The Week Nº19

IN-DEPTH:

Green Public Procurement and Contract Modification – Interpreting Directives 2014/24/EU and 2014/23/ EU in Light of Sustainable Development

Markus P. Beham

Between politics of suspicion and reinforced protection: the EU long-term residence Directive and deportations of ethnic Russians (Case C-752/22, EP)

Jonas Bornemann

The CETA Ratification Crises Continue: Addressing Some Questions about the French Senate’s Rejection

Gesa Kübek

The principle of openness gives way to data protection. Judgment in Case C-740/22 Endemol Shine

Susanna Lindroos-Hovinheimo

Based on VAT Directive, a national provision requiring a company to achieve a certain turnover in order to qualify for the right to deduct is prohibited: C-341/22, Feudi di San Gregorio Aziende Agricole

Marja Hokkanen

Rules regarding services enabling contact between pharmacists and consumers in the online sales of OTC medicines : C-606/21, Doctipharma

Katarzyna Mełgieś and Katarzyna Miaskowska-Daszkiewicz

SRF ex ante contributions and statement of reasons in SRB decisions before the General Court – 2023

Christy Ann Petit

THE LONG READ:

EU Data Protection Law and Pay-or-Consent Business Models

Martin Nettesheim

HIGHLIGHTS OF THE WEEK

IN-DEPT H

Green Public Procurement and Contract Modification –Interpreting Directives 2014/24/EU and 2014/23/EU in Light of Sustainable Development

Markus P. Beham

Introduction

Piotr Bogdanowicz recently brought attention to Case C-452/23 in which the German Higher Regional Court of Düsseldorf requested a preliminary ruling on whether Article 72(1)(c) of Directive 2014/24/EU should be interpreted as including public contracts concluded outside of the scope of the directive. The case concerns the operation of charging stations for electric vehicles along the German motorway. As Bogdanowicz already pointed out, the Court will have to reformulate the question to address the same issue with regard to Article 43(1)(c) of Directive 2014/23/EU since the case relates to concession contracts. But the form in which the concessions were originally granted might not prove as controversial as the request for a preliminary ruling suggests. The Court already made it sufficiently clear that Directive 2014/23/EU with its rules on contract modification applies irrespective of whether ‘the original concession contract was concluded prior to the adoption of EU rules on the matter ’. At the heart of the request lies a much larger question: whether the green transition will allow for the modification of existing concession contracts or lead to a wave of new tenders.

Adding Charging Stations to Existing Concessions

Recital 75 of Directive 2014/23/EU recognises that concession contracts ‘typically involve long-term and complex technical and financial arrangements which are often subject to changing circumstances’. A new concession award procedure is required wherever material changes to the initial concession take place, for example, if such changes concern ‘the scope and content of the mutual rights and obligations of the parties’. That would be the case, ‘ if the amended conditions would have had an influence on the outcome of the procedure, had they been part of the initial procedure’. In the present case, the initial procedure concerned the operation of gas stations and rest areas along the motorway with the purpose of allowing road users to refuel their vehicles and rest without having to leave the motorway. The provision of charging stations for electric vehicles clearly appears to would have fallen within this scope.

Instead, an existing concession may simply be modified, for example, whenever this has ‘ become necessary following the need to accommodate requests from contracting authorities or contracting entities’. Regulation (EU) 2023/1804 requires Member States to provide a minimum number of charging stations on their road networks by 2025. In the case at hand, Section 3(1) of the German Fast Charging Act provides for an appropriate nationwide

provision of fast charging stations for electric vehicles. For existing concession contracts for the operation of facilities in the sense of Section 15 of the German Federal Motorway Act, Section 5(3) of the German Fast Charging Act specifically envisions contract modifications for the inclusion of charging stations. This is further confirmed by the explanatory memorandum in the parliamentary materials and the fact that paragraph 4 of said provision envisions a new bidding process only where no modification of an existing contract proved possible.

