12

Article 3(1) and Recital 13, 14 DCD-COM clearly state that counter-performance can be provided not only in the form of money, but also in the form of personal data or any other data. Notably, the General Approach document of the Council does not mention the notion of “counter-performance” by name. It seems that the Council prefers to avoid using this terminology by stating instead that the DCD “shall not apply […] to the supply of digital content […] for which the consumer does not pay […] a price and does not provide […] personal data”.  [4] The EP shows a similar tendency by recommending to remove the phrase “counter-performance” from Article 3(1). Its amendment to Article 3(1) stipulates that the DCD “shall apply to any contract where the trader supplies […] digital content […] under the condition that personal data is provided or collected […]”.  [5]

13

The debate whether data should be considered “counter-performance” or not reflects the tension between two regulative approaches to the intersection between markets, data protection and consumer protection; namely, recognizing data as counter-performance in the context of the DCD and thereby guaranteeing a high factual level of consumer protection might signal to market participants the acceptance of commercialisation of personal data. Alternatively, ignoring that type of counter-performance may signal a rejection of such commercialisation, but this would come at the price of lowering the factual level of consumer protection.

14

There are no clear answers to the general question regarding how far the legal system should “protect consumers from themselves” without risking becoming overly paternalistic.  [6] At the same time, there seems to be a consensus around the recognition that “data [provided] against digital content” is today a prevalent business model that cannot be ignored.  [7] Accordingly, the COM and EP agree that in the digital economy, information about individuals is being increasingly seen by market participants as having a value comparable to money.  [8] Even the European Data Protection Supervisor (EDPS) in principle welcomes the intention of regulatory approaches to protecting consumers in the digital environment, including those who provide personal data in exchange for ostensibly “free services.”  [9]

15

In fact, excluding data as counter-performance (hereinafter “DACP”) situations from the DCD would lead to discrimination between DACP-consumers and price-paying consumers. It is highly questionable whether discrimination solely on this basis across the board is justifiable. Obviously, DACP-consumers do not obtain the digital content “for free” and therefore there is no reason to assume that they deserve a lower level of protection. Their data has a substantial economic value to traders, and their economic interests are surely at stake when the trader deviates from its contractual obligations irrespective of the nature or their counter-performance.  [10]

16

Recital 13 DCD-COM makes a double assumption according to which (1) differentiation would boost DACP business models, and (2) incentivising DACP business models in this way would be unjustified and should be avoided. These assumptions call for further scrutiny. Strictly speaking, excluding DACP-transactions from the scope of the DCD would mean a lack of harmonisation in this area, and by extension, result in any type and level of consumer protection a given Member State decides to grant. The DCD would thereby forgo an important opportunity to cover this aspect of digital markets. Increased fragmentation among domestic laws in their respective approaches of DACP-transactions would clearly undercut the harmonisation agenda of the DCD.

17

Apart from this, the emphasis of Recital 13 on discrimination between business models appears somewhat misplaced: The main instrument with which the DCD seeks to achieve the ultimate goal of fostering the growth of the Digital Single Market is not by equalizing incentives to pursue various business models, but more likely by harmonizing the level of consumer protection (or at least, some aspects thereof) and thus significantly increasing legal certainty across the European Union. The discrimination that needs to be avoided is therefore not so much between different business models as it is between different consumer groups. As also suggested by the COM and EP in Recital 13, an important consideration in this context is the impact on the economic interests of consumers: it is the discrimination between classes of consumers that generally should be avoided.

18

In addition, the human-rights aspect of personal data and the capacity of personal data to serve as counter-performance are not mutually exclusive.  [11] In other legal disciplines it is well established that personality-related rights (such as authors' rights or publicity rights) can simultaneously have a monetary dimension, which their holders are free to realise.  [12] Such duality can equally apply to the interface between data as reflecting a personal right (e.g., under the GDPR  [13] ) and data as a commodity (e.g., under the DCD).  [14] The direct reference from the DCD to the GDPR as having the regulative priority in all data protection-related matters effectively leaves the latter unaffected.  [15] No erosion in the status and operation of data protection law is to be feared if the DCD merely targets the commercial facets of a market reality that data protection law cannot wipe away.

