On 28 July 2016, the Court of Justice of the EU (CJEU), in VKI v Amazon EU Sárl (Case C-191/15), reconfirmed its earlier decision in Weltimmo (C-230/14) regarding the test for applicable law in relation to data processing activities.

The CJEU held that the processing of personal data by an undertaking engaged in electronic commerce is governed by the law of the Member State to which it directs its activities, if the undertaking carries out the data processing in question “in the context of the activities” of an establishment situated in that Member State.  It is for the national court to determine whether that is the case.  The fact that the undertaking does not have a branch or subsidiary in that Member State does not preclude it from having an establishment there.  The degree of stability of the arrangements and the effective exercise of activities in the Member State in question must be assessed. 

The CJEU also held that a standard term choosing a seller or supplier’s law as governing law is unfair within the meaning of the Unfair Consumer Contracts Directive (93/13/EEC).  As a result companies will need to consider whether their standard choice of law clauses in Business to Consumer contracts are unfair and therefore invalid.

Background

The defendant, Amazon, is established in Luxembourg. Among other activities, via a website, it addressed Austrian consumers, with whom it concluded electronic sales contracts.  Amazon has no registered office or establishment in Austria. Its standard terms provided for Amazon to make use of data supplied by purchasers and stated that Luxembourg law applied. The claimant, VKI, a consumer protection body, applied to the Austrian court for an injunction to prohibit the use of these terms. 

The Austrian Supreme Court referred the following questions to the CJEU:

(1) Whether a term in the general terms and conditions of a contract concluded in the course of electronic commerce between a seller or supplier and a consumer is unfair, within the meaning of Article 3 of the Unfair Terms in Consumer Contracts Directive (93/13/EEC), where the term (which has not been individually negotiated) provides that a contract with the consumer is subject to the law of the Member state in which the seller/supplier is established;

(2) Whether the law applicable to an injunction pursuant to Directive 2009/22/EC on injunctions for the protection of consumers’ interests should be determined by the Rome I Regulation (concerning the law applicable to contractual obligations) or Rome II Regulation (on the law applicable to non-contractual obligations), where the action is directed against the use of unfair terms; and

(3) Whether Article 4(1)(a) of the Data Protection Directive must be interpreted as meaning that the processing of personal data by an undertaking, engaged in electronic commerce, which concludes contracts with consumers resident in other Member States is governed by the law of the Member State to which the undertaking directs its activities.

Decision

The CJEU held that:

(1) The choice of law clause term was unfair. Article 3 of the Unfair Terms in Consumer Contracts Directive must be interpreted as meaning that a standard choice of law term in a contract concluded with a consumer that it is to be governed by the law of the Member State in which the seller or supplier is established is unfair, insofar as it gives the consumer the mistaken impression that only the law of that Member State applies, without informing him that under Article 6(2) of the Rome I Regulation he also enjoys the protection of the mandatory provisions of the law that would be applicable in the absence of that term, this being for the national court to ascertain in the light of all the relevant circumstances;

(2) The law applicable to an action for an injunction, within the meaning of Directive 2009/22/EC, must be determined by the Rome II Regulation where what is alleged is a breach of a law aimed at protecting consumers’ interests with respect to the use of unfair terms and conditions. On the other hand, the law applicable to the assessment of the unfairness of a particular contractual term is determined by the Rome I Regulation whether this is an individual or collective action; and

(3) Article 4(1)(a) of the Data Protection Directive must be interpreted as meaning that the processing of personal data carried out by an undertaking engaged in electronic commerce is governed by the law of the Member State to which that undertaking directs its activities, if it is shown that the undertaking carries out the data processing in the context of the activities of an establishment situated in that Member State.

The CJEU emphasised that the fact that the undertaking responsible for the data processing does not have a branch or subsidiary in a Member State does not preclude it from having an establishment there. Article 4(1)(a) requires the processing of the personal data in question to be carried out not ‘by’ the establishment concerned itself, but only ‘in the context of the activities’ of the establishment (Weltimmo C-230/14, para. 35). However an establishment does not exist in a Member State merely because the undertaking’s website is accessible there.  The degree of stability of the arrangements and the effective exercise of activities in the Member State in question must be assessed.

Therefore the CJEU held that it is for the national court to ascertain in light of Weltimmo, and taking account of all the relevant circumstances in the present case, whether Amazon EU carries out the data processing in question in the context of the activities of an establishment situated in a Member State other than Luxembourg.