As Recital 76 of Directive 2014/23/EU lays out, modifications may also become necessary in the case of unforeseen externalities, ‘ in particular when the performance of the concession covers a long period ’. One would have needed more than a crystal ball to foresee in the mid 1990s the extent of the transition to electric mobility, prohibiting the sale of vehicles other than those with zero CO2 emission after 2035, let alone the level of European integration that has since taken place. The road to sustainable development that began with the Treaty of Maastricht in 1992 is only linear in retrospect. Still today, Member States and car manufacturers are resisting the full transition to electric vehicles and have managed to lobby for an exception for e-fuels (which will not require much adaptation of existing gas stations). The coming elections for the EU Parliament might bring further resistance against the green transition towards zero CO2 emission vehicles. The outcome ultimately remains unforeseeable and subject to political developments within the Union and the Member States.

Recital 76 of said Directive further specifies that a new tender should only be required where the modification would result ‘ in an alteration of the nature of the overall concession, for instance by replacing the works to be executed or the services to be provided by something different ’. While the original concessions, of course, included the operation of gas stations as an essential element, the nature of the overall concession was to provide the necessary facilities that allow road users to ‘refuel’ themselves and not just their vehicles, all in the interest of road safety and a rapid and smooth flow of traffic. It is hard to see how the need to recharge a vehicle is any different from having to fill it with gasoline. The time it takes to fully recharge an electric vehicle has rather created a new type of road user that is even more dependent on additional facilities such as rest areas, shops, or restaurants already covered by the existing contracts (and which stand-alone charging stations often lack, forcing drivers of electric vehicles to make additional stops at gas stations with all of their facilities).

Green Transition as an Interpretative Maxim

The green transition is inherently embedded in the application of EU law. As the Court has confirmed, environmental protection is not just a political goal of the EU but ‘a mandatory requirement ’. In accordance with Article 3(3) TEU, the Union shall ‘work for the sustainable development of Europe based on [...] a high level of protection and improvement of the quality of the environment’. Article 11 TFEU clarifies that these requirements ‘must be integrated into the definition and implementation of the Union’s policies and activities, in particular with a view to promoting sustainable development’. Furthermore, Article 191(1) TFEU lays out that ‘Union policy on the environment shall contribute to pursuit of [...] preserving, protecting and improving the quality of the environment, protecting human health’ and ‘promoting measures at international level to deal with regional or worldwide environmental problems, and in particular combating climate change’. This is echoed by Article 38 of the Charter of Fundamental Rights of the European Union.

For now at least, the Union and its Member States have committed to the goal of electrifying mobility, including in the public sector. The Green Deal sets the goal of net zero CO2 emissions by 2050 – reflected in the binding norm of Article 2(1) of the European Climate Law – and estimates that by 2025 ‘about 1 million public recharging and refuelling stations will be needed for the 13 million zero- and low-emission vehicles expected on European roads’. With an eye to the threat to human health and ecosystems through spills and soil contamination from fossil fuels, the ‘ The Zero Pollution Vision for 2050: A Healthy Planet for All’ includes the long-term goal of reducing pollution to a minimum. Finally, the Governance Regulation sets out to achieve the EU goals on climate action in the most efficient way possible.

It follows that Directive 2014/23/EU and its rules on the modification of concession contracts must be read in light of the green transition. If modification is a readily available and effective option, this is the route to pursue. Of course, as Recital 32 of Regulation 2023/1804/EU makes clear, once existing concession contracts run out, new concessions should be awarded in a way as ‘to prevent the encroachment of green spaces, as well as to limit deployment costs and to enable new market entrants’. Sealing additional soil with asphalt and new charging facilities is surely not in line with the Soil Strategy for 2030.

Charging is the New Refuelling

One could go a step further and argue that modification is even completely unnecessary. This is supported by an argument familiar to anyone dealing with the interpretation of international treaties. In areas subject to constant and often swift technological or social advances, an evolutionary or dynamic approach to treaty interpretation can accommodate change. While this is often the case where the wording refers to since outdated technology, the interpretation of terms in accordance with sustainable development was most famously applied by the WTO Appellate Body in the United States – Import Prohibition of Certain Shrimp and Shrimp Products case, arguing that animals threatened by extinction were in fact ‘exhaustible natural resources’ in the sense of Article XX(g) GATT.

A fifth of total CO2 emissions within the EU stems from transport. The ultimate goal of the green transition is not to offer the alternatives of fossil fuels or e-fuels and electricity but to replace the former with the latter. Arguably, an interpretation of the original concessions in line with the maxims of sustainable development and the Paris Agreement should not require modification of contracts over facilities for the refuelling of vehicles and rest of road users. This already covers the new requirement of providing electric charging stations. Taking the green transition seriously and in light of the goal of zero CO2 emissions vehicles, charging must be considered ‘the new refuelling’.