19

An impact in the opposite direction, namely, a foray of data protection law into the domain of contract law, should also be considered at this juncture.  [16] The right to withdraw consent to the processing of personal data (e.g., as laid down in Article 7(3) GDPR) does not necessarily negate the possibility of a contract over personal data. The conclusion of a contract remains subject to national law.  [17] In addition, the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR).

20

The conclusion must be that the European legislator cannot turn a blind eye to DACP-transactions within the general project of promoting the Digital Single Market despite the potential tension with data protection law. The proposed Article 3(8) DCD-Council already points in a similar direction. That said, certain clarifications, for instance as suggested by the Council (in footnote 15) or by the EP (in Recital 13 – Amendment 20), may be useful in explaining the interplay between these two bodies of law. Avoiding the term “counter-performance” or any comparable terminology from the realm of contract law contributes nothing to achieving the goals of the DCD or serving any other regulative purpose.  [18]

21

Whereas the COM relates to “personal data or any other data” as potentially replacing payment of price, both the Council and EP advocate for limiting the language to “personal data” only. The General Statement (Council) and the Report (EP) do not explain in detail the rationale for excluding “other data” from the scope of the DCD. A possible explanation is the wish to avoid the additional complexity resulting from the necessity to differentiate between the two types of data in the text of the directive. Another possible reason could be the underlying idea that specific regulation addressing non-personal data is less necessary provided that consumers, for the most part and in light of the broad concept of “personal data” under the GDPR, are not likely to provide non-personal data to traders.

22

The latter assumption is weakened if considered against available methods and technologies to anonymise data once it reaches the trader and further down the value chain. But even assuming that data preserves its original identity as personal or non-personal after entering the commercial cycle, differentiation at the scope level would immediately introduce the (sometimes nontrivial) task of determining which category the data provided by the consumer belongs to. Once this has been done, the assumption about the negligent importance of non-personal data in DACP-scenarios would have to be revisited under future business models that might increase the importance of such scenarios.

23

We therefore submit that including both personal and non-personal data would better serve the interests of efficiency, legal certainty and consumer protection. To the extent that the two data categories receive different treatment under the DCD in order to prevent friction with data protection law, a direct reference to the definition of personal data in the GDPR appears advisable. Once included, non-personal data should be controlled by the DCD norms that protect consumers against continued use of their data after termination.  [19] The GDPR will continue to apply directly on such matters with regards to personal information.  [20]

24

In the context of the DCD referring to GDPR norms where data protection law is implicated due to the nature of data as personal data, a general word of caution is warranted: reference to specific provisions in the GDPR should not necessarily mention provision numbers, but rather the intended data protection principles in order to prevent cross-reference errors in case the legislative texts are to be amended or replaced in the future.  [21] Furthermore, a specific reference to the GDPR in one occasion should not open the door to argumentum e contrario where the GDPR should apply but is not mentioned in the text of the DCD. It is therefore advisable to explain (possibly in the Recitals) the relationship between the DCD and the GDPR and specifically exclude e contrario interpretations.

25

According to the COM, the DCD applies only to data that is actively provided by the consumer, whereas data collected by the trader that is not actively provided, such as the IP address or even data collected after the acceptance of a cookie, do not fall under its scope.  [22] The Council, by comparison, would introduce a minimum harmonization standard, allowing member states to also extend the application of the DCD to passively provided data.  [23] Shifting to the opposite extreme, the EP would apply the DCD irrespective of the question whether data was actively “provided by the consumer or collected by the trader or a third party in the interest of the trader”  [24] in order to avoid loopholes.  [25]

26

As pointed out by the European Parliament's Committee on Civil Liberties, Justice and Home Affairs (LIBE), limiting the scope to actively provided data would create a perverse incentive for traders to not ask for the consumer's consent.  [26] Simply assuming that data protection law will operate to protect a consumer whose data was passively collected in a manner that adversely affects his or her interests does not suffice. In case of passive collection that is unlawful under the GDPR, the protections of the DCD should apply all the more.

