1. Giving Meaning to Unfair Terms

The substantive fairness element in the UCT Directive contains both good faith and significant imbalance components. According to Article 3(1) UCT Directive, a term will be regarded as unfair “if, contrary to the requirement of good faith, it causes a significant imbalance in the parties’ rights and obligations arising under the contract, to the detriment of the consumer.” There has been intense academic debate surrounding the meaning of good faith and significant imbalance. More specifically, as contracts are rarely contrary to the interests of traders, the potential openness of the test has been criticized.Footnote ⁶⁵ In addition, good faith was somewhat alien to the common law tradition.Footnote ⁶⁶ Although at first the UCT Directive had little real impact, in more recent years there has been a dramatic increase in the number of references from the national courts, thus facilitating the emergence of a deeper understanding of the Directive’s substantive fairness element.Footnote ⁶⁷

More specifically, in endorsing the opinion of Advocate General Kokott in the Mohammed Aziz case, the Court of Justice found that in the determination of whether there is a significant imbalance the national court should take the national rules that would apply in the absence of a contractual agreement into consideration.Footnote ⁶⁸ The Court further observed such an analysis would allow the national court to assess the extent to which the contract results in a less favorable legal situation and that such an assessment should include an examination of the legal situation of the consumer with regard to the means at their disposal under national law to prevent the continued use of unfair terms.Footnote ⁶⁹ In the determination of the circumstances in which such an imbalance arises contrary to the good faith requirement, the Court of Justice stated that Recital 16 UCT Directive should be considered. In particular, in addition to indicating that good faith may be satisfied if the seller or supplier deals fairly and equitably with the consumer by taking their interests into account, Recital 16 UCT Directive further provides that the assessment of good faith necessitates the consideration of the bargaining power of both parties—including the specific consumer vulnerabilitiesFootnote ⁷⁰; whether the consumer was induced to accept the term; and also whether the goods or services were being sold or supplied by the special order of the consumer. As a consequence, the national court is required to assess whether the seller or supplier, dealing fairly and equitably with the consumer, could reasonably assume that the consumer would have agreed to such a term in individual contract negotiations taking the particular circumstances of the case into account.Footnote ⁷¹

The Court of Justice has subsequently confirmed the judgement in Mohammed Aziz and found that a significant imbalance does not necessarily have to relate to an economic disparity but instead can also be a consequence of a “sufficiently serious impairment of the legal situation in which that consumer, as a party to the contract, is placed, vis-à-vis a restriction of rights or a constraint on the exercise of such rights.”Footnote ⁷² Importantly, in this context it is also necessary to examine Article 4(1) UCT Directive which stipulates that:

This provision highlights the importance of the individual circumstances of each case and, therefore, the significant role played by the national courts as the evaluators of the fairness of a specific term, given that the Court of Justice does not normally have access to the full facts of the case.Footnote ⁷⁴ In this context, the role of the annexed grey-list, which provides an indicative list of unfair clauses, should also be acknowledged.Footnote ⁷⁵ Indeed, although the Court of Justice has stated on several occasions that the adoption of this list is up to the Member States and that there is no presumption of unfairness unless otherwise provided by national law, according to the Invitel judgement the inclusion of a term in the list remains an essential element on which the national court can base its assessment.Footnote ⁷⁶

With this in mind, it is important to note that the UCT Directive is a product of its time in that in effect it amounts to a partial harmonization of consumer contract law, largely focused on information provision and transparency as adopted under Article 100a EEC (now Article 114TFEU). This Treaty provision forms the legal basis for the EU to adopt legislation for the approximation of laws for the functioning of the internal market. To clarify, Article 114 TFEU permits the EU legislator to regulate areas which are seen as obstacles to the proper functioning of the internal market. It should also be noted that, given the fact that the Directive is a minimum harmonization instrument,Footnote ⁷⁷ Member States are not precluded from offering a higher level of protection. Establishing precise indicators for when a term is contrary to good faith is, therefore, a determination which remains challenging at the EU level. As a consequence, there is a large degree of disparity amongst the Member States with many opting to expand the protections—for example, if the existing protections were not already more expansive.Footnote ⁷⁸ Accordingly, in order to truly assess the fairness of a particular term one is required to refer to the national courts.Footnote ⁷⁹ The room for maneuver afforded by the minimum harmonization approach is illustrative of the tight reign that Member States have kept over national contract law, for more see Section D below. This is indicative of the Directive’s restricted scope in that it only concerns terms that have not been individually negotiated.

From the above, therefore, one must question how the substantive fairness element in the UCT Directive overlaps with the principle of fairness in data protection in order to interpret unfair terms in the context of pre-formulated declarations of consent. The need for such an assessment is particularly clear given that the UCT Directive focuses on economic considerations in comparison to the fundamental rights focus of the GDPR. In this vein, one can refer to the recent EDPS opinion on the proposed Directive on certain aspects concerning contracts for the supply of digital contentFootnote ⁸⁰ in which the EDPS criticizes the use of Article 114 TFEU as a legislative basis concerning matters involving personal data due to the availability of Article 16 TFEU. Arguably this points to a larger issue with relying on frameworks based on Article 114 TFEU, and, thus, their suitability to cater for social rights orientated concerns rather than the market integration centered mandate understood more readily to be the focus point of Article 114 TFEU. To clarify, this is not to suggest that Article 114 TFEU cannot be used to harmonize protections but rather to question how this might affect the protection goal.

