Additional Key Input for Phase 1 - VKI v Amazon EU Sárl judgement of CJEU
Greetings all, I would like to introduce a new key input for your consideration and for Phase 1 of our work. The Court of Justice of the European Union (CJEU) has recently delivered a judgment on the applicability of data protection laws in reference to VKI v Amazon EU Sárl (Case C-191/15). I have summarised the Court’s judgement below, as it may have a bearing on our work when we come to consider what data should be collected, stored, and disclosed. In this case, the defendant (Amazon) was established in Luxembourg. It maintained a website which was accessible to Austrian consumers and allowed persons in this territory to enter into electronic sales contracts. However, Amazon has no registered office or employees in Austria. It also did not allow consumers to negotiate their sales contract – they could either accept it, or were asked to exit the website. Inside this contract, the terms permitted Amazon to make use of data supplied by consumers and stated that Luxembourg law applied, despite the fact that the consumers themselves were not established in Luxembourg. The claimant (VKI) applied to the Austrian court for an injunction to prohibit the use of these terms. The Austrian Supreme Court referred the case to the CJEU. The CJEU held, among other things, that the fact that Amazon does not have an office or subsidiary in Austria does not preclude it from having an establishment there. Therefore the CJEU held that it is for the national court to ascertain whether or not Amazon carries out the data processing in question in the context of the activities of an establishment situated in Austria or in Luxembourg or elsewhere. The CJEU also held that the choice of law clause in Amazon’s contract was unfair, because under the Rome I Regulation, European consumers enjoy the protection of the mandatory provisions of the law which apply in the location where they are established. Amazon was wrong to give consumers the impression that only the laws where Amazon is established apply. You can read the entire judgement here (it is available in multiple languages, if more convenient): http://curia.europa.eu/juris/document/document.jsf?text=&docid=182286&pageIn... I am not a lawyer, but from my reading of this case it would appear to have some implications for domain name registrars and other parties doing business with European consumers. This would be especially true for such entities registered themselves in the European Union. Best wishes, Ayden Férdeline
Please note that cases determining choice of law for internet related transactions across traditional territorial boundaries exist in several jurisdictions. I believe it is out of scope for us to consider these, as to my knowledge, these cases are very fact specific. From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Ayden Férdeline Sent: Saturday, August 13, 2016 1:05 PM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: [gnso-rds-pdp-wg] Additional Key Input for Phase 1 - VKI v Amazon EU Sárl judgement of CJEU Greetings all, I would like to introduce a new key input for your consideration and for Phase 1 of our work. The Court of Justice of the European Union (CJEU) has recently delivered a judgment<http://curia.europa.eu/juris/document/document.jsf?text=&docid=182286&pageIn...> on the applicability of data protection laws in reference to VKI v Amazon EU Sárl (Case C-191/15). I have summarised the Court’s judgement below, as it may have a bearing on our work when we come to consider what data should be collected, stored, and disclosed. In this case, the defendant (Amazon) was established in Luxembourg. It maintained a website which was accessible to Austrian consumers and allowed persons in this territory to enter into electronic sales contracts. However, Amazon has no registered office or employees in Austria. It also did not allow consumers to negotiate their sales contract – they could either accept it, or were asked to exit the website. Inside this contract, the terms permitted Amazon to make use of data supplied by consumers and stated that Luxembourg law applied, despite the fact that the consumers themselves were not established in Luxembourg. The claimant (VKI) applied to the Austrian court for an injunction to prohibit the use of these terms. The Austrian Supreme Court referred the case to the CJEU. The CJEU held, among other things, that the fact that Amazon does not have an office or subsidiary in Austria does not preclude it from having an establishment there. Therefore the CJEU held that it is for the national court to ascertain whether or not Amazon carries out the data processing in question in the context of the activities of an establishment situated in Austria or in Luxembourg or elsewhere. The CJEU also held that the choice of law clause in Amazon’s contract was unfair, because under the Rome I Regulation, European consumers enjoy the protection of the mandatory provisions of the law which apply in the location where they are established. Amazon was wrong to give consumers the impression that only the laws where Amazon is established apply. You can read the entire judgement here (it is available in multiple languages, if more convenient): http://curia.europa.eu/juris/document/document.jsf?text=&docid=182286&pageIn... I am not a lawyer, but from my reading of this case it would appear to have some implications for domain name registrars and other parties doing business with European consumers. This would be especially true for such entities registered themselves in the European Union. Best wishes, Ayden Férdeline
