Law, University of Essex
The recent CJEU judgment
in VKI v Amazon concerns jurisdiction
both in the context of conflict of laws (applicable consumer laws) and the Data
Protection Directive. Essentially,
the Court of Justice had to decide which Member State’s data protection law
should apply where goods are sold across national borders but within the EU. In
this, it forms part of a stream of case law (both decided and pending), dealing
with the powers of states (and their institutions) to protect those within
their boundaries notwithstanding the digital internal market.
Facts
The case concerned Amazon, a well-known
large company engaged in on-line selling. It has a branch established in
Luxembourg. It has a domain name ending
‘.de’ and there is a German language page.
It concludes sales with customers in Austria. The company has no
registered address in Austria. Whenever
a customer buys goods via Amazon the transaction is governed by Amazon’s
unilaterally imposed standard terms and conditions. One term in the agreement
is that the law applicable to the contract is that of Luxembourg.
A consumer protection body in
Austria (VKI) sought to challenge this: Austrian law provides higher protection
for the consumer than the equivalent Luxembourgish law and it sought to injunct
Amazon on the basis of Directive
2009/22/EC on injunctions for the protection of consumers’ interests through
an action brought before the Austrian courts. Amazon countered that it has no
legal connection with Austria – it is not established there. While there were questions regarding the
applicable law and the fairness of the jurisdiction clause in the contract in
the light of the Unfair
Contract Terms Directive, there was another issue concerning data
protection. There were clauses in Amazon’s standard terms and conditions which
indicated that data might be exchanged with credit-risk assessment and
financial services companies in Germany and Switzerland. Again VKI argued that Austrian data
protection rules should apply.
Questions Referred
While on the face of it, the
matter might seem to be one of contract law therefore governed by the Rome
I Regulation on the law applicable to contractual obligations, the form of
relief sought – the injunction – might seem to bring the question within the Rome
II Regulation, which regulates the law applicable to non-contractual obligations – a fact which might affect the outcome
in the case. The national court asked
whether an action for an injunction fell within Rome II and if so, where the
damage might said to have taken place so as determine jurisdiction. Irrespective of the outcome to that question,
the referring court also asked about the impact of the Unfair Contract Terms
Directive on the jurisdiction clause. It likewise also wanted to know whether
the processing of data should be regulated by Luxembourg alone, or must the
processor ‘also comply with the data protection rules of those Member States to
which its commercial activities are directed?’
Judgment
The ECJ dealt with the questions
on Rome I and II together. It noted that
they should be interpreted consistently with one another, as well as the Brussels
I Regulation (which concerns the separate question of which country’s court has jurisdiction in cross-border
cases). The Court referred to its
previous case law in relation to the previous Brussels Convention, and the Brussels
I Regulation replacing the Convention, to conclude that an action for
injunction within the terms of Directive 2009/22/EC (on the protection of
consumers’ interests) falls within the meaning of a non-contractual obligation
for the purposes of Rome II. Article 6
of the Rome II Regulation deals with unfair competition. In that circumstance, the law applicable is
that ‘of the country where competitive relations or the collective interests of
consumers are, or are likely to be, affected’.
The Court followed the Advocate General (Opinion,
para 73) to hold that Article 6(1) covers the use of unfair terms inserted in
standard terms and conditions, as ‘this is likely to affect the collective
interests of consumers as a group and hence to influence the conditions of
competition on the market’ (para 42). Here the relevant country is that where
the consumers to whom the undertaking directs its activities reside and who are
protected by the relevant consumer protection body (para 43).
Article 4(3) of the Rome II Regulation
states that the law of another country applies if it is clear that the tort is
manifestly more closely connected with it.
The ECJ approved the approach of the Advocate General (para 77) where he
advised that Article 4(3) is not well suited to unfair competition. Article 6
is aimed at protecting collective interests and cannot be displaced by
individual agreement (para 45). Allowing
the term of a contract to constitute ‘closer connection’ for the purposes of
Article 4(3) would mean that such parties would be able to avoid the conditions
for ‘freedom of choice’ set down in Article 14 Rome II.
The question of which law applies
to the assessment of the unfairness of the contractual terms, however, falls
under Rome I, whether or not it applies to a collective or individual action.