Although the relationship between Article 114 TFEU and Article 16 TFEU is a matter requiring more detailed analysis, for our current purposes it is sufficient to conclude that the precise effect of such considerations remains to be seen. But, given the potential distinction, it is necessary to question the overlap between the reference to the prohibition of unfair terms and the last sentence in Article 7(2) GDPR which, as noted above, states that, “[a]ny part of such a declaration which constitutes an infringement of this Regulation shall not be binding.”Footnote ⁸¹ Therefore, although it is clear that any part of a declaration, pre-formulated or not, which infringes the GDPR will not be binding, it is uncertain how this clarification differs substantively from the UCT Directive fairness assessment of pre-formulated declarations. As mentioned in the previous sub-Section, Svantesson suggests that the reference to the assessment of unfair terms under the UCT Directive could be viewed as providing lex specialis specification of the rules therein through the requirements in the GDPR.Footnote ⁸² Due to the fundamental deviations underlying the frameworks however, one should question such a conclusion. In support of this, one can refer to the common position taken by various national consumer protection agencies through the Consumer Protection Collaboration Network regarding the terms of service of social networking sites which clearly focused on more traditional cross-border consumer contract issues. These issues include clauses relating to jurisdiction, the identification of commercial communications, the waiving of liability, the removal of content and unilateral rights to change, determine the scope of and terminate agreements.Footnote ⁸³ Accordingly, instead of incorporating an assessment of the fairness of terms in line with data protection—which would relate more to the application of the transparency principle and the validity of the data subjects’ consent—the common position focuses on issues more aligned with traditional B2 C cross-border contract issues. Such a distinction allows for the differentiation in the respective frameworks’ intent and their underlying policy objectives. This also appears to be reflected in the judgements of—at least some—national courts where national law contract formation requirements are satisfied.

Helberger, Borgesius, and Reyna highlight in particular the cases taken by the Federation of German Consumer Organizations (Verbraucherzentrale Bundesverband) against Facebook which have confirmed that the UCT Directive applies to situations concerning personal data processing.Footnote ⁸⁴ Indeed, building on the authors’ overview one can also refer to a recent judgement of the Berlin Regional Court which found eight clauses in Facebook’s terms of use to be invalid under the German implementation of the UCT Directive.Footnote ⁸⁵ For example, the Berlin Court found that terms specifying that pre-formulated declarations of consent permitting Facebook to use the individual’s name and profile picture for commercial, sponsored, or related content and to transfer personal data to the US were unfair. The court, however, also rejected several submissions against Facebook’s privacy policy by finding that the policy only contains information about procedures and thus no contractual provisions.Footnote ⁸⁶ This judgement, therefore, appears to demonstrate the divergence between the respective realms of data and consumer protection.

To illustrate this difference more tangibly, it is significant to refer to the fallout from the Facebook-WhatsApp merger and the change in privacy policy that WhatsApp imposed on its users in August 2016, as well as the subsequent regulatory responses. As background, while Mark Zuckerberg—Facebook’s CEO—made public assurances that no changes would take place in the way WhatsApp uses personal data from users at the time of the notification of the Facebook-WhatsApp acquisition,Footnote ⁸⁷ within two years after the approval of the merger by the European Commission, Facebook introduced an update of WhatsApp’s privacy policy that would enable the company to start using data from WhatsApp to better target ads on Facebook and Instagram.Footnote ⁸⁸ As summarized by Zingales,Footnote ⁸⁹ this attracted the attention of several data protection authorities and resulted in a coordinated action by the Article 29 Working Party. The coordinated action aimed to clarify the concerns associated with the merger and resulting change in privacy policy and has resulted in an ongoing correspondence between the Working Party and the company.Footnote ⁹⁰ More specifically, the Working Party’s letter sent on October 24, 2017, specifies WhatsApp’s failure to satisfy each of the conditions for consent and in particular their failure to adequately inform, specify the intended purposes, and more generally comply with the transparency principle and the freely given stipulation in the definition of consent.Footnote ⁹¹

In addition to arousing the interest of data protection authorities, however, the developments since the Facebook-WhatsApp merger have also caught the eye of consumer protection authorities. More specifically, the Federation of German Consumer Organizations sought an injunction to stop the continued data-sharing and the deletion of the data already transferred to Facebook.Footnote ⁹² Furthermore, on May 11^th, 2017, the Italian Competition and Consumer Protection Authority (Autorita’ Garante della Concorrenza e del Mercato (AGCM)) adopted two decisions in its proceedings against WhatsApp.Footnote ⁹³ Nevertheless, in line with the common position taken by a number of national consumer protection agencies, the AGCM rulings appear to diverge from the approach taken by the Article 29 Working Party in relation to the information requirements and, thus, the expectations of the respective enforcement agencies—thereby indicating deviations in substantive requirements. The action taken by the Article 29 Working Party focused on the failure to inform the data subjects of the sources and categories of data and to sufficiently specify the intended purposes. The Article 29 Working Party viewed these failures to be in violation of the transparency principle in the GDPR. In contrast, similar to the common position adopted by national consumer protection agencies, the AGCM, in its proceedings concerning the UCT Directive, focused instead on the fairness of clauses regarding issues such as inter alia the choice of jurisdiction and law clauses, the unilateral authority to interrupt the service without reason or advance notice, and to rescind or terminate the contract.Footnote ⁹⁴

From the diverging interpretations by the relevant enforcement authorities, the formulation of Recital 42 GDPR, and the specific reference to the limitation in scope to pre-formulated declarations, it can be concluded that the Recital aims to clarify that pre-formulated privacy policies may be “unfair” under the distinct yet complementary UCT Directive protections. It is suggested, therefore, that the UCT Directive and the GDPR operate in an independent but complementary manner. This appears to be indicative of the bolstered protections for data subject consent, the common reliance on pre-formulated terms—especially in the ISS context—and hence, the apparent need to protect data subject-consumers from consenting to terms that they would otherwise not have agreed to had they been individually negotiated.

