Huge GDPR-style fines loom for breaches of consumer law across Europe

As more businesses quickly pivot to become consumer-facing in order to open up new revenue streams, they will need to take the time to ensure they are compliant with consumer laws – or brace themselves for huge fines potentially at the General Data Protection Regulation (GDPR) levels.

However, businesses are notoriously bad at complying with consumer law. A recent EU "sweep" revealed that 67 % of the surveyed e-commerce properties might be infringing basic EU consumer law, meaning that a significant amount of businesses are likely to at risk of some form of enforcement action.

Businesses that breach consumer laws in the EU could now face GDPR-style fines that are set at 4% of a company's annual global turnover.

Fines of this magnitude will need to be flagged at board level, as they become a significant operational risk to any consumer-facing business. These companies should ensure all consumer-facing products and services are designed with consumer law compliance in mind. They should also begin to think urgently about a plan to ensure compliance and to avoid a "GDPR-style panic" when the deadline looms.

'New Deal for Consumers'

These fines will be implemented as part of the EU's "New Deal for Consumers" initiative (also known as the Omnibus Directive), which was approved at the tail end of 2019. Member States are required to implement national laws to comply with the Directive from 28 May 2022.

The New Deal for Consumers is an overhaul of consumer law, giving it more teeth against non-compliant businesses, and bringing the legislation (some of which was passed in the 1990s) up to date for our modern digital markets.

The Omnibus Directive amends and updates four crucial pieces of consumer law: the Unfair Commercial Practices Directive, the Consumer Rights Directive, the Unfair Contract Terms Directive and the Price Indication Directive.

In the first in a series of podcasts on the EU's New Deal for Consumers, John Davidson-Kelly and Katrina Anderson discuss further the implications of the Directive for consumer-facing businesses, the larger fines for breaches and the more stringent regulatory environment.

Listen to the podcast here:

Or click here to listen to the podcast on Internet Explorer.

Did you say GDPR-level fines?

Yes, and this is the significant change introduced by the Directive. To recap, it requires Member States to provide for maximum fines of at least 4% of the infringing trader’s annual turnover in the relevant member state(s). Currently only some member states have imposed mandatory fines for breaches of consumer law, and these tend to be low (for example, some breaches attract a fine of €15,000 in France).

Consumer law crackdown

The highest fines are only likely to be applied for the most serious breaches, but, looking across the EU, consumer law enforcement is becoming more widespread and the fines are alarming. In Italy, the communications industry regulator AGCOM has fined a series of companies up to €5m for consumer law breaches.

Regulators, such as the Competition and Markets Authority in the UK, have made it clear that they are looking to enforce consumer law more stringently. They are seeking the power to impose civil fines and emergency legislation to deal with excessive pricing during the coronavirus crisis (for more information please see our insight on emergency powers).

Any other changes?

The Directive includes additional changes, including:

• Improved consumer remedies and protections, which means that consumer groups can bring group actions and consumers can bring individual remedies in case of harm through unfair commercial practices (for example, termination of contract or compensation for damages).
• Increased online transparency obligations, including around search-ranking criteria and for online marketplaces and platforms. There is also a requirement to notify consumers each time the price they are being presented with is personalised;
• For every price-reduction claim, sellers and traders must indicate a reference price of the lowest price applied within a period of at least 30 days preceding the current reduction.
• Digital service providers to grant consumers additional rights to free digital services and content when their personal data is consideration for the contract.
• Dual-quality goods are now a misleading action. This means that global brands will need to give careful thought to any differences in the products offered in different member states.
• A new category of digital service has been introduced, with all of the associated consumer law obligations attaching.

What's next?

• Timing: Member States have until 28 November 2021 to adopt and publish their implementing legislation so businesses will have more information on the exact scope of the changes by then. The laws will then come into force by May 2022.
• Board-level issue: Any consumer-facing business should make sure their board is aware of this new category of risk that the business faces.
• Compliance by design: Just as a slogan for GDPR was "privacy by design", respecting consumer rights should be considered as part of the creation of new products. Businesses should make sure that compliance with consumer law is a priority. Any new consumer-facing products and services should be designed to be consumer law compliant at launch.
• Compliance plan: Businesses are urged to avoid a GDPR-style panic by planning their compliance exercises now.
• Audits: It will also be advisable to carry out an audit to ensure that existing processes and products are compliant particularly because EU consumer protection sweeps routinely indicate that the majority of websites surveyed are infringing consumer law (here).

The UK and Brexit

Since the UK's transition period will (likely) have expired before November 2021, the UK will not be bound to implement legislation to apply the Omnibus Directive under the existing withdrawal agreement. However, ongoing regulatory alignment in this area may form part of any trade agreement.

In any event, UK traders selling to EU consumers will have to comply with the updated consumer laws, regardless of the UK's status or the trader's location.

'New Deal' insights

Osborne Clarke will be publishing a series of articles, podcasts and events on aspects and features of the EU's New Deal for Consumers in the run up to implementation to ensure that you are informed and aware of the key points and risks for your businesses. Our insight into the implications of the Directive for consumer-facing businesses launches the podcast series. To sign up for our alerts in this area please click here.