27

Excluding scenarios from the scope of the DCD where the counter-performance consists of passively provided data would in fact be counterproductive in terms of consumer protection. In case of non-personal data, neither the DCD nor the GDPR would apply. But also in case of personal data provided passively, where the GDPR does apply, the DCD can provide an additional layer of protection, e.g., a right to damages (Article 14 DCD-COM) if the digital content or service is not in conformity with the contract.

28

Moreover, it should be noted that the criteria set out in Recital 14 DCD-COM to distinguish between actively or passively provided data call for further clarification. This is especially true for the given example of cookies. There is no reason for consumers whose data is collected by the means of cookies to be less protected than consumers who actively consent to the collection of essentially the same data.  [27] Passively collected data is neither less valuable than actively collected data, nor is it marginal in scope or importance.  [28] In addition, the economic interests of both types of consumers are affected by the usage of the data in the same way. The conclusion is that discrimination between consumer groups on such basis would lack any plausible justification, and following a minimum harmonisation approach here would not suffice.

30

Considering the regulative framework of the DCD alongside the current proposal for a directive of the European Parliament and of the Council on certain aspects concerning contracts for the online and other distance sales of goods (COM(2015) 635 final, hereinafter “OSD”) reveals a notable misconception: the OSD is often mentioned as providing a “safety net” to consumers due to its capacity to close loopholes in the DCD protection scheme. It must be mentioned in this context that the OSD only applies if the physical good is bought and paid for with money. The DCD is therefore indispensable to rental or lending situations.

31

The same holds true for cases in which the good is given away for free or in exchange for data. With the sinking cost of electronic gadgets and the growing market for Big Data and targeted marketing, companies have an increased incentive to distribute consumer electronics without charge. Already now, some consumer electronics are sold at the manufacturing price or less. The main purpose of such “giveaways” is the collection of data generated through use and monetising that data. Under the current OSD draft, this entire market segment is not covered (since the OSD does not cover data as counter-performance transactions), opening a regulatory gap that the DCD is capable of closing.

32

Even in cases where the OSD could serve as a safety net for consumers, its anticipated protection scheme remains insufficient as it does not cover crucial questions such as (security) updates or modifications that are necessary irrespective of whether the content is provided as a stand-alone product or embedded in a physical good. Many observers as well as the EP have already recognised the importance of including EDCS within the framework of the DCD.  [29] Despite the difficult challenge of reasonably delineating the scope of the DCD and its coexistence alongside the OSD, leaving EDCS outside of the domain covered under the DCD would be a resounding mistake.

33

The main arguments for such inclusion are identical with the arguments for enacting the DCD in general: smart goods (or for the DCD in general digital content) are becoming ever more relevant, and they differ from conventional goods in ways that call for specific regulation. A harmonized set of rules in this area is essential in order to bolster consumer rights and increase legal certainty, which might hinder transactions and thus the development of a Digital Single Market. As already noted by others, a failure to cover the digital aspect of physical smart goods on an EU-level would lead to confusion, inconsistencies and a “serious gap in consumer protection”.  [30]

34

The difficulties in implementing this approach, however, are rooted in the regulative perspective of the DCD, which focuses on the type of good (digital content), as opposed to the OSD that is tied to the legal consequences intended by the parties (transfer of ownership). The DCD's stance of focusing on the type of goods seems to contrast civil codes' regulative matrix in some Member States (including Germany). The resulting problems in aligning the DCD with the OSD are therefore likely to trickle down to future efforts of implementing the two instruments in national laws.  [31] However, assuming that the basic structure of both directives will be upheld in the final versions, we submit that including EDCS products under the DCD is crucial.