2. Pre-Formulated Versus Individually Negotiated and the Importance of Price

From the above, it is important to reiterate that the UCT Directive is a minimum harmonization instrument and is hence reliant on national law implementations, which can offer a higher degree of protection. This approach has consequently led to a large degree of disparity across the Member States, which is a reflection of diversity in terms of legal traditions and approaches in national contract law. Furthermore, this also reflects the focus of the UCT Directive on terms not individually negotiated. Indeed, as per Article 3(2) UCT Directive, terms drafted in advance are always considered as not being individually negotiated and where there is doubt the burden of proof rests with the seller or provider. As previously mentioned, this focus on pre-formulated terms reflects the underlying assumption that consumers who actually engage in negotiations with traders are protected from risk. Weatherill observes, however:

The delineation of the UCT Directive’s scope is important, given that it reflects the ongoing importance of national law and courts, which are of substantial significance in the shaping the application of the protections.

Although it is hard to imagine an individually negotiated B2 C term especially in the ISS context, this does raise interesting questions in terms of practical application. Would the negotiation of any part of a contract render it pre-formulated or individually negotiated? And further, how are terms classified as pre-formulated in practice? In this regard, one can refer to Article 3(2) UCT Directive which stipulates that:

In commenting on this provision and hence, the notion of individual terms, Micklitz argues that the term pre-formulated does not have to be interpreted strictly.Footnote ⁹⁷ Micklitz substantiates this observation with reference to two important points. First, contracts between private persons based on individual negotiations are not included within the scope of the UCT Directive, and second, the core terms relating to the “price/quality ratio and the main subject matter of the contract” are not subject to review.Footnote ⁹⁸

The first of these points inherently points towards the personal scope of the Directive and, thus, the specification in Article 1(1) UCT Directive that the Directive targets contracts concluded between a seller or supplier and a consumer. Regarding the second of these points, it is important to highlight Article 4(2) UCT Directive. This provision states that an:

Consequently, the exemption of these core terms restricts the application of the substantive fairness element to the more peripheral contractual aspects—provided such terms are stipulated in plain intelligible language and in line with the formal fairness element—hence seemingly minimizing the impact on freedom of contract.Footnote ¹⁰⁰ The key point which emerges from Article 4(2) UCT Directive, therefore, is that the Directive does not wish to control the fairness of the “price.”Footnote ¹⁰¹ In the context of pre-formulated declarations of consent, the question thus becomes: What constitutes a price? This is a matter for the national courts to determine with reference to the specific facts of the case. It is a hotly contested topic, given that distinguishing the specific limits of this notion remains challenging. More specifically, the case law on this issue has highlighted the stickiness of this concern,Footnote ¹⁰² and this has resulted in some disparity in interpretation between the national courts and the Court of Justice.Footnote ¹⁰³

It should be noted, however, that even if a term under assessment is deemed to fall within the exemption provided in Article 4(2) UCT Directive, it is still subject to an overarching transparency requirement given that this same provision mandates that such terms be presented in plain intelligible language.Footnote ¹⁰⁴ Given the focus of the present Article, however, it is necessary to explore this issue further. Hence, the question becomes one of how the exclusion of the “adequacy of the price and remuneration, on the one hand, as against the services or goods supplies [sic] in exchange, on the other,”Footnote ¹⁰⁵ may affect the application of the UCT Directive in the context of pre-formulated declarations of consent. This raises an important fundamental sub-question: Are personal data to be considered a “price”? Such a finding would exempt the provision of personal data from the substantive fairness test, which would appear odd given the aim of pre-formulated declarations of consent. Although the ability to offer higher levels of protection remains and, thus, extends to the possibility of excluding the exemption provided in Article 4(2) UCT Directive in the national implementation,Footnote ¹⁰⁶ the lack of a harmonized approach runs contrary to aims of the GDPR if personal data are positioned as the price.

Building on this discussion, one can refer again to the above delineation in the substantive application of the assessment of unfair terms in the UCT Directive and the fairness principle in the GDPR. Given that certain consumer protection authorities appear to position personal data as a de facto price and thus a core term, the substantive fairness element in the UCT Directive—at least unless otherwise provided for in the national implementation—does not apply in the enforcement of the Directive’s protections.Footnote ¹⁰⁷ Importantly, this does not affect the application of the GDPR’s fairness principle. Although it will be discussed in more detail below, it is worth noting that this nuanced point perhaps adds further clarification in terms of delineating the substantive application of the fairness protections in the UCT Directive and the GDPR. Nevertheless, it is important to re-emphasize that this will depend on the national implementations and thus on whether national transpositions of the UCT Directive, or indeed the prior existing law, extend the substantive protections to core terms. As noted by Helberger, Borgesius, and Reyna, therefore, consumer law could be positioned as an important instrument in the assessment of the fairness of the conditions under which consumers agree to personal data processing.Footnote ¹⁰⁸ Nevertheless, due to the minimum harmonization approach in the UCT Directive and the more specifically tailored rules in the GDPR, there is potential for disparity. It is thus argued that a violation of consumer law would merely result in the addition of supplementary enforcement mechanisms, rather than a further tailoring of the data protection requirements, as any breach of the GDPR will not be binding in line with Article 7(2) GDPR. Nonetheless, this is certainly not a straightforward matter.