Conclusion

Time is already running short. A wave of new tenders to include what would otherwise have been part of existing concession contracts – together with the ensuing review that Case C-452/23 foreshadows – appears hard to

reconcile with the ambitious goals of the Green Deal. A smooth green transition is also inextricably linked to the inclusion of and economic interests of private actors. It is inevitable that the increasing electrification of vehicles will lead to a decrease of revenue from fossil fuels that requires compensation if there must be any incentive towards achieving the green transition. New calls for tenders will force unsuccessful bidders currently holding concessions for the operation of gas stations to compete with operators of electric charging stations to make fossil fuels more competitive and profitable. Setting up ‘big oil’ against ‘big energy’ can surely not have been the intention behind the Green Deal.

Markus P. Beham, is Associate Professor at the University of Passau.

SUGGESTED CITATION: Beham, M.; “Green Public Procurement and Contract Modification – Interpreting Directives 2014/24/EU and 2014/23/EU in Light of Sustainable Development)”, EU Law Live, 03/04/2024, https://eulawlive.com/op-ed-green-public-procurement-and-contract-modificationinterpreting-directives-2014-24-eu-and-2014-23-eu-in-light-of-sustainable-development-by-markus-p-beham-universi/

Between politics of suspicion and reinforced protection: the EU long-term residence Directive and deportations of ethnic Russians (Case

C-752/22, EP)

Jonas Bornemann

Could national authorities expel individuals who have lived their entire life in the country of their residence? What protection against deportation do they enjoy? In a recent case in EP (C-752/22), the Court of Justice discussed the power of Member States to expel third country nationals from EU territory under the Long-Term Residence Directive (LTRD). As this Op-ed will argue, the case may be read as a reminder to Member States that policies of suspicion vis-à-vis Russian nationals and non-nationals cannot undo the firm safeguards against expulsion that these individuals enjoy under the LTRD and European migration law more broadly. In the following sections, the reasoning of the Court will be analysed and situated in the context of safeguards in European law. In this vein, it will be argued that both the LTRD and European fundamental rights safeguards rally strongly against the lawfulness of policies that may ultimately lead to the expulsion of members of Russian speaking minorities.

Different permutations of the protection against expulsion

One of the key promises of EU long-term residence status is that it offers strong protection against expulsions. Pursuant to Article 12 of the Long-Term Residence Directive, a long-term resident may only be expelled where (s)he poses ‘an actual and sufficiently serious threat to public policy or public security’, following a thorough consideration of all the relevant circumstances of the individual case. This is a very high bar to clear. Inspired by the rules on long-term resident EU citizens, long-term residents who have committed criminal acts should principally be sanctioned through criminal rather than migration law measures. For that reason, EU law renders deportations an exceptional option that cannot be applied sweepingly to third-country nationals of, say, a certain ethnic group.

Unlike the situation of those long-term residents who mostly stay in the Member State of their permanent residence, the case EP (C-752/22) concerned a Russian national who had been afforded long-term residence status in Estonia but stayed, on several occasions, in Finland. There, he had been caught drunk driving, an offence that was garnished by the fact that he was not in possession of a driving licence. For that reason, Finish authorities decided to remove EP to Estonia and issued an entry ban against him. This did not, however, stop EP from entering Finland on several other occasions. This ultimately motivated Finish migration authorities to expel him from the territory of the Union altogether, based on the ground that he had acted in violation of an entry ban issued against him.

In this case, the Court of Justice was asked to clarify whether a Member State may expel a long-term resident

from the territory of the EU and, specifically, to the third state of her or his nationality. What makes this case special is the fact that the EP had resided in Estonia most of his life and presumably did not have any links to the Russian State other than his citizenship. The Finish authorities, however, pointed to Article 22 (3) of the LTRD to support the view that they should be competent to remove him to Russia, nonetheless. The provision stipulates that the Member State other than the one that had issued the long-term residence permit could remove a third country national, ‘in accordance with and under the guarantees of Article 12, on serious grounds of public policy or public security.’