35

The current proposals to include EDCS in the DCD share one shortcoming: these proposals would expressly include “embedded” digital content and services and separately define the term “embedded”.  [32] Unfortunately, this approach tends to raise more questions than it can solve.  [33] For instance, the latest EP proposal attempts to identify “embedded” digital content or services based on them being “pre-installed in a good”. Alas, the definition is ambiguous and potentially too narrow. Ambiguous, as it is not clear whether it covers content that remains on a cloud and is accessed through the good in the course of use. In addition, the term is not really fitting for digital services: usually, they are not “installed” on the device. In such cases, merely a client or interface might be pre-installed to allow access to the service. Would the DCD in such cases only apply to the client or also cover errors on the remote server?

36

The definition is also too narrow, as it leaves the door open for common business models to escape its application. If EDCS are to be included separately, the logic of the proposal would be that digital content or services delivered through a physical good were not to be covered per se, but only if they were “pre-installed”. Especially where content quickly runs out-of-date (e.g., maps on a Navisat), devices are only delivered with a basic environment and physical parts, while the majority of content must be downloaded after delivery. Such content would hence not be covered – a loophole the trader could take advantage of, even where there is no objective reason to deliver the digital content subsequent to providing the good.

37

To avoid such definition-based problems, we recommend to remove the differentiation between stand-alone and embedded digital content or services and instead to conceive EDCS as a special way of supplying digital content or services. There is no need for distinction at the scope level, as the two forms of supplying digital content do not differ to an extent that requires two sets of specific rules. In both cases, there are similar consumer interests and market challenges at stake. Additionally, in case differentiation would still make sense in a limited context, this can be done ad hoc within the relevant provision.

38

The challenge of distinguishing between physical products distributed with an embedded digital content or service (hence, subject to EDCS regulation) and the distribution of digital content or services that are merely embodied in a physical article or otherwise connected with it (hence potentially subject to mixed/linked contract regulation) is only expected to grow in the future.  [34] For this reason, we recommend to extend the scope of the DCD to all digital content and services irrespective of the way in which they are delivered. To implement this understanding into the DCD, one could for example clarify the scope by changing the definition of “supply” and omit any definitions and exclusions or inclusions of EDCS (e.g. “’supply’ means providing access to digital content or services or making digital content or services available isolated or within or in connection with physical goods”).  [35]

39

If, however, the EU legislature nonetheless chooses to follow the definition-based approach, we join the recommendations of the ELI advocating for the amendment of the notions of “embedded” and “ancillary” content or services.  [36] To broaden the directive's scope, these terms should then be defined in such a way that they cover all digital content and services delivered within or in connection with a physical good in fulfilment of a contractual obligation.  [37]

40

That there is no basic need for differentiation becomes clear if one is to investigate the rules that have been proposed by the EP specifically for EDCS. Those EDCS-specific provisions set out in Article 3(3), 9(1)(c), 10(1)(b), 13b(2) DCD-EP are superfluous and should hence be deleted:

41

Another critical point is the interrelation between the DCD and the OSD in cases of sales contracts. In many instances, the separation is fairly easy to make, since most of the rules designed for digital goods logically do not apply to physical goods (a security update for the wristband of a smart watch would make no sense.) At the same time, serious issues begin to surface in the broader context of conformity with the contract and remedies for non-conformity as there are different regulations intended for conformity criteria, relevant time periods, or burden of proof. The EP's co-rapporteurs declared their intent to work together with the rapporteur responsible for the OSD in an attempt to align conformity criteria and thus minimize the impacts of the split approach.  [39] However, already the on-going discussion about subjective and objective conformity criteria for digital goods  [40] and the vastly different proposals on this matter by the COM, Council and EP show that a full alignment in that regard between DCD and OSD is unlikely. Besides, such an alignment would actually undermine to some extent the idea behind the DCD.  [41] Although we embrace any approaches of aligning both directives, the following question will remain relevant: What set of rules should apply to situations, where both directives are applicable but provide different rules?