As described above in Section B(I), the right to data protection aims to protect individual control over personal data. In its construction, this fundamental right recognizes the benefits of personal data processing but also aims to mitigate this by targeting the prevention of disproportionate impacts on individuals.Footnote ¹⁰⁹ This is reflected in the triangular structure of Article 8 of the Charter—for example, controller obligations, data subject rights and the monitoring activities of the authorities.Footnote ¹¹⁰ Data subject control, however, remains key in the operation of the GDPR, given that the framework aims to not only protect fundamental rights and freedoms in general, but also the right to data protection in particular where personal data are processed in Article 1(2) GDPR. That being said, personal data are seen by many as the currency through which ISS are provided with certain consumer protection authorities clearly positioning personal data as a price.Footnote ¹¹¹ Furthermore, the UCT Directive inherently assumes that some form of price will be exchanged in the operation of its provisions as evidenced by the exclusion of the core terms from the substantive fairness element assessment at the EU level. Therefore, the determination of what will be classified as a price is of clear importance. The following Section aims to more specifically tackle the categorization of personal data as a price, given that it is a particularly thorny issue in the alignment of the protections offered by the UCT Directive and the GDPR, and as it has been at the root of the reforms of the consumer law framework.

1. Passive and Active Collection and the ePrivacy Directive

As highlighted above, in their draft Digital Content Directive, the Commission confusingly drew a distinction between passive and active personal data collection in Article 3(1) of the proposal. This distinction was further specified in Recital 14 of the Commission draft. From these provisions, it is clear that the intention of the proposal was to exclude personal data such as IP addresses and “other automatically generated information such as information collected and transmitted by cookies, without the consumer actively supplying it, even if the consumer accepts the cookie”Footnote ¹²³ from the scope of application. To add to the confusion, the Commission draft Recital 14 went on to note that the proposed Directive “should also not apply to situations where the consumer is exposed to advertisements exclusively in order to gain access to digital content.”Footnote ¹²⁴ Although the Parliament amendments proposed the deletion of this distinction,Footnote ¹²⁵ the Council version retained the separation.Footnote ¹²⁶ As such, both the Commission proposal and the proposed Council modifications envisaged a distinction between the active and passive provision of data and significantly this has found its way into the Compromise Directive. In this regard it is interesting to refer to Recital 14 Digital Content Directive (Compromise). This provision states inter alia that the Directive should:

This Recital therefore, appears to maintain the distinction that was in the Commission and Council versions and this raises two concerns. First, it appears to assume that advertising is separate from any contract formation – albeit while this remains an issue in the competence of the Members States; and second, it draws an odd distinction between different types of personal data. Hence, browsing on sites that do not require log-in information is deemed distinct from visiting a social networking site with only the latter invoking the operation of the compromise Directive. Nevertheless, such an interpretation seemingly disregards the fact that both IP addresses and cookies are widely considered as personal data and that personal data processing for online behavioral advertising purposes requires the consent of the data subject—for example, as confirmed by the Article 29 Working Party in several opinions.Footnote ¹²⁸

More specifically, although as specified above in Figure 3, contractFootnote ¹²⁹ and legitimate interestFootnote ¹³⁰ may be deemed appropriate in a B2 C ISS context under the scope of the GDPR, their applicability to the collection of such passive data provision in the current context is unlikely for two specific reasons. First, within the meaning of the draft versions of the proposalFootnote ¹³¹ and Article 3(1) Digital Content Directive Compromise, the provision of personal data necessary for the performance of a contract is excluded from the Directive’s scope of application. Second, in relation to IP addresses, although one cannot deny the potential application of other conditions for lawful processing—such as legitimate interest in Article 6(1)(f) GDPR, as confirmed in the Breyer case—,Footnote ¹³² in the context of online behavioral advertising, consent is often the condition most likely to be deemed applicable, as the fair balancing act required under Article 6(1)(f) GDPR is unlikely to be satisfied. Of course, this does not comprehensively exclude the potential for advertising that does not require the consent of the data subject—contextual advertising or personal data processing that relies upon the legitimate interest or contract conditions which may relate for example to security purposes or processing necessary for the provision of a service—from being excluded from the scope of the Directive.

Indeed, this point appears to be reflected in the Parliament’s proposed modifications to the Digital Content Directive, given that rather than referring to processing that is strictly necessary for the performance of a contract requested by the consumer—for example, as in the Commission version—reference was made to personal data “exclusively processed by the trader for supplying, maintaining the conformity of or improving this digital content or service.”Footnote ¹³³ Therefore, to summarize the above: The point proposed here is that this draws a line between different types of personal data in a context where the processing of both types requires the consent of the data subject under data protection and privacy law provisions.Footnote ¹³⁴ Although by removing the terms passive and active, the Compromise Directive aims to avoid the problems associated with delineating based on the manner in which the personal data is provided, the difficulties from a data protection and privacy perspective remain. This criticism is even clearer in the context of cookies.

