Authors:

 Cosmina Simion – Managing Partner, Simion Baciu Law Firm                   

Ana – Maria Corugă – Managing Associate, Simion Baciu Law Firm

Directive (UE) 2019/2161 amending Council Directive 93/13/EEC and Directives 98/6/EC, 2005/29/EC and 2011/83/EU (“Consumer Rights Directive”) as regards the better enforcement and modernisation of Union consumer protection rules (“Omnibus Directive”) have been adopted at EU level in November 27, 2019.

One of the key changes introduced by Omnibus Directive – and subject to this piece of information, resides in the extension of the Consumer Rights Directive scope of application to B2C agreements where the trader supplies or undertakes to supply digital content which is not supplied on a tangible medium or a digital service to the consumer and the consumer provides or undertakes to provide personal data to the trader. Two exceptions are regulated in this respect and concern the situations where the personal data provided by the consumer are exclusively processed by the trader (i) for the purpose of supplying the digital content which is not supplied on a tangible medium or digital service in accordance with the normative act or (ii) for allowing the trader to comply with legal requirements to which the trader is subject to, where the trader does not process such data for any other purpose.

In Romania, Omnibus Directive has been transposed within the national legislation through Government Emergency Ordinance no. 58/2022 amending and completing specific normative acts in the field of consumer protection (“GEO no. 58/2022”). The draft Law for approving GEO no. 58/2022 is, at the date of this article, pending debates within the Chamber of Deputies, as decisional chamber in the legislative process.

GEO no. 58/2022 has taken over the above referred provisions of Omnibus Directive and thus extended the scope of Government Emergency Ordinance no. 34/2014 on consumers rights within contracts concluded with professionals (“GEO no. 34/2014”), transposing into the national legislation the Consumer Rights Directive.

As a rule, before the date of entry into force of GEO no. 58/2022. GEO no. 34/2014 was applicable in relation to sales and service contracts having as object goods and/or services for which the consumer would have to pay a price in money.

Starting with May 28, 2022, GEO no. 34/2014 shall apply also to any long-distance contract under which a consumer is provided with digital content and/or digital services in exchange of personal data which are processed by the trader outside of the sole purpose of supplying the digital content or digital service to the consumer (execution of the contract) or of the trader’s necessity to comply with a legal obligation incumbent to the later.

In line with Omnibus Directive, GEO no. 34/2014 expressly provides for the obligation of the trader to comply with the obligations applicable under Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or “GDPR”).

Thus, it results that any long-distance contract under which the trader is providing the consumer with digital content or a digital service with the later not being obliged to pay a price but to provide however personal data shall fall under the legal requirements of GEO no. 34/2014 as long as the personal data are processed on other legal bases than the performance of a contract or compliance of the trader with a legal obligation.

Considering the dynamics of the digital market, specific attention should be drawn to the situations where digital content or a digital service is provided by a trader to the consumer who provides personal data on the basis of:

1. the consent given in this respect – in accordance with art. 6 paragraph (1) letter a) of GDPR;
2.  the legitimate interest pursued by a trader, as controller, or by a third party – in accordance with art. 6 paragraph (1) letter f) of GDPR.

As a first consequence of the regulation of new parameters under which one will determine whether a long-distance B2C contract having as object digital content or a digital service, without a price being required from the consumer, the trader shall be diligent in ensuring a proper qualification of the legal bases under which the personal data collected from the consumer are processed.

In any situation however, as expressly stressed by the European Data Protection Supervisor within Opinion no. 8/2018 on the legislative package “A New Deal for Consumers” (“EDPS Opinion 8/2018)[1], any processing operations of the personal data can only be done by the trader in accordance with the EU data protection framework, in particular the GDPR.

Within this Opinion 8/2018, issued with regard to the initial form of the draft Omnibus Directive (as part of the legislative package “A New Deal for Consumers”), EDPS has also underlined that the normative act should include an express provision to clearly state that in case of a conflict between the Consumers Rights Directive and the data protection legal framework, the latter shall prevail. Such a statement does not appear within the Omnibus Directive and national transposition legislation. However, under the principle of the primacy of Union Law, as a rule, the provisions of GDPR would prevail over any contrary national provisions, as the legal provisions transposing into the national legislation the Omnibus Directive.

In this context, EDPS drawn the attention over the fact that personal data must not be reduced to a non-monetary currency and must not be conceived as a mere economic asset, since protection of natural persons in relation to the processing of personal data is a fundamental right under both the Charter of Fundamental Rights of the European Union and the Treaty on the Functioning of the European Union.

Furthermore, traders shall be precautious and diligent in distinguishing between the consent given by the consumer when entering a B2C contract, on the one side, and the consent required by the data protection framework when processing specific categories of personal data.

For example, the mere consent of the consumer to be provided with the digital content or service as object of a long-distance contract shall not be seen as grounding processing operations subject to strict legal requirements (e.g. profiling). Also, the complex interplay between the consumer’s right of withdrawal from the long-distance contract and the consumer’s right to withdraw the consent for processing of personal data shall not lead to a confusion between the two legal institutions.

Having now the Omnibus Directive transposed into the national legislation in Romania, it remains for the traders, along with the competent authorities in the field, to ensure the consistency between the provisions of GEO no. 34/2014 and the data protection framework.