The Court then considered the
Unfair Contract Terms Directive (Directive 93/13). That Directive contains the
principle that a contractual term which has not been individually negotiated –
that is, drafted in advance by the seller/supplier - must be regarded as unfair
if it causes a significant imbalance to the detriment of the consumer. The
Court agreed with the Advocate General (Opinion para 84) that the terms in
issue here fell within that definition (para 63). The question of unfairness is
to be determined on the facts by the national court within the scope of
criteria determined by the Court of Justice. Since choice of law clauses are in
principle permissible, such clauses are only unfair if its wording or context
creates an imbalance – so if it is not drafted in intelligible language or if
it seeks to deprive consumers of protections from which it would not be
possible to derogate. Here, this means
that in relation to an Austrian consumer, the national court will ‘have to
apply those Austrian statutory provisions which, under Austrian law, cannot be
derogated from by agreement’ (para 70).
The Court then turned to Article
4 of the Data Protection Directive. Under Article 4, each Member State
regulates processing carried out in the context of activities of an
establishment in that Member State. Essentially the question is whether Amazon
was established in Austria. The Court referred to its recent Weltimmo judgment, discussed here,
which ruled that an undertaking does not need to have a branch or
establishment. Rather, it is a question
of the stability of the arrangement and the effective exercise of activities
(para 77) that is important. Further,
Article 4 does not require that the processing is carried out by the
undertaking itself; the test is whether processing is carried out in the
context of its activities (para 78).
This is a question of fact for the national court.
Comment
In terms of the importance of
this judgment, we should note that the facts in issue are not uncommon – many
on-line businesses have headquarters in one Member State but conclude contracts
across multiple Member States.
As regards the questions relating
to applicable laws generally, we are now in a situation where national courts
may have to assess questions pertaining to injunctions according to a different
law from that relating to the contract itself.
This is not surprising, given case law in other fields, but it is the
first confirmation of this point in the e-commerce context. As an aside, it is also the first judgment on
the Directive on injunctions for the protection of consumers’ interests. It is worth noting that the Court seemed
critical of attempts to bypass the protection in Article of 6 Rome II through
the notion of ‘manifestly closer connection’ in Article 4(3). It also specifically excluded the choice of
law clause in the agreement as a determining factor in this regard too.
Perhaps the most interesting
aspect is, however, the data protection aspect.
The Court did not go into much detail (perhaps signalling behind the
scenes disagreement) and there are some curious silences as to some points
touched upon by the Advocate General.
The Advocate General had in fact suggested that Article 4 had a ‘dual
role’ (Opinion para 110). So while Weltimmo might apply to determine
applicable law, the broad approach to ‘establishment’ found in GoogleSpain
to determine the outer territorial limit of the Data Protection Directive did
not apply to the intra-EU setting. The
driver for the decision in GoogleSpain
was a desire to ensure that the Data Protection Directive applied at all; it
was therefore relevant to external processors (Opinion, para 124). In this case, if the Austrian laws did not
apply then the laws of one of the other Member States would and so the
extensive approach would not be necessary.
This distinction was an innovation on the part of the Advocate General;
it was certainly not visible in Weltimmo
in which the Court relied on its reasoning in GoogleSpain, and nor was it apparent from GoogleSpain. Further, the
Advocate General seemed to be more stringent about finding ‘establishment’ than
the Court in Weltimmo. For example, the fact that Amazon may provide
an aftersales service in Austria on its own was insufficient in his view
(Opinion, paras 121 and 125); he also discounted the possibility that the
accessibility of a website was likewise insufficient for this purpose (Opinion,
paras 117 and 120).
Against this background, the
silence of the ECJ on the internal/external point is striking, especially given
the repeated references to the Opinion through the rest of its judgment. So is its silence on the subject of GoogleSpain. The Court’s reasoning is
grounded only on Weltimmo. On the one hand, we could argue that the
Court has not agreed with the distinction put forward by the Advocate General,
but by not applying GoogleSpain
directly here, it has not ruled it out either. Note that the Article 29 Working
Party (the advisory body set up by the data protection Directive) had applied
the extensive interpretation from GoogleSpain
in its updated
Opinion 8/2010. The Court here also gave no further guidance on the topic
of establishment, taking convenient refuge no doubt in the point that its role
is to interpret EU law and not to assess facts.
Photo credit:
www.creativeintent.co.uk
thanks
ReplyDelete