42

One possible solution would be applying the DCD to the digital component and the OSD to the physical component of a good. However, distinguishing between the digital and physical components can be rather tricky in real-life situations, making it difficult for the consumer to determine where the conformity deficiency lies. To solve this matter, the consumer could have the right to base the non-conformity claim on the DCD without the need to prove that the problem indeed relates to the digital part. To balance the picture, it was proposed by ELI that the supplier should have the opportunity to show that the problem lies within the physical part, and hence, the consumer would have no rights under the DCD.  [42]

43

We welcome this approach but would recommend going one step further for achieving a higher level of clarity, certainty and consumer protection. In case of such a rebuttable assumption as proposed, the success of the consumer's claim under the DCD would depend on the trader not being able to prove that the deficiency falls within the physical component of the good. The problem here is that the consumer has limited possibilities to tell where the deficiency lies – and thus is not able to properly assess the risk of a lawsuit. In contrast, the 6-month reversal of the burden of proof under the CSGD  [43] is more consumer-friendly: to answer the question whether the lack of conformity existed at the time of delivery, the consumer has some first-hand knowledge about facts such as when the fault initially occurred or whether he/she might have been responsible for the problem (e.g., by dropping the good or by not handling it properly in any other way). By comparison, when it comes to the question of where the defect lies, such or other facts will be mostly unavailable to the consumer. So, if the trader denies the consumer his rights under the DCD by simply alleging a physical fault, the consumer would be unlikely to challenge that claim, rendering this solution impracticable.

44

Therefore, an alternative approach to this dilemma appears more appropriate: The consumer should be mostly free to claim a defect in the physical part of the good or a fault in the digital component, a choice the trader should not be able to challenge by proving that the consumer's choice was incorrect. By performing that choice, the consumer should only be restricted by an “obviousness principle”. Namely, relying on DCD remedies in a given case will be denied only if it is apparent without further investigation and expertise that the problem lies in the physical part of the good (and vice versa, if the consumer relies on OSD remedies).  [44]

45

Following this consumer-friendly approach is a conscious policy decision that should guide the legislative process. In some cases, this indeed might lead to an extended liability of the trader; yet strong consumer protection and legal certainty are gained, and it should be easier for the trader to compensate for possible financial drawbacks resulting from the legal exposure, for example, by raising the price.

46

Multi-party scenarios that are typical to the supply of EDCS call for more discussion and analysis. The current DCD proposals seem to focus on bilateral contracts while overlooking more complex settings that involve multiple players in direct contact with the consumer.  [45] Very often, the digital part of smart goods is supplied and maintained not by the vendor but by a third party (e.g., the product manufacturer). In such situations, the consumer's interests could be affected amongst others by: (1) the direct affiliate (i.e., the vendor); (2) the manufacturer of the physical good; (3) the (technical) supplier of the digital content / service; or (4) the data processor.

47

Multi-party scenarios are obviously not unique to EDCS, but there are several aspects of smart goods, especially the rights and duties connected to consumers' data, that call for enhanced attention.

48

For example, it has to be clarified (possibly within the Recitals), that the consumers' claims against the trader are not diminished by whether the trader does or does not also fulfil the functions of the manufacturer, digital content supplier, or data processor. Clarifications like these are crucial to close loopholes emerging from multiple parties being involved. For example, for “analogue” sale contracts, it is legally unambiguous that the contracting party is liable for the product sold. Even so, it can be observed that in many cases the consumer is redirected to the producer, often giving the impression that the consumer has no rights against the contracting party. It is foreseeable that the contracting parties liable under the DCD will use the same mechanisms to avoid requests to make available or delete user-generated content – a scenario that has to be avoided. The fact that a third party is responsible for data processing, for instance, should not automatically render Article 13a(4) DCD-EP (portability of user-generated content) inapplicable. Instead, the contracting party should have the obligation to support the consumer to the full extent possible, for instance by providing information about the data processor or the consumer's rights according to the GDPR.

49

We strongly recommend to further investigate this aspect and other possibilities to strengthen the consumers' position against third parties through full harmonisation in this field and to examine multi-party scenarios in general. If, however, the trilogue chooses not to harmonise such questions, the final draft should clarify that the DCD does not prejudice the ability of domestic law to regulate these questions.