Building on the above, the disregard for the lex specialis protections provided for in Article 5(3) of the e-Privacy Directive is striking.Footnote ¹³⁵ In short, Article 5(3) ePrivacy DirectiveFootnote ¹³⁶ essentially provides for a higher degree of protection for the use of cookies or cookie-like technologies when used for non-functional purposes, by essentially mandating user consent as defined in the GDPR. Cookies come within the functional cookies exemption if either: (a) They are used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network”;Footnote ¹³⁷ or (b) the cookie is “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.”Footnote ¹³⁸ In its opinion on the exemptions, the Article 29 Working Party has noted that these are to be interpreted narrowly, and that, therefore, cookies for user tracking, third party advertising, or first party analytics, inter alia, do not come within their scope.Footnote ¹³⁹ Article 5(3) ePrivacy Directive, therefore, essentially denies the availability of the other conditions available in Article 6(1) GDPR for the processing of such personal data.Footnote ¹⁴⁰ The distinction is justified as such methods are deemed to interfere with the terminal equipment—construed to mean consumer electronic devices and not just mobile phones—and, thus, the private sphere of the individuals concerned. This point is exemplified in the wording of Article 5(3) ePrivacy Directive which refers to the accessing of information stored or the storing of information, rather than the narrower category of personal data which refers to information which must relate to an identified or identifiable natural person as per Article 4(11) GDPR. It is therefore hard to understand how this differentiation between types of personal data aligns with the requirement of consent for the storing or accessing of information already stored on the terminal equipment of users—like cookies—as provided for in Article 5(3) ePrivacy Directive.Footnote ¹⁴¹

Malgieri, in his analysis of the Commission proposal, argues that the active-passive distinction is illustrative of an underlying and deliberate legislative intent to develop a personal data taxonomy and to create a separation between “received, observed, inferred and predicted data,” with only received personal data being considered “a legitimate non-monetary payment for the supply of digital content.”Footnote ¹⁴² It is submitted here, however, that despite being deliberate, rather than representing an informed legislative choice, the proposal instead manifests the complex legislative history related to the attempted harmonization of contract law formation at the EU level and an apparent disregard for the nuances in data protection and privacy. The EDPS was particularly strong in his criticism of the Commission draft, the EDPS proposes the use of the notion of services as defined in the Treaties to encompass services where no price is paid. To clarify, in the ISS context the e-Commerce Directive includes services financed by advertising,Footnote ¹⁴³ and the Court of Justice has found that services as defined by Article 57 TFEU do not necessarily require payment by the users.Footnote ¹⁴⁴ As a second, but inherently linked alternative, the EDPS suggested that one could refer to Article 3(2)(a) GDPR, which specifies the territorial scope in the GDPR, by stipulating that the GDPR applies where personal data are processed in “the offering of goods or services, irrespective of whether a payment of the data subject is required.”Footnote ¹⁴⁵

Nevertheless, despite the EDPS’s suggestions, there is somewhat of a question mark surrounding whether a service, as defined in either the GDPR, e-Commerce Directive, or the TFEU, may be deemed distinct from a service contract.Footnote ¹⁴⁶ To clarify, a service contract is defined in Article 2(6) of the Consumer Rights Directive (CR Directive) as “any contract other than a sales contract under which the trader supplies or undertakes to supply a service to the consumer and the consumer pays or undertakes to pay the price thereof.”Footnote ¹⁴⁷ In interpreting the scope of the Directive broadly and seemingly in line with Article 57 TFEU, DG Justice has stated in its interpretative guidance of the CR Directive that such contracts do not require the payment of a price by the consumer, but that accessing online services without the express contractual agreement of individuals is excluded from its scope.Footnote ¹⁴⁸ Hence, as noted by Helberger, Borgesius, and Reyna, “contracts [for the supply of digital content in exchange of data] that are concluded by tacit agreement would escape the application of the Consumer Rights Directive.”Footnote ¹⁴⁹ As pointed to above, this is undoubtedly the root of the confusion and is illustrative of the clear differences between the data protection and privacy, and consumer protection policy agendas. In simple terms, EU consumer protection, as illustrated by the interpretation given to the CR Directive, draws a distinction between express and tacit agreement which simply does not exist in the data protection and privacy framework.

In essence, therefore, it appears that the differentiation between types of personal data or in the Commission proposal—active and passive collection—may stem from the fact that there is uncertainty as to whether a contractual agreement can be formed under all respective Member State contract law traditions in situations where only such passive data are collected. Indeed, from a common law perspective, given the need for consideration for a valid contract formation, it is unclear whether, for instance, browse-wrap contracts necessarily form a valid B2 C consumer contract—unless personal data is considered consideration. As described above, however, one must question how this interpretation aligns with Article 5(3) ePrivacy Directive and the requirement for consent for the storing or accessing of information already stored on the terminal equipment of a user, like cookies, as defined in the GDPR. In simple terms, it is the same consent that will be used to legitimize the provision of both types of personal data, and accordingly, it is difficult to imagine how such a delineation could be justified.

Furthermore, given the intended strength of the definition of consent in the GDPR, it would seem unlikely that this could be positioned as tacit. Indeed, as outlined above in Section B(II), consent as defined in Article 4(11) GDPR requires a “freely given, specific, informed and unambiguous indication of the data subject’s wishes by … a statement or by a clear affirmative action, [signifying] agreement to the processing of [their] personal data.”Footnote ¹⁵⁰ Irrespective of such nuancing however, when combined with the conditions for consent in Article 7 GDPR as outlined above, one must question how the delineation between forms of data provision could be deemed in line with the GDPR and ePrivacy Directive requirements.Footnote ¹⁵¹ It is perhaps with this criticism in mind that the Compromise Directive focuses instead on types of personal data. Despite the above the Compromise version de facto retains the distinction and therefore, there is a large degree of uncertainty as to how all this fits together.