Interpreting the wording and context of that provision, the Court of Justice reiterated that standards of ‘reinforced protection against expulsion’ should equally apply to persons who had entered another Member State and faced removal from the territory of the EU (paras. 53-54). Specifically, the Court highlighted that the decision to remove a third-country long-term resident is subject to several conditions, including the guarantees spelled out in Article 12 and the requirement that the removal decision may only be adopted on ‘serious grounds of public policy and public security’ (para. 53). The provisions, moreover, have direct effect and may therefore be invoked by individuals against the Member State in question (para. 76). Accordingly, the Court essentially ruled that third country nationals do not forfeit the protection against expulsion from EU territory that they derive from the LTRD, even where they enter another Member State unlawfully and/or in violation of an entry ban. Rather, the rule that individuals may only be removed for weighty reasons of public policy or public security applies in full to third-country long-term residents who fear removal from EU territory.

Effectively, this interpretation introduces different degrees of protection against expulsion into the LTRD. Unlike the unrelentingly strict protection that applies in relation to expulsions from EU territory, expulsion to another Member State (routinely the one that had issued the long-term residence permit) may be justified more easily. National migration authorities may, for instance, remove third country nationals who failed to apply for a residence title in the second state or breached an entry ban. In this sense, the Court’s own description of this approach rings true, referring to protection against expulsion ‘in its different permutations’ (para. 69). Protection standards are stricter for removals to a third state than for intra-EU removals. The Court accordingly concludes that such an approach prevents the emergence of ‘loopholes’ in the protection against expulsion while paying heed to the wording of Article 22 of the LTRD (para. 69).

Safeguards against expulsion and politics of suspicion

All this suggests that it would not be possible for Member States to expel a long-term resident to a third state in which (s)he had never lived or stayed. Under Article 12 of the LTRD, national migration authorities are obliged to consider a variety of factors before taking such a decision, including ‘the absence of links with the country of origin’. In a situation such as that of EP, it is reasonable to read the reference to the ‘country of origin’ as his country of nationality, i.e., Russia. Since his ties to that country are almost inexistent, it would be a violation of this core guarantee of protection against expulsion if he was to be returned to Russia. A different conclusion would be merited only if the Finish migration authorities would decide to return EP to Estonia (something they

had tried and failed to do time and time again). This could be justified more easily, given that he had been staying in that Member State most of his life.

What bearing could this judgment have for current policies of suspicion adopted in other Member States? At first sight, the situation of EP has very little to do with that of elderly women enrolling in language crash courses to avoid deportation. Neither did the latter move to another Member State, nor did they drive drunk without a licence. On an intermediate level of abstraction, however, the Court’s firm emphasis of reinforced protection against expulsion may serve as a reminder to Member States that long-term residents benefit from strong safeguards against expulsion. This was not a foregone conclusion. Advocate General de la Tour, for instance, had taken the view that the LTRD would not apply in this case. By contrast, the Court reiterates that the notion of reinforced protection applies unreservedly to beneficiaries of EU long-term residence status fearing expulsion from the territory of the Union. In this sense, the Court’s interpretation indeed ensures that any potential protection ‘loophole’ in the Directive is patched.

Even where individuals do not benefit from the protection afforded by EU long-term residence status, the Court’s emphasis on the reinforced protection against expulsion is cognisant of the fact that similar guarantees exist under the ECHR (para. 45). Accordingly, it should be borne in mind that third country nationals who permanently reside in the territory of a Member State (but do not qualify as long-term residents under EU law) equally benefit from guarantees of reinforced protection against expulsion, albeit on the basis of fundamental rights law. In Üner v. the Netherlands, the ECtHR explicitly clarified that one of the criteria for determining the lawfulness of an expulsion is the ‘solidity of social, cultural and family ties with the host country and with the country of destination’ (para. 58). Against this backdrop, it seems very unlikely that generalised considerations of public security could outweigh the fact that individuals have never resided in the state to which they are supposed to be expelled. The Court of Justice’s ruling in EP serves as a welcome reminder in this regard.

Jonas Bornemann is an Assistant Professor of European Law at the Rijksuniversiteit Groningen.

Erratum: a previous version of this Op-ed falsely mentioned that policies threatening deportation of members of the Russian-speaking minority would exist in Estonia. This has been corrected.

