Safe Harbor is No Longer Safe

A recent ruling in the Court of Justice of the European Union (CJEU) has had a significant on European data protection law. The CJEU had previously ruled that a framework devised by the US Department of Commerce known as “Safe Harbor” provided adequate protection to EU citizens, and their personal data, for instances when their personal data was being handled outside of the EU (i.e. in the USA).

Until October 2015, a US company would simply have to be a member of Safe Harbor, which would give them a broad stamp of approval to handle personal data of EU citizens. This has now changed; to comply with the existing Safe Harbor framework is no longer sufficient in demonstrating that a US company is complying with EU data protection law.   

The Case

The case that has forced this change was Maximillian Schrems v Data Protection Commissioner, and it was a case originally brought before the Irish Data Protection Commissioner by an Austrian citizen. The individual, Mr Schrems, alleged that his personal data held by Facebook was not being adequately protected as it was being transferred from Facebook’s subsidiary in Ireland to servers located in the US. Mr Schrems also sought to successfully argue that, in light of the data protection concerns raised by Edward Snowden in 2013 and the increased awareness of the invasive techniques used by the US intelligence services in relation to personal data held in the US, Safe Harbor can no longer provide assurances that data is protected to a standard that an EU citizen would expect. The court also ruled that data protection authorities within EU member states are not prevented from considering complaints from individuals that their data has not been properly protected outside of the EU. The ability to do this was previously prohibited.

The implications

The ruling has, at least for the time being, left industries that involve themselves in transatlantic data sharing somewhat shell-shocked. The assurance that meant Safe Harbor was automatically considered to provide the adequate protection under EU law is no longer there, and EU companies must now seek specific assurances from their US counterparts. 

For EU or EEA based companies, the CJEU ruling will act as a prompt to review contracts with US based data hosts in order to consider whether additional measures need to be added to these agreements to ensure that they offer greater protection than that offered by Safe Harbor.

This ruling could even have an impact on small (non-international) UK companies, as such companies will often use cloud storage for storing personal data. Providers of cloud storage regularly store the data on a US server because US hosting is cheaper, and they will not always tell the customer they are doing so. So in light of the ruling, it is important that companies using cloud storage pay close attention to where their data is being stored, and under what terms.

Cloud providers themselves will also have to ensure their legal processes are now more watertight.  This will include using additional methods recommended by the Information Commissioner’s Office, such as using standard EU contract terms or in the case of a larger,  international group of companies, by entering into what is called binding corporate rules between themselves. These will then give the requisite assurances to both the data protection authorities and the data subjects that their data should be safe.

The future

It is most likely that, in the interim at least, EU companies will possibly have to tweak data handling contracts held with US companies on a case-by-case basis, where they feel it is necessary and appropriate as part of protecting the personal data of EU citizens. Further into the future, it is possible that the European Commission will devise a set of standardised terms which could be inserted by EU companies into the contracts that they enter into with US companies in order to offer improved protection.  

Beyond this, the most logical long-term solution would be for the EU and US to devise a new transatlantic data-sharing agreement with a stricter set of standards, a ‘Safe Harbor 2.0’ effectively. It may however prove difficult once again to regularise dealings with US companies in this way, as the invasive behaviour of US intelligence services may prove difficult to control.

Should you require any further information, or advice, on this topic, or any assistance in modifying your data sharing and processing contracts, please get in touch.

Brian Miller is a solicitor and partner and Richard Jones a trainee solicitor at Stone King LLP, providing specialist advice in the fields of intellectual property, IT, data protection and commercial law.

Disclaimer: This article may not be reproduced without the prior written permission of the author. This article reflects the current law and practice. It is general in nature, and does not purport in any way to be comprehensive or a substitute for specialist legal advice in individual circumstances.

A Guide to the Consumer Rights Act 2015 by Brian Miller Solicitor

(A downloadable version of this article in PDF format can be found here.)

The main sections of the Consumer Rights Act 2015 (“CRA”) came into force today (1 October 2015). This is a significant update and consolidation of consumer law, with the business-to-consumer aspects of long-standing pieces of legislation such as the Sale of Goods Act 1979 and the Supply of Goods and Services Act 1982 being repealed.