2. Counter-Performance or De Facto Counter-Performance

Aside from the confusion surrounding the differentiation between the passive and active personal data provision, albeit undoubtedly connected, there are also clear difficulties with the provision of personal data for access to a service and thus the controversy stemming from the inclusion of the notion of counter-performance in the Commission proposal. In particular, the EDPS highlighted three concerns associated with the use of the term counter-performance. First, the Commission proposal failed to define the term and that the use of one simple catch-all term appears to oversimplify a variety of business models and data usages. Second, linking the active provision of data with the paying of a monetary price is misleading as consumers are often unaware of what they are giving away when it comes to data, and this is not helped by the use of vague and elastic terms to describe the use of the collected data. Third, data and money are clearly not identical, as providing personal data does not deprive an individual of using this same data repeatedly and this complicates matters when it comes to restitution.Footnote ¹⁵² Thus, expressly recognizing personal data as counter-performance is controversial from a data protection perspective, because from a normative perspective there are no proprietary rights in personal data.Footnote ¹⁵³

Although the final Compromise deletes the references to the term “counter-performance,” potential concerns remain, given that the Directive now de facto appears to retain such a role for personal data. The final Compromise stipulates that the Directive applies where the consumer provides or undertakes to provide personal data to the trader. This language appears to have been inspired by the Parliament and Council versions. In particular, the Parliament draft of Article 3(1) stipulated that the Directive:

Indeed, at first glance this draft provision seemingly did away with the notion of counter-performance by stating that the proposed Directive applied when access to digital content or a digital service is conditional upon on the provision of personal data. It is argued here however, that the Parliament’s proposed amendments instead merely presented a more subtle recognition of personal data as a de facto quasi-price. This interpretation is further supported when one compares Recital 13 of the Commission draft with the modifications to this provision proposed by the Parliament, see Figure 5 below.

Figure 5.

When compared to the Commission version, the Parliament’s proposed modifications of Recital 13 reveal that the omission of the term “counter-performance” in its draft Article 3(1), merely implicitly recognized the same role. In short, the Parliament’s approach instead acknowledged such a status for personal data by recognizing that access to digital content and services can be conditional upon the provision of personal data. This is evidenced by the retention of the term counter-performance in the Parliament draft of Recital 13, as illustrated in Figure 5 above.

The Council’s proposed modifications of Article 3(1) presented another variation, but in essence reflect the underlying intention made apparent from the above discussion of the Parliament amendments. More specifically, the Council version of Article 3(1) stated that:

As such, the Council modifications replaced the notion of counter-performance and instead framed the role of the provision of personal data in negative terms. More simply, according to the Council version, the Directive does not apply if the consumer does not provide or undertake to provide personal data. This is in contrast to the Commission text that recognized the notion of counter-performance, and the Parliament amendments which provided for situations in which traders give access to digital content or services to consumers either through “the payment of a price or under the condition that personal data is provided.”Footnote ¹⁵⁶ Thus, although the Council amendments certainly reflected the discussion above in relation to the acknowledgement of personal data as de facto counter-performance, they also appear to indicative of the Member State reticence in relation to any attempt to harmonize contract law formation at the EU level. Indeed, the Council construction of the provision, in addition to their intention to retain the passive-active distinction, revealed the fear that a positive acknowledgement of personal data as counter-performance in an EU legislative text, even if implicit, would have had an impact on this tightly guarded aspect of national contract law. This is evident in footnote 15 of the Council’s general approach which included the specification that the contractual protections in its version of the proposed Directive can be extended to situations where only passive data are provided where this is considered a contract by national law.Footnote ¹⁵⁷ Importantly, the concerns manifested in the Commission and Parliament versions are reflected in the final Compromise.

The Compromise version tries to create a clear delineation between contracts supplied for a price versus those created where the consumer provides personal data. There is some very careful wording in the Compromise in comparison to the Commission proposal incorporating the concerns associated with recognising personal data as an economic asset to be bartered and traded and thus the Council and Parliament versions. Here reference can be made to Recital 13 Digital Content Directive (Compromise) which states inter alia that, “[w]hile fully recognising that the protection of personal data is a fundamental right and therefore personal data cannot be considered as a commodity, this Directive should ensure that consumers are in the context of such business models entitled to contractual remedies.”Footnote ¹⁵⁸ In other words, therefore although personal data cannot be considered as a commodity, the provision of personal data can give rise to a contract with the consent of the consumer-data subject—provided the other requirements on contract law formation in national law are met—giving rise to a consumer contract.Footnote ¹⁵⁹

For instance, from a common law perspective recognizing that the provision of personal data gives rise to a contract could essentially lead to the personal data being regarded as sufficient consideration.Footnote ¹⁶⁰ Therefore, although the use of the term counter-performance attracted much ire, it is perhaps the underlying recognition of the economic value of personal data vis-à-vis contract formation which is the more apt target for such a debate. Somewhat counterintuitively, therefore, data protection enthusiasts critical of positioning personal data as a quasi-price may find support in those critical of contract law formation harmonization. Indeed, as noted by Mak, an important doctrinal question in this regard therefore, is how this provision of personal data will give rise to a contract in national law.Footnote ¹⁶¹ The author goes on to specify that this presents important challenges as inter alia most national contract laws require a monetary payment for a sales/services contract.This matter is far from clear-cut, and although the analysis may seem somewhat tangential to our current focus, the UCT Directive inherently assumes that in the operation of its provisions some price and consideration will be paid—as evidenced by the exclusion of such core terms from the substantive fairness element in the Directive. As a consequence, the determination of what the price is in relation to declarations of consent is an issue worthy of discussion, as it will effectively determine what is exempt. Therefore, the classification of personal data as a price is of key importance to the operation of the UCT Directive, and subsequently, the substantive fairness element contained therein.

