Directive 2019/2161 of the European Parliament aims to ensure better enforcement and the modernization of EU consumer protection rules. The Omnibus directive is also known as the consumer GDPR because it sets forth hefty fines for infringements of the regulatory framework on consumer rights protection. The Omnibus directive must be transposed into the national legislation by November 28, 2021.
Why Was It Necessary?
The national rules on sanctions for consumer law breaches have varied to a great extent across the EU member states. In some cases, they were miserable and ineffective. Such a situation has led to a “Wild West” in terms of consumer rights protection regulatory frameworks. In the absence of sufficiently effective penalties, traders would often opt for maneuvering in the grey or even the black areas and would only adjust their behavior towards consumers when put on the spot by supervisory authorities. For instance, the maximum fine provided for in the Law on Consumer Protection of the Republic of Lithuania stood at merely EUR 5,000 at the time the directive was adopted.
Secondly, the existing regulatory framework did not cover certain aspects of consumer rights protection relating to digital content and online commerce. Third, there was a lack of transparency online. Fourth, price manipulation (e. g. crossed-out prices) was a big and prevalent problem in many EU member states. The Omnibus directive seeks to resolve all these issues.
It Will Affect SEO Rankings
Providers of online search functionality for products or services will be required to expressly disclose to consumers the cases where a payment has been made for a higher ranking in search results. Such a requirement was enshrined in the directive following the behavioral analysis of today’s average rushing consumer. When buying online, a consumer enters a keyword into the search field and usually chooses the first or one of the first few options offered, without going into more detail or looking at other options.
This requirement applies to online marketplaces, such as those selling products by multiple manufacturers and where manufacturers are given the opportunity to place their product at the very top of search results subject to a certain sum being paid. Information on paid rankings must also be provided by search engines and comparison websites operators. The requirement does not apply to physical stores, although all in all they are subject to identical principles: suppliers or manufacturers pay the stores for their products to be placed in the most prominent places on the shelves at eye level.
In cases where products or services are offered by various traders, such as representatives from the accommodation sector, consumers will have to be presented with the information about the default main parameters determining the ranking of offers displayed, as a result of the search query and their relative importance. These include price, location, reviews, etc.
Personalized Price Offers
Traders have been placed under a new obligation to inform when the consumer has had the price of a particular product or service changed, on the basis of automated decision-making. For instance, it has often been observed that if flight fare prices are checked a number of times from the same user IP address, all of a sudden they start to change. This gives the consumer a fake impression that the fare prices are rising and that the purchase decision needs to be made now. If such price changes are made on an automated basis, as a result of the fact that the consumer has checked the price numerous times, they will have to be informed of that. It is also important to keep in mind that the Omnibus directive is without prejudice to the validity of the GDPR, including the right of an individual to object to certain automated decision-making.
This requirement to inform will not apply to techniques such as ‘dynamic’ or ‘real-time’ pricing, that involve changing the price in a highly flexible and quick manner in response to market demands, when those techniques do not involve personalization based on automated decision-making.
Stricter Requirements for Reviews
It has been observed that, with such a plentiful supply of products and services online, consumers increasingly rely on reviews and feedback online. They may have a significant impact on their decision to buy a product or service. The directive requires that when traders provide access to consumer reviews of products, they should inform consumers whether processes or procedures are in place to ensure that the published reviews originate from consumers who have actually used or purchased the products. These amendments aim to make the consumer buying online better informed, so as to prevent them from being misled and help them make a correct and informed decision.
Not only will traders be required to publish real reviews, but they will also be under the obligation to provide information on how they have ensured that consumers posted reviews on the products or services that they actually bought or consumed. The directive requires such checks to be reasonable and proportionate, but this concept has not been elaborated on. It has been observed on the market that certain traders have already implemented this requirement of the directive, and only allow consumers to leave a review in the online store for a specific product that they have purchased. From a technical point of view, this is ensured in the following manner: when the parcel is delivered, a link to the specific product purchased is sent to the consumer’s mailbox and the consumer is only able to leave a review if they activate this link.
This requirement of the directive is closely linked to data protection, as the GDPR requires data subjects to be informed of the processing of their personal data, including the basis, purpose, and length of such processing. Information about the processing of data will need to be presented by the trader in the privacy policy of the website or in any other document which the consumer will be made aware of at the time the data is obtained.
The directive also prohibits manipulations of reviews and endorsements, such as publishing only positive reviews and removing the negative ones.
Crossed-Out Price Manipulations
The Omnibus directive calls for a stricter and more transparent way of presenting prices to consumers. Price manipulations have been a major problem across the entire EU. The Omnibus directive requires that any announcement of a price reduction should indicate the prior price applied by the trader, for a determined period of time prior to the application of the price reduction. The general rule states that the ‘prior price’ must be the lowest price applied by the trader during a period of time no shorter than 30 days, prior to the application of the price reduction.
Threat of Hefty Penalties
An infringement of the provisions of the Unfair Commercial Practices Directive, the Consumer Rights Directive, or the Unfair Terms in Consumer Contracts Directive, when they are transposed into national law, may result in a fine, the maximum amount of which must be at least 4% of the trader’s annual turnover in the member state or member states concerned. This implies potential millions in fines for traders that state product characteristics that their products do not possess, or fail to provide information about the fact that the consumer has the right to withdraw from a contract concluded at a distance, etc.
Although the Omnibus directive is dubbed the new consumer GDPR, it sets forth fines that are narrower in scope than those in the existing GDPR. The maximum fine provided for by the latter piece of legislation is EUR 20 million or 4% of the total annual global turnover of the offender, whereas the Omnibus directive requires the fine to be calculated on the annual turnover in the member states concerned. Nonetheless, the fines under the Omnibus directive could still be considerable, not least because member states are free to introduce fines exceeding the limits set by the Omnibus directive.
In summary, the directive introduces quite a few new rules for traders that will need to be properly implemented, not only from a technical point of view, but also by amending the existing terms and conditions of sale and privacy policies, and, more generally, supplementing the information provided on online marketplaces. There is still time to do this, as the requirements transposed into national legislation will only apply from May 28, 2022. However, if we do not prepare to implement the new directive ahead of time, we may again find ourselves in the same panicking situation as shortly before the GDPR came into force.
By Asta Macijauskiene, Partner, Ilaw Lextal
This Article was originally published in Issue 8.9 of the CEE Legal Matters Magazine. If you would like to receive a hard copy of the magazine, you can subscribe here.