SUGGESTED CITATION: Bornemann, J.; “Between politics of suspicion and reinforced protection: the EU long-term residence Directive and deportations of ethnic Russians (Case C-752/22, EP)”, EU Law Live, 04/04/2024, https://eulawlive.com/op-ed-between-politics-of-suspicion-andreinforced-protection-the-eu-long-term-residence-directive-and-deportations-of-ethnic-russians-case-c-752-22-ep-by-jonas-bornemann/

The CETA Ratification Crises Continue: Addressing Some Questions about the French Senate’s Rejection

Gesa Kübek

On 21 March 2024, the French Senate voted to reject the ratification of the Comprehensive Economic and Trade Agreement (CETA) between the EU and Canada with a large majority (243 to 26 votes). This is the latest episode of the CETA ratification crises, which began with the agreement’s rejection by the Walloon parliament in 2016, leaving Belgium and the EU initially unable to sign the deal. The deadlock was eventually solved by an innerBelgium compromise solution and CETA was signed by the EU, all Member States, and Canada in 2017. The CETA crises picked up pace again during the ensuing ratification processes within EU Member States. In 2020, the Cypriot Parliament rejected CETA because it was unhappy with the protection of certain agricultural goods, in particular Halloumi cheese. In 2022, the Irish Supreme Court held that CETA could not be ratified by Ireland without prior changes to existing legislation. The French Senate’s rejection of CETA is thus part of a larger unfolding. The vote nonetheless came as a shock to many, prompting questions about the legal consequences of the rejection of CETA by national parliaments in general, and the French Senate in particular. This Op-Ed, aims to address some of these questions in brief. A more in-depths analysis can be found in my forthcoming monograph EU Trade and Investment Treaty-Making Post-Lisbon: Moving Beyond Mixity.

Why does CETA have to be approved by national parliaments?

CETA has been signed as a so-called mixed agreement. Mixed trade and investment agreements fall partially outside the exclusive competence of the EU and are therefore made by the EU and the Member States acting jointly. The EU ratifies the agreement in accordance with the rules set out in the Treaties (especially Art. 207 and 218 TFEU), whereas the Member States ratify the agreement in accordance with their own constitutional rules. Article 53 of the French Constitution, for example, stipulates that trade agreements or agreements relating to international organisations may be ratified or approved only by an Act of Parliament. In total, mixed EU trade and investment agreements must be approved by around 40 national and regional parliaments, in addition to the European Parliament.

Has the ratification of CETA by France failed?

The rejection of CETA by the French Senate does not yet imply that the ratification of CETA by France has failed. Pursuant to Art. 45(1) of the French Constitution, the National Assembly and the Senate consider a draft law successively, with a view to passing an identical text. In 2019, the National Assembly voted in favour of a draft law on the ratification of CETA (Art. 1 of the draft law) and the EU-Canada Strategic Partnership Agreement (Art. 2 of the draft law) by France. The Senate now amended that draft law, deleting its Art. 1 (and thus rejecting

the ratification of CETA and approving only the ratification of the Strategic Partnership Agreement). Given the requirement to vote on an identical text, the draft law will have to be re-considered by the French Assembly. If both Houses cannot agree on an identical text after two readings (or a single reading, under the accelerated procedure), a conciliation committee composed of an equal number of representatives of both Houses may be tasked with proposing a joint text, which may then be submitted by the Government to both Houses for approval.

If this conciliation process fails, the Government may, after one more reading by both Houses, ask the National Assembly to take a final decision (Art. 45(4) of the French Constitution). If push comes to shove, the National Assembly thus has the last word about CETA’s ratification by France, not the Senate. Yet, the composition of the National Assembly has changed since its affirmative vote in 2019 and it is currently unclear whether it still supports the agreement. The Conseil constitutionnel has already confirmed the compatibility of CETA with French constitutional law (see further here and here). The ratification of CETA by France will thus not fail on ground of unconstitutionality.

Does the rejection of CETA by a national parliament end the ratification process for the EU as a whole?