The new law relates to business-to-consumer transactions only and makes it clear what should happen when goods or digital content are faulty, or when services are not provided with reasonable care and skill.

Some of the main points of the CRA are as follows:

• Within thirty days of purchase, a consumer has a right to an immediate refund if the goods supplied are faulty
• Within six months of purchase, if a faulty good cannot be repaired or replaced then the consumer will be entitled to a full refund in most cases
• For up to six years, if purchased goods do not last a reasonable length of time, you may be entitled to some money back
• If a business does not carry out a service with reasonable care and skill, the consumer has a right to request that the service be repeated or fixed.  If it cannot be fixed, the consumer will be entitled to some money back
• If a consumer and business have not agreed a price before the service is delivered, the consumer must pay a reasonable price
• If a timescale for the delivery of a service has not been agreed beforehand, then it must be carried out by the business within a reasonable time
• If a consumer has purchased digital content which is faulty, then they are entitled to a repair or replacement
• If a fault with digital content cannot be fixed, or if it has not been fixed within a reasonable time and without significant inconvenience, the consumer is entitled to either a full or partial refund
•  If a consumer can demonstrate that the faulty digital content has damaged their electronic advice and that the business has not used reasonable care and skill, the consumer may be entitled to a repair of that device or compensation

  

The Sale and Supply of Goods

What can the consumer expect?

Under the CRA, certain standards apply for the sale and supply of goods (including hire purchase, hire, part exchange and contracts for work and materials).

The business/trader selling the goods must have the right to do so and the goods must:

• Be of a satisfactory quality Goods must be of a standard that a reasonable person would regard as satisfactory. The quality of the goods covers a number of factors including:
• fitness for purpose (in the context of the purposes for which the goods of that type are usually supplied)
• appearance and finish
• minor defects
• safety
• durability

In assessing the quality of the goods, all of the relevant factors must be considered, including price, description, and the advertising used by the business/trader.

• Be fit for a particular purpose - When a consumer indicates that goods are required for a specific purpose, or where it is obvious that goods are intended for a particular purpose and a trader/business supplies them to meet that requirement, the goods should be fit for that specified purpose.
• 
  
• Match the description - When a consumer relies on a description (or perhaps a sample or display model) the goods supplied must match expectations. If the goods do not conform, an offence may have been committed.
• 
  
• Be installed correctly - This is where installation has been agreed as part of the consumer contract.

A consumer’s remedies for breach of rights

·         Short-term right to reject

o    If the goods do not meet the requirements above, there is a short period during which the consumer can reject them. This period is thirty days unless the expected life of the goods is shorter (e.g. highly perishable goods). This right does not apply where the only breach relates to an incorrect installation of goods

o    If the consumer asks for repair or replacement during the thirty day period, the period is paused so that the consumer has the remainder of the thirty day period, or seven days (whichever is longer) to check whether the repair/replacement has been successful and to decide whether to reject the goods

o    When the goods are rejected, the consumer is entitled to a full refund

o    The trader is responsible for the reasonable cost of returning the goods, unless the consumer is returning them to the place where he took possession of them (and assuming that this is a requirement under the contract in order to get a refund)

·         Repair or replacement

o    When there has been a breach of the sales contract and the customer has failed to exercise any right to reject the goods, then he or she will be entitled to claim a repair or replacement

o    This repair or replacement must be carried out with no cost to the consumer, and in a reasonable time and without causing significant inconvenience to the consumer

o    Where repair or replacement fail, the consumer is entitled to further repairs or replacements or he can claim a price reduction or the right to reject

·         Price reduction and the final right to reject

o    If repair or replacement is not available or unsuccessful, or is not provided within a reasonable amount of time and without significant inconvenience to the consumer, then the consumer can claim a reasonable price reduction or reject the goods by returning them to the trader.

The burden of proof

·        Regardless of the remedy being pursued, if the defect is discovered within six months of delivery, it is assumed that the fault was there at the time of delivery unless the business/trader can prove otherwise

·         If more than 6 months has elapsed, the consumer has to prove the defect was there at the time of delivery

The Supply of Services

What can the consumer expect?

