A recent judgment delivered by the Court of Justice of the European Union (CJEU) touched upon questions concerning unfair terms in consumer contracts and data protection rules in the context of online sales.

The questions arose in a preliminary reference request made by the Austrian Supreme Court following proceedings advanced by the Austrian Consumer Association against Amazon. EU law grants qualified entities such as consumer protection organisations the right to obtain injunctions prohibiting infringements of consumer protection measures.

Amazon, a multinational online sales giant, owned a subsidiary company in the Duchy of Luxembourg through which it conducted its European online business. Online sales are made with consumers across the EU via websites addressed at consumers in the different member states. Customers purchasing goods from Amazon’s website were bound by its standard terms and conditions. One of such terms subjected consumers to Luxembourg law. Consequently, any disputes relating to online purchases had to be brought forward before the courts of the Duchy.

The Austrian Consumer Association found fault with this choice of law clause in Amazon’s consumer contracts, and sought an injunction against the online website to block Amazon from using specific terms in the online sales contracts when trading with consumers living in Austria.

“Amazon argued in its defence that it had no legal connection with Austria and a close connection to the Duchy”

The association took a stand against the choice of clause imposed by Amazon on its customers, arguing that EU law does not allow Luxembourg law to prevail over the protection measures enjoyed by consumers in Austria from where Amazon’s website was accessible.

Amazon opposed the association’s arguments and argued in its defence that it had no legal connection with Austria and a close connection to the Duchy. Indeed, it had no registered office or seat of establishment in Austria while its subsidiary company was set up in Luxembourg.

In its ruling, the CJEU held that Amazon’s standard term – that imposed the seller’s law as governing law of a consumer contract – was an unfair term within the meaning of the EU Unfair Consumer Contracts Directive.  The Court deemed that such standard term causes a significant imbalance to the detriment of the consumer. It also gave the consumer the mistaken belief that only the chosen law applies, when in fact EU law gives consumers the added protection of mandatory provisions of law that are applicable in the consumer’s home state.

In the context of standard terms, the CJEU was also requested by the Austrian Supreme Court to give a ruling on the issue of data protection. Amazon’s standard terms authorised it to make use of data supplied by purchasers, by exchanging such data with credit-risk and financial services companies in Germany and Switzerland. In such case too, Amazon’s standard terms laid down that Luxembourg law would apply.

The Court of Justice had to decide which member state’s data protection law should apply where goods are sold across national borders but within the EU. The key question in this case was whether the processing of personal data by Amazon was governed exclusively by the law of the Luxembourg in which the establishment of its company was situated, or whether Amazon had to comply with the data protection rules of those member states to which its commercial activities were directed.

The CJEU held that the processing of personal data by an undertaking engaged in electronic commerce is governed by the law of the member state to which it directs its activities if the undertaking carries out the data processing in question in the context of the activities of an establishment situated in that member state.  The Court emphasised that the fact that an undertaking does not have a branch or subsidiary in that member state does not preclude it from having an establishment there.  The degree of stability of the arrangements and the effective exercise of activities in the member state in question must be assessed. In any event, an establishment does not exist in a member state merely because the undertaking’s website is accessible there. The CJEU held that it is for the national court to ascertain whether Amazon carries out the data processing in question in the context of the activities of an establishment situated in a member state other than Luxembourg.

The legal landscape in this context is set to change, albeit to a limited degree, once the General Data Protection Regulation enters into in less than two years’ time.

jgrech@demarcoassociates.com

Josette Grech is adviser on EU law at Guido de Marco & Associates.

Sign up to our free newsletters

Get the best updates straight to your inbox:
Please select at least one mailing list.

You can unsubscribe at any time by clicking the link in the footer of our emails. We use Mailchimp as our marketing platform. By subscribing, you acknowledge that your information will be transferred to Mailchimp for processing.