CETA is a bilateral mixed agreement, i.e. a mixed agreement composed of two parties only (the EU and its Member States, on the one side, and Canada, on the other side). A bilateral mixed agreements can only enter into force after all the parties have approved it in accordance with their respective internal procedures (Art. 30.7(1) CETA). As a result, the rejection of CETA by a single Member State in principle means that the EU, as a whole, can no longer ratify the agreement, at least not in its current mixed form (see further below). At present, large parts of CETA are applied provisionally. The Council has stated that ‘provisional application must and will be terminated’ if the ratification of CETA fails ‘permanently and definitively’ in a Member State. Notably, a national government – and not a national parliament – must issue a formal notification to that end, and it is for the Council to determine whether the ratification of CETA has indeed failed ‘permanently and definitely’. Ultimately, the provisional application of CETA – which spans EU exclusive competence only – can only be terminated by the Council, on a proposal by the Commission (actus contrarius, Art. 218(5) TFEU).

Can national parliaments reject CETA on any ground, such as trade in agricultural goods?

EU law clearly sets out that the Member States may only ratify – and thus reject – the part of a mixed agreement that falls within their competence. The Court confirmed in Opinion 1/19 ‘that the conclusion of a mixed agreement by the European Union and the Member States in no way implies that the Member States exercise, in that event, competences of the European Union or that the European Union exercises competences of those States; rather, each of those parties acts exclusively within its sphere of competence’ (para 259). In the field of trade and investment, the division of competence between the EU and the Member States has largely been clarified by the Court in Opinion 2/15. Accordingly, the EU has exclusive competence to conclude new generation free trade agreements, with the exception of the provisions on investor-state dispute settlement and foreign non-direct investments.

Notably, the Cypriot parliament and the French Senate openly stated that they rejected CETA for reasons relating to trade in agricultural goods (eg., a potential increase in import quotas for Canadian meat products) and/ or geographical indications (eg., the protection of Halloumi cheese) – two areas of exclusive EU competences. As Advocate General Sharpston recalled in relation to the EU-Singapore Free Trade Agreement: ‘It is true that, in principle, each party (including the Member States) must — as matters stand — choose between either consenting to or rejecting the entire agreement. However, that choice must be made in accordance with the Treaty rules on the allocation of competences. Were a Member State to refuse to conclude an international agreement for reasons relating to aspects of that agreement for which the European Union enjoys exclusive external competence, that Member State would be acting in breach of those Treaty rules’ (point 568). Should the Cypriot or the French government openly denounce their ratification of CETA for reasons relating to trade in agricultural goods and/or geographical indications, the Commission could thus launch infringement proceedings. However, such proceedings would be highly sensible and likely cause political and public uproar. Moreover, it would be rather simple for national governments and parliaments to formally reframe the grounds for rejecting CETA.

Arguably, the Cypriot and the French cases showcase the need to change the practice of ratifying mixed agreements on the national level more durably. At the very least, national ratification acts should no longer relate to the entire mixed agreement but be clearly confined to the part of the agreement that Member States are actually ratifying. In the long term, the EU may consider to ‘built-in’ the potential for incomplete mixity from the outset, for example by allowing bilateral mixed agreements to enter into force after a large majority but not all Member States have completed their internal ratification processes (see further here and here).

Is it time to move beyond mixity?

When it comes to the making of EU trade and investment agreements, it is arguably time to move beyond mixity. In the aftermath of Opinion 2/15, the EU has indeed begun to negotiate separate EU-only trade and mixed investment protection agreements. At that point in time, CETA was already signed and applied provisionally. Should the ratification of CETA in an EU Member State fail ‘permanently and definitely’, the EU could (re-) open negotiations with Canada for a new EU-only trade deal or a ‘CETA 2.0’, as Thomas Verellen coined it. As he noted, ‘while some may view this approach as undemocratic, it aligns with the division of competences outlined in the Treaties, where the EU possesses democratic legitimacy for issues within its exclusive competence.’ Moreover, national parliaments remain involved in EU-only treaty-making, and it is also up to the Member States to determine the degree of national parliamentary involvement in EU affairs. In Denmark, for example, as a result of long-standing practice, the Danish representative in the Council will not cast an affirmative vote if the European Affairs Committee of the Danish parliament is against it. The Danish example showcases that the Member States could elevate the role of their parliaments in EU affairs, if they so desire.

Gesa Kübek is Assistant Professor in European Law at the University of Groningen.