50

The data portability rules of the DCD serve different purposes. The first and most obvious function is to safeguard the consumer's right of termination in order to avoid lock-in effects, see Recital 39 DCD-COM. A second purpose is to foster competition, see Recital 46 DCD-COM. The parallel provision in Article 20 GDPR underlines that portability provisions do also aim at the empowerment of the data subject. However, Article 13 DCD-COM is not restricted to personal data but covers also user generated content that is not personal data (in the following: UGC). The general tendency of the provision is to be welcomed. Without portability requirements, at least after termination of a contract, lock-in effects will prevent consumers from switching from one service to another. As a consequence, the consumers' freedom to make a choice and competition between services would be affected.

51

The main difference between the COM's, Council's and EP's proposals concerns the applicable portability regime for personal data. In its proposals, the Council and EP suggest that for personal data, the portability provision of Article 20 GDPR should apply instead of the DCD. The clear advantage of a streamlined portability regime for personal data is its coherence. With one portability regime, codified in the directly applicable GDPR, it would be easier for both consumers and service providers in the EU to know their rights and duties and to adapt their conduct to the legal rules. Since Article 20 GDPR only covers personal data, it is vital that Article 13 DCD maintains additional rules on UGC. Even though most content created by consumers in the current business models meets the criteria of personal data, the provisions should be drafted in a forward-looking wording and cover as many different services as possible.

52

Abandoning the specific portability rules in the Directive should only be considered if the protection given by the GDPR arrives at the same level as Article 13 DCD-COM. Apparently, the most important advantage for consumers under Article 13 DCD is the broader field of application vis-a-vis UGC. By contrast, for personal data Article 20 GDPR provides a higher level of protection.

53

All aspects considered, the Council's and EP's suggestion to replace the portability provision in Article 13 DCD by a reference to the GDPR is well-founded. However, the link to the GDPR should be clarified by an explicit reference to the portability regime enshrined in the GDPR. Also, the portability right for content that is not personal data should be maintained.

54

With regard to UGC, the Council's and EP's proposals suggest a number of exceptions to the portability provision in Article 13a. These exceptions may seriously weaken the consumer's right to retrieve UGC provided to the supplier. For the application of the exceptions, it may not suffice that the suppliers assert “no utility outside the context of the digital content or digital service”, that “only relates to the consumer's activity when using the digital content or digital service” or “has been aggregated with other data by the trader”. Rather, it should suffice that the consumer claims that he sees utility outside the context of the service or that he wants to use the content outside of the service. With regard to the proportionality requirement, the provisions should explicitly oblige the supplier to configure its service in a way that allows UGC to be extracted separately for each consumer. Service providers should apply state-of-the-art technology to protect the consumers' interest in its UGC. If suppliers do not set up their services in such a way as to facilitate the retrieval of consumers' UGC to the maximum effect possible according to state-of-the-art technology, they should not be heard with the argument of disproportionality. The EU legislator should keep in mind that portability rules serve a competition-enhancing purpose. Consumers seeking to retrieve their personal data and UGC to change over to other traders are the key for a functioning digital single market.

55

Moreover, the provisions of portability of UGC should reflect that the trader may not always be the party who stores and processes the content generated by the consumer, e.g. in case of digital content supplied by a mere reseller which enables the consumer to access a service provided by a third party. In such a case, the consumer should have an additional direct right against this third party to retrieve its content.  [46]

56

The right to retrieve personal data and other UGC must also be ensured in case of termination of long-term contracts according to Article 16 DCD. The COM's proposal suggests in Article 16(4)(b) to provide a rule which is in line with the termination rule in Article 13(2)(c). The Council proposes to implement a reference to Article 13a and to the GDPR into Article 16(3), which would streamline both sets of rules. Such a reference is missing in DCD-EP with regard to UGC. According to DCD-EP, in case of termination of a long-term contract, the consumer would have the right to retrieve personal data based on Article 20 GDPR. However, the drafters have obviously overlooked the necessity to provide a parallel rule for other UGC. The final text of the DCD should either stipulate explicit portability rules for UGC or contain a reference to Article 13a.