1. Necessity and the Role of Consent

Building on the above, it is important to remember Article 7(2) GDPR laying down the requirement that consent must be presented in a manner which is clearly distinguishable from the other matters, and Article 4(11) GDPR which stipulates that consent must be freely given. The requirement for the separation of consent and other matters is reinforced in Article 7(4) GDPR which states that:

As noted by the EDPS, this separation is further evident in Recital 43 GDPR which provides that where “the performance of a contract, including the provision of a service, is dependent on… consent despite such consent not being necessary for such performance,” there is a presumption that consent is not freely given.Footnote ¹⁶³

In analyzing these provisions, one must wonder what this separation of consent and other matters—for example, the details of the contract—means from a theoretical perspective regarding the classification of the pre-formulated declaration of consent subject to the contractual protections afforded by the UCT Directive. If consent is to be separated from the provision of the service, how can the GDPR rely on the application of the protections against unfair terms in pre-formulated declarations of consent in its recitals if personal data is to be viewed as the price for the provision of the service? In other words, as consent precisely constitutes a lawful condition for the processing of an individual’s personal data and the personal data would at the same time constitute the de facto price for the provision of the service to the individual in a B2 C consumer contract sense, it seems at first glance to be counterintuitive to present consent in a manner which is clearly distinguishable from the other matters as required by Article 7(2) GDPR. This challenge manifests itself even more clearly when one recognizes the distinction between consent and contract as conditions for lawful processing.

Article 6(1)(b) GDPR provides that personal data processing is lawful where such “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”Footnote ¹⁶⁴ Importantly, the notion of necessity has its own distinct meaning within the scope of the GDPR. In essence, this refers to the necessity component in the fair balancing element of the fairness principle in data protection. The question thus becomes what is necessary for the performance of a contract and hence, the argumentation around whether—and, if so, which—personal data processing operations are integral to the delivery of free services and the economic underpinnings of the internet. The Article 29 Working Party has repeatedly noted that it seems unlikely that large scale personal data processing for commercial purposes—for example, online behavioral advertising—would satisfy this necessity test.Footnote ¹⁶⁵ There is therefore a distinction between consent and contract as conditions for lawful processing but what does this mean in terms of the conditionality of consent and thus the relationship between consent and consumer?

Here it is important to note that the Working Party has explicitly stated “the GDPR ensures that the processing of personal data for which consent is sought cannot become directly or indirectly the counter-performance of a contract.”Footnote ¹⁶⁶ Despite the fact that this is an ongoing debate, from a systematic reading of the GDPR it is indeed difficult to position personal data as a price. Such doubt also appears to reflect a teleological interpretation of the GDPR in that although the Regulation has dualist aims—for example, as it also focuses on the integration of the internal market—it is more predominantly weighted towards the protection of fundamental rights and freedoms and in particular, the right to data protection—as evidenced by its reliance on Article 16 TFEU as its legislative basis. Indeed, if one was to position personal data as the core term, how would this align to the fair balancing, and hence, the proportionality and necessity components? More specifically, the very purpose of Article 4(2) UCT Directive is to leave such matters for the contractual parties. Although data protection is not an absolute right, it nevertheless establishes key fairness checks and balances in the GDPR which must be respected.

Nevertheless, as the recent policy initiatives show, this matter is far from simple to understand. In this regard one must wonder how the Article 29 Working Party opinion on consent aligns for instance with the modifications of the consumer law acquis. How can the Article 29 Working Party issue an opinion that appears to contradict the Digital Content Directive Compromise and the new deal for consumers? And, therefore, should the freely given stipulation be understood not as a strict requirement, but instead merely as an indicator that utmost account shall be taken of whether access to the service is conditional on consent? An important point of reference here is the recent opinion by Advocate General Szpunar in the Planet 49 case where he notes that “[…] from the terms ‘utmost account shall be taken of’, the prohibition on bundling is not absolute in nature.”Footnote ¹⁶⁷ There is clearly a large degree of uncertainty here as to how these provisions and frameworks are to be interpreted. Hence, it remains to be seen not only how far consent will be stretched, but also how processing that is necessary for the contract will be delineated from additional activities. The Digital Content Directive as a legislative development, provided it is formally published in the Official Journal, should therefore be considered to have more authority than the non-legally binding opinions of the Article 29 Working Party. Ultimately, the boundaries of the notion of consent will need to be determined by the Court of Justice.Footnote ¹⁶⁸ Hence, the classification of what constitutes the core terms for the purposes of the UCT Directive remains uncertain, and this is indicative of the teething problems inherent to the alignment of the data protection and consumer protection policy agendas. This uncertainty illustrates the fundamental divide between the dominant view in data protection, which positions personal data protection as a fundamental right, and the approach in consumer protection and competition law which are increasingly recognizing and catering to the economic value of personal data.Footnote ¹⁶⁹ Although the ability to offer higher levels of protection also extends to the exclusion of the exemption provided in Article 4(2) UCT Directive in the national implementation,Footnote ¹⁷⁰ legal certainty and a fully harmonized approach appear to be at risk. In this regard it is important to remember that Recital 42 GDPR refers to pre-formulated declarations of consent specifically.