SUGGESTED CITATION: Kübek, G.; “The CETA Ratification Crises Continue: Addressing Some Questions about the French Senate’s Rejection”, EU Law Live, 02/04/2024, https://eulawlive.com/op-ed-the-ceta-ratification-crises-continue-addressing-some-questions-about-the-french-senates-rejectionby-gesa-kubek/

The principle of openness gives way to data protection. Judgment in Case C-740/22 Endemol Shine

Susanna Lindroos-Hovinheimo

The Endemol Shine case (C-740/22) concerns balancing the right to personal data protection and the principle of access to documents. A request for a preliminary reference ruling was made by a Finnish court in 2022, in which this issue was salient. The Court of Justice gave its ruling in sixth chamber, whereby it considered the right to data protection more important than public access to documents.

Facts and preliminary reference questions

Endemol Shine Finland is a company that had asked a District Court to give information on any pending and concluded criminal convictions of a person. According to the District Court, information had been requested to establish the criminal background of the person participating in a competition. The District Court had rejected the request for information. The company appealed to the Eastern Finland Court of Appeal, which requested a preliminary ruling to the Court of Justice.

The preliminary questions were put in a way that highlighted the issue of oral processing. The referring court asked whether an oral transfer of personal data constitutes processing of personal data within the meaning of Article 2(1) and Article 4(2) of the GDPR. The court also asked, whether public access to official documents can be reconciled with the right to protection of personal data, in the manner referred to by Article 86 GDPR, by allowing information on criminal convictions or offences of a natural person to be obtained from a court’s register without restriction where a request is made to transfer the information orally to the applicant.

It is somewhat unfortunate that the referring court formulated Its questions this way because the case became in large part a discussion about the legal meaning of oral processing in the GDPR setting. One would have hoped that the case had sparked assessment of the much more difficult issue of how to reconcile data protection rights with public access to documents, according to Article 86 GDPR. As it was, the issue of oral processing became prominent and the Court paid less attention to the balancing of data protection with other rights and values.

The judgment of the Court of Justice

Not surprisingly, the Court of Justice found that that the oral disclosure of information on possible ongoing or completed criminal proceedings to which a natural person has been subject constitutes processing of personal data, within the meaning of Article 4(2) GDPR. Even though there is not much previous case law on oral processing, in light of the GDPR as a whole, including its aims and purposes, this is a logical result (see also Case C-25/17, Jehovan todistajat). It could be a serious infringement on the fundamental right to data protection if oral

processing were not included in the scope of the Regulation.

As for public access to documents, the Court of Justice argued that the GDPR does not preclude the disclosure of personal data to the public when such disclosure is necessary for the performance of a task carried out in the public interest or for the exercise of official authority. This has been established in previous case law as well, including Case C-439/19 Latvijas Republikas Saeima (Penalty points), joined Cases C-37/20 and C-601/20 Luxembourg Business Registers, as well as Case C-184/20 Vyriausioji tarnybinės etikos komisija.

The Court of Justice also stated that, in this case, it is apparent that according to national legislation, openness and public access to documents are considered a public interest. Nevertheless, the Court did not engage in an analysis of Article 86 GDPR. Hence, it did not really balance the right to data protection with public access to documents. It did mention, as it usually does, that the right to data protection is not an absolute right. It repeated its earlier stance, according to which the fundamental rights to respect for private life and to the protection of personal data must be considered in relation to their function in society and be weighed against other fundamental rights. Still, it did not do the weighing. The Court simply stated that in the light of the sensitivity of data relating to criminal convictions it must be held that privacy rights prevail over the public’s interest in having access to official documents.

Hence, the Court concluded that, in this case, data protection is more important than access to documents. Therefore, also the right to freedom of information referred to in Article 85 of the GDPR cannot be interpreted as justifying the disclosure of personal data relating to criminal convictions to everyone requesting it.

Discussion

The Endemol Shine judgment is important because it concerns Article 86 GDPR, on which there is very little caselaw. In this sense, the ruling feels like a missed opportunity. Article 86 GDPR leaves room for national legislation. How much room there is, has been an open question. The ruling is not ideal because it does not give national legislators or courts much help in reconciling transparency and data protection. The Court’s argumentation was minimalist –and it ruled without the opinion of an Advocate General– which means much debate and some bewilderment for constitutional lawyers in the future.

According to Article 86 GDPR,

Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation.