The trader/business supplying the service must ensure that the following standards are met:

·    The service must be carried out with reasonable care and skill
·         Where it has been relied upon by the consumer, information that has been relayed to the consumer (either orally or in writing) is binding
·         Where the price is not agreed before the service is carried out, the price must be a reasonable one (and will be judged against the prices that similar businesses/traders have charged)
·         Where there is no agreement in relation to time, the service must be carried out within a reasonable timeframe

A consumer’s remedies for breach of rights

·         A repeat performance of the service

o    This remedy can be requested when the service has not been carried out with reasonable care and skill

o    This work must be done at no cost to the consumer, within a reasonable time and without causing significant inconvenience to the consumer

·         Price reduction

o    The consumer can claim a price reduction where a repeat performance is impossible or cannot be done within a reasonable time and without causing significant inconvenience to the consumer

o    A reduction in price can also be claimed where the service has been carried out to a good standard, but where it has not been carried out in a reasonable time

o    The price reduction can be anything up to 100% of the amount paid, depending on how serious the breach has been

·         Exceptions

o    If the service has been carried out using reasonable care and skill and in a reasonable amount of time, a consumer cannot make a claim if the service did not achieve the consumer’s desired outcome, unless that outcome was agreed first

o    A consumer cannot make a claim where they are responsible for things going wrong (e.g. they requested that the trader use cheaper materials, short-cuts, etc)

The Sale of Digital Content

What is digital content?

With digital and downloadable products becoming an ever-growing and prominent part of the consumer market, the CRA ensures that consumer law makes specific requirements in relation to such content. Digital content can include products such as the following:

• Computer games
• Television programmes
• Films
• Music
• E-books
• Computer software
• Phone and tablet apps

What can the consumer expect?

The trader/business supplying the digital content must ensure that the following standards are met:

·         The digital content is of satisfactory quality

o    When deciding whether digital content is satisfactory, three factors are taken into account: any description that was attached to the digital content, the price paid and all other relevant circumstances such as public statements made in advertising and labelling

o    Quality of the digital content is to be considered in terms of safety, durability, the product being free from minor defects and the fitness for all the purposes for which digital content of that kind is usually supplied

·         Fit for a particular purpose

o    If, before a contract is made, a consumer makes known to the trader a particular purpose that he intends to use the digital content for, this becomes a term in the consumer contract. The consumer may make this particular purpose known to the trader directly or by implication

o    An exemption to this requirement is if it can be shown that the consumer did not rely on, or it was unreasonable for the consumer to rely on, the skill or judgement of the trader

·         The digital content is as described

o    The content must match the description that has been given to it by the trader

o    The content must match the description regardless of how it compares to any trial version that had been examined prior to the completion of the contract

A consumer’s remedies for a breach of rights

·         Repair or replacement

o    If there is a quality defect in the digital content, the consumer can request that the content is replaced or repaired

o    This must be done by the trader within a reasonable amount of time and without significant inconvenience to the consumer. The trader must bear any costs that are involved in replacing/fixing the content

o    The consumer does not have a right to repair or replacement if it would be impossible to do so, or it would be disproportionate in comparison to any other remedy

o    If the consumer shows that the digital content is defective within six months of its supply, it is to be taken as being defective on the day it was supplied

·         Price reduction

o    This remedy is only available where replacement/repair is not possible, or replacement/repair has been requested by the consumer, but not carried out within a reasonable time or not without significant inconvenience to them

o    The agreed reduction must be refunded without undue delay, and no more than fourteen days after the reduction has been agreed between the trader and the consumer.

Free digital content

The rights and remedies available to consumers under the CRA are still available when digital content has been given away for free, provided that the free digital content has been supplied under a contract where the consumer has to pay for goods, services or other digital content in order to get the “free” content. For example, if a consumer is given free anti-virus software when purchasing a laptop computer, the consumer would have the same rights as described above in relation to the software.