2. Positioning Consent and Applying Contractual Protections

Although it is clear from the above analysis that consent and contract are separate and entirely distinct conditions for lawful processing in the GDPR, this separation raises some doubt as to the positioning of consent in relation to the contractual protections in the UCT Directive. In other words, can consent to a pre-formulated declaration be understood as a contract in its own right despite its required separation from the provision of a service contract? Can consent in Article 6(1)(a) GDPR itself be reduced to a form of contract? And can consent to a pre-formulated declaration legitimizing personal data processing in effect act as a trigger for the formation of a B2 C consumer contract?

In responding to these complex questions, one must remember that it remains uncertain as to whether the separation of consent and contract in Article 7(4) GDPR is merely potentially indicative of a scenario in which the freely given stipulation may be infringed and, hence, whether it in fact gives rise to a rebuttable presumption and does not entirely delegitimize rendering access to a service conditional upon the provision of personal data. Indeed, despite the Article 29 Working Party Opinion, this remains a matter for the Court of Justice to decide. It is thus arguable that privacy policies in addition to terms of use should be presented as the provisions of the contract with the declaration of consent being a separate, and, indeed, revocable but connected part of the same overarching contractual agreement, despite the presumption and associated burden of proof. With this in mind, personal data does not necessarily have to constitute a price, but the protection of it may be encompassed within the contractual agreement as both explicitFootnote ¹⁷¹ and implied terms.Footnote ¹⁷² Currently interpreting where personal data fits is a matter for national contract law and national courts.

This interpretation does not, however, render contract and consent synonymous—as contract law assumes the autonomous decision making capacity of individuals. Therefore, although the formation of a contract requires the voluntary assent of the parties, consent in data protection cannot be reduced to a form of contract, given that it must not always be freely given, specific, informed, and unambiguous as understood under the GDPR, in order for it to be considered a B2 C contract. This is indicative of the fact that the UCT Directive focuses on the fairness of the terms themselves and explicitly excludes the analysis of the validity of the contract formation. As such, the validity of a data subject’s consent and the fairness of the pre-formulated declaration of consent are two connected, but distinct, issues. Nevertheless, this higher threshold for consent in data protection does not exclude the possibility that the data subject’s consent may give rise to a B2 C contract. Indeed, this currently hinges on whether the provision of personal data can be recognized as conditional for the provision of the service in national contract law, or indeed on whether national contract law otherwise recognizes the existence of a B2 C contract.Footnote ¹⁷³ The Article 29 Working Party opinion should therefore be taken with a grain of salt, as this is an issue which is far from resolved. As such, much hinges on the interpretation of the Digital Content Directive (Compromise) and Article 7 GDPR by the Court of Justice, as well as the reform of the ePrivacy Directive and therefore the proposed ePrivacy Regulation.

To illustrate, one can refer here to the debate surrounding the legitimacy of cookie walls in the discussion surrounding the proposed ePrivacy Regulation. More specifically, as outlined above in Section D(I)(1), Article 5(3) ePrivacy Directive requires consent for the “storing of information, or the gaining of access to information already stored, in the terminal equipment” of the user.Footnote ¹⁷⁴ There are ongoing debates as to whether there should be a ban on cookies walls—such as cookie notices which require you to accept the use of cookies in order to access the service—as these effectively render access to the service conditional upon consent with the EDPS, and others criticizing the failure to include a specific ban on the use of cookie walls.Footnote ¹⁷⁵ Following this criticism, the European Parliament draftFootnote ¹⁷⁶ introduced a ban on the use of cookie walls.Footnote ¹⁷⁷ But, the Council’s consolidated approach, released on December 5^th, 2017, did not follow this example.Footnote ¹⁷⁸ As such, it remains largely uncertain how this will be resolved and the various rumblings which have emerged since the release of the two drafts referred to above indicate that this is still a very sticky issue. Indeed, in this regard it is important to note that the reform of the ePrivacy Directive as a lex specialis framework could essentially decide the conditional consent debate and provide the practical interpretation for the GDPR. To clarify, given that cookies are considered personal data and are effectively a key means through which personal data is gathered in an ISS context, a failure to ban cookie walls, or indeed the provision of a partial ban in the lex specialis rules, would seemingly legitimize the use of such technologies by omission—at least in certain circumstances.Footnote ¹⁷⁹

From the above, therefore, although the legislator intended to cross-reference the protections in the UCT Directive in Recital 42 GDPR for pre-formulated declarations of consent, there are many unresolved issues centered around the recognition of the economic value of personal data. Despite the fact that the EDPS and Article 29 Working Party have criticized the positioning of personal data as a form of payment, this remains a highly contentious issue with divergences in interpretation amongst policy makers, academics, and even different enforcement bodies.Footnote ¹⁸⁰ Indeed, at first glance, it seems unlikely from a systematic and teleological interpretation of the GDPR that personal data could be positioned as the price, given the separation of data subject consent from other matters in order to be certain that it will not fall foul of the freely given requirement; despite this fact, this position has not been reflected in consumer protection and competition law and policy. The uncertainty regarding the recognition of the economic value of personal data described above raises a number of issues in terms of how the GDPR may be interpreted in practice and by the Court, in particular in light of the Digital Content Directive (Compromise). One must therefore wonder whether the Article 29 Working Party opinion on consent is truly sustainable in the current regulatory environment. The action taken by Max Schrems referred to in the introduction will hopefully provide the answer to this question, however, one must wonder whether a more tiered understanding of conditionality is in fact needed.