Hi, I would suggest we consider the Court's verdict, given it has sought in this instance to unify disparate European laws on this subject. In this case the Court of Justice of the European Union has found that the jurisdiction clauses which are routinely inserted into consumer contracts might well be irrelevant when deciding which Member State’s data protection laws apply. As you know, I am not a lawyer, but this is something that I imagine could impact our European registrars. Especially if, in the future, we talk about a gated access system that stores personally-identifiable data? Maybe this isn't for Phase 1 of our work plan, but I would respectfully submit that this is a ruling we do need to give consideration to. Thanks, Ayden -------- Original Message -------- Subject: RE: [gnso-rds-pdp-wg] Additional Key Input for Phase 1 - VKI v Amazon EU Sárl judgement of CJEU Local Time: August 16, 2016 3:13 PM UTC Time: August 16, 2016 2:13 PM From: vsheckler@riaa.com To: icann@ferdeline.com,gnso-rds-pdp-wg@icann.org Please note that cases determining choice of law for internet related transactions across traditional territorial boundaries exist in several jurisdictions. I believe it is out of scope for us to consider these, as to my knowledge, these cases are very fact specific. From: gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org] On Behalf Of Ayden Férdeline Sent: Saturday, August 13, 2016 1:05 PM To: RDS PDP WG <gnso-rds-pdp-wg@icann.org> Subject: [gnso-rds-pdp-wg] Additional Key Input for Phase 1 - VKI v Amazon EU Sárl judgement of CJEU Greetings all, I would like to introduce a new key input for your consideration and for Phase 1 of our work. The Court of Justice of the European Union (CJEU) has recently [ delivered a judgment](http://curia.europa.eu/juris/document/document.jsf?text=&docid=182286&pageIn...) on the applicability of data protection laws in reference to VKI v Amazon EU Sárl (Case C-191/15). I have summarised the Court’s judgement below, as it may have a bearing on our work when we come to consider what data should be collected, stored, and disclosed. In this case, the defendant (Amazon) was established in Luxembourg. It maintained a website which was accessible to Austrian consumers and allowed persons in this territory to enter into electronic sales contracts. However, Amazon has no registered office or employees in Austria. It also did not allow consumers to negotiate their sales contract – they could either accept it, or were asked to exit the website. Inside this contract, the terms permitted Amazon to make use of data supplied by consumers and stated that Luxembourg law applied, despite the fact that the consumers themselves were not established in Luxembourg. The claimant (VKI) applied to the Austrian court for an injunction to prohibit the use of these terms. The Austrian Supreme Court referred the case to the CJEU. The CJEU held, among other things, that the fact that Amazon does not have an office or subsidiary in Austria does not preclude it from having an establishment there. Therefore the CJEU held that it is for the national court to ascertain whether or not Amazon carries out the data processing in question in the context of the activities of an establishment situated in Austria or in Luxembourg or elsewhere. The CJEU also held that the choice of law clause in Amazon’s contract was unfair, because under the Rome I Regulation, European consumers enjoy the protection of the mandatory provisions of the law which apply in the location where they are established. Amazon was wrong to give consumers the impression that only the laws where Amazon is established apply. You can read the entire judgement here (it is available in multiple languages, if more convenient): http://curia.europa.eu/juris/document/document.jsf?text=&docid=182286&pageIn... I am not a lawyer, but from my reading of this case it would appear to have some implications for domain name registrars and other parties doing business with European consumers. This would be especially true for such entities registered themselves in the European Union. Best wishes, Ayden Férdeline
participants (2)
-
Ayden Férdeline -
Victoria Sheckler