Damage caused to a device or other digital content

Where digital content has been supplied and causes damage to a device or to other digital content belonging to the consumer (and the damage is of a kind that would not have occurred if the trader had exercised reasonable care and skill), the consumer can request:

•          Repair of the damage

o    This must be carried out within a reasonable time, without significant inconvenience and without cost to the consumer

•          Payment of compensation

o    This must be given by the trader to the consumer without undue delay, and in any event within fourteen days of the trader agreeing to pay the compensation

Unfair Terms

The CRA has built upon the Unfair Contract Terms Act 1977 (“UCTA”) in relation to protecting consumers against unfair contract terms.

The test for 'unfair terms' in the CRA is the same as that in UCTA: it provides that a term is "unfair" if "contrary to the requirements of good faith, it causes a significant imbalance in the parties' rights and obligations to the detriment of the consumer".

The most significant change as now embodied in the CRA relates to 'relevant terms' (these are terms specifying the key elements of the contract, i.e. the main subject matter of the contract or setting the price). These relevant terms are not subject to the fairness test provided that they are both:

•          Transparent – in plain language, and legible (if in writing)
•          Prominent – brought to the consumer’s attention in a way that an average consumer (who is well informed and observant) would be aware of the term(s)

This test goes further than existing law, which includes the 'transparency' requirement but not the 'prominence' requirement. Businesses should now be even more wary of ensuring that relevant terms are clearly brought to a consumer's attention.

Stone King LLP

1 October 2015

If you require any further information or advice on how the Consumer Rights Act 2015 will affect your business, please get in touch.

BrianMiller is a solicitor and partner and Richard Jones a trainee solicitor at Stone King LLP, providing specialist advice in the fields of commercial law, intellectual property, IT, and data protection.

Disclaimer: This article may not be reproduced without the prior written permission of the author. This article reflects the current law and practice. It is general in nature, and does not purport in any way to be comprehensive or a substitute for specialist legal advice in individual circumstances.

The Consumer Rights Act 2015

Consumer Rights Act 2015

The Consumer Rights Act 2015 (the “Act”) received Royal Assent on 26 March and it is currently proposed that its main provisions come into force on 1 October this year. The Act is relevant to all consumers and any person or organisation that sells goods or services directly to consumers. If you are an organisation providing goods or services, the implementation of the Act provides a good opportunity for you to review your current terms and conditions and ensure that they are compliant.

Background

Before the Act, consumer law in the UK was very complicated and difficult to navigate for lawyers and even more complex for the average consumer to understand. There were no fewer than ten pieces of legislation relating to domestic consumer law ranging from the Sale of Goods Act 1979 to the Enterprise Act 2002. Consumer law was also not up to date with technological changes in the market place and did not sufficiently address issues arising from internet shopping and downloading of digital content such as apps, music, and films.

The Act seeks to amalgamate in one place the rules governing consumer rights in the UK. The Act is split into three parts: Part 1 Consumer contracts for goods, digital content and services; Part 2 Unfair Terms; and Part 3 Miscellaneous and general provisions. Below is a summary of the key provisions.

Consumer contracts

In relation to goods, the Act sets out the standards that must be met (e.g. that goods must be of satisfactory quality, as described, fit for a particular purpose and so forth) and the remedies available to consumers for goods supplied under different types of contract (previously such remedies were inconsistent). Consumers now have thirty days in which to reject substandard goods and if they reject goods within this time period, they will be entitled to a full refund. Limits have been placed on the number of times replacement goods and repairs can be offered before the provider must offer money back to the consumer and on the extent to which a provider can reduce the amount of a refund where the goods are not initially rejected (for example, if the final right to reject is exercised by the consumer in the first six months, no deduction to the refund can be made).

The Act also sets out consumer rights in relation to the provision of services. A service must be performed with reasonable care and skill, a reasonable price is to be paid for it and it must be provided within a reasonable time. The consumer has statutory remedies of repeat performance and price reduction if a service does not comply with the contract. In addition, information about the service provider or service is now binding. For example, if a salesperson says something about the service and the consumer then relies on that statement, that information will be binding (even if it is not included in a written contract).

The Act introduces a new category in consumer law namely, digital content, and sets out the statutory remedies available to consumers if their digital content rights are not met.

The rights and remedies which are available to consumer cannot be excluded or limited.

Unfair terms

The second part of the Act consolidates, but also adds to, the current laws on unfair contract terms. If a term of a consumer contract is deemed to be unfair, it will not be binding on the consumer. A term is considered unfair if, contrary to the requirement of good faith, it causes a significant imbalance in the parties’ rights and obligations under the contract to the detriment of the consumer. Schedule 2 of the Act also sets out a non-exhaustive list of terms which may be regarded as unfair (for example, a term which has the object or effect of excluding or limiting the trader’s liability in the event of the death of or personal injury).

Certain terms in a consumer contract are excluded from the “fairness” test. Terms which specify the main subject matter of the contract or relate to the price of the contract cannot be assessed for fairness provided that they are transparent (in plain and intelligible language and (in the case of a written term) are legible) and prominent (if brought to the consumer’s attention in such a way that an average consumer would be aware of the term).

Summary

So if your organisation is providing a service or selling goods directly to the consumer, we would urge you to review your terms and conditions of sale to check that they are compliant with the relevant provisions of the Act before it comes into force later this year.

BrianMiller is a solicitor and partner and Lauren Mitchum a trainee solicitor at Stone King LLP, providing specialist advice in the fields of intellectual property, IT, data protection and commercial law.

If you would like further information about the Regulations or if you have any concerns or queries in relation to them, please contact Brian.

Disclaimer: This article may not be reproduced without the prior written permission of the author. This article reflects the current law and practice. It is general in nature, and does not purport in any way to be comprehensive or a substitute for specialist legal advice in individual circumstances.

The Consumer Contracts Regulations. Is Your Business Ready?

Do you have terms and conditions with your customers which deal with consumers?  If so, the chances are that the new Consumer Contracts Regulations 2013 will apply to your business or organisation.  Brian Miller and Clive Vergnaud of Stone King LLP explain why they need to be compliant with the new Regulations.

Read more here: Consumer Contracts Regulations: Is My Business Compliant?

Protecting Your Brand and Intellectual Property by Brian Miller, Solicitor and Trade Mark Lawyer

A whistlestop tour to protecting your brand and intellectual property by registration of trademarks, design rights and domain names and the consequences of not doing so is now available at here: An Introduction to Intellectual Property by Brian Miller, Trademark Lawyer and IT Solicitor . Includes guidance on how to deal with cybersquatters, copyright and its exceptions, how to register trade marks, design rights and patents, use of databases and website compliance.

The Trademark Clearinghouse: Should I Register?

Brian Miller examines whether you should consider registering your trade mark with the Trademarks Clearinghouse or whether in fact you would just be better employing a private domain watching service. For more information, go to The Trademarks Clearinghouse: Should I Register?

EU COMMISSION PLANS INCREASE TO EU TRADE MARK FEES by Brian Miller Solicitor

Following a discovery by the EU Commission that OHIM, the body responsible for registering EU trade marks, is making a profit from its fees, the Commission plans to remove the surplus to its own funds.

As part of this review, the Commission intends to reduce the number of classes which are included in the initial one off registration fee from three classes to one. This will effectively increase costs for all businesses (but particularly small ones), who cannot ill afford this increase in costs, unless they simply decide to register an EU trade mark only in one class.

But deciding to take that strategy in order to save costs is not advisable, since if a business or organisation operates in more than one area, it will need to register in more than one class  in order properly to protect its brand. It will therefore have no choice but to pay the extra fees if it wishes to continue to do so.

OHIM fees to register a trade mark are currently €900 for an online application (€1050 otherwise), which includes three classes.  The fee for each addition class is €150 euros.  This means that, in order to sustain an application which includes three classes, the applicant will pay an extra €300 euros, an increase of 33% over the current fee for a trade mark which includes three classes.

There was a mini-hearing before the Legal Affairs Committee of the European Parliament just before the summer break, on 8 July. The issues of fees was hotly debated and member states have unanimously rejected the Commission’s legislative package, on the grounds principally that it overlooks the interests of SMEs, which the Commission hotly contests.

The debate rolls on and time will tell whether SMEs will persuade the Commission that changing from a one-fee-for-three-classes to one-fee-for-one-class approach is only going to increase the coffers of OHIM, which was the main reason for making the change in the first place!