The Court did not engage with the recitals to the GDPR, which might have given some directions towards a more balanced decision. According to recital 154 GDPR, the Regulation allows the principle of public access to official

documents to be taken into account when applying the Regulation. Public access to official documents may be considered to be in the public interest. Personal data in documents held by a public authority or a public body should be able to be publicly disclosed. The recital requires that balancing is made so that public access to official documents and the reuse of public sector information is reconciled with data protection.

Even though the end result of the ruling might be the only one any court can reach when interpreting the GDPR, it might have been more helpful if the Court of Justice had given some guidelines on how the principle of transparency should be reconciled with data protection. In this sense, some of the earlier case law to which the Court did not refer, is more informative. Specifically joined Cases C-37/20 and C-601/20 Luxembourg Business Registers and Case C-184/20 Vyriausioji tarnybinės etikos komisija seem more nuanced. In them, the Court seems more aware of the different values and principles at stake. It also seems aware of the fact that sometimes it is important that personal data is accessible to the public.

Endemol Shine makes no exception to the general trend in data protection case law, where other values or rights usually give way to data protection. The ruling is in line with the Court’s previous case law on transparency, too, the classic example being the Psara case (Joined Cases T-639/15 to T-666/15 and T-94/16). This case concerned the principle of transparency in EU administration. Also here, the Court did not give reasons as to why privacy rights should win over transparency of government. Access to documents was noted by the Court as a value in the Union. The Court also mentioned that decisions should be taken as openly as possible and as closely as possible to the citizen. The right of public access to documents is connected with the democratic nature of the EU institutions. Hence, transparency is linked to democracy but still does not weigh stronger than privacy.

In the Psara case, transparency gives way to privacy in the Union legal setting, even though EU law recognises the principle of transparency for EU institutions. No wonder then that Endemol Shine gets decided as it does. Here, the legal setting is different because the EU does not include secondary legislation that would protect access to documents in the Member States, whereas data protection is protected very strongly both in primary and secondary law. Thus, it is not surprising that data protection is the right that gets the last word. What is missing from the Endemol Shine ruling is nevertheless an awareness of the fact that access to documents is a fundamental constitutional principle in many Member States.

Nordic legal systems tend to take public access to documents very seriously. This principle, which ultimately relates to the transparency of public power, can even be regarded a cornerstone of the legal culture. It includes the openness of judicial proceedings, which was relevant in the case. Therefore, one way to approach the core dilemma of the case would have been for the Court of Justice to acknowledge that the issue may have a link also to Article 4(2) TEU, according to which the EU shall respect the national identities of the Member States, including their fundamental structures, political and constitutional.

Susanna Lindroos-Hovinheimo is Professor of Public Law, University of Finland

SUGGESTED CITATION: Lindroos-Hovinheimo, S.; “The principle of openness gives way to data protection. Judgment in Case C-740/22 Endemol Shine”, EU Law Live, 03/04/2024, https://eulawlive.com/op-ed-the-principle-of-openness-gives-way-to-data-protection-judgment-in-case-c-740-22endemol-shine-by-susanna-lindroos-hovinheimo/

Based on VAT Directive, a national provision requiring a company to achieve a certain turnover in order to qualify for the right to deduct is prohibited: C-341/22, Feudi di San Gregorio Aziende Agricole

Marja Hokkanen

Under Italian national law, a company is considered a shell company without the right to deduct input VAT if its turnover falls below the reference amount stipulated by law, corresponding to the return expected based on the assets available to the taxable person, unless the company demonstrates objective reasons preventing the threshold from being reached. The company may rebut this presumption by proving that turnover couldn’t have been achieved in a given period due to objective reasons.

The Italian company at issue in the present case, engaged in wine production and sale, faced VAT deduction refusal as its turnover remained below the threshold set for shell companies by Italian law. Consequently, it contested this denial, asserting its entitlement to deduct input VAT. Despite lower courts rejecting its appeal, the case was elevated to the Italian Supreme General Court, which sought a preliminary ruling from the Court of Justice of the EU in case C-341/22, Feudi di San Gregorio Aziende Agricole.

The Italian Supreme General Court queried whether a company could be denied the right to deduct input VAT on purchases for failing to meet the turnover threshold mandated by Italian law without demonstrating objective reasons hindering income exceeding that threshold. The court doubted the compatibility of such a practice with Article 9(1) of the VAT Directive, which asserts that taxable person status depends on carrying out any economic activity whatever the purpose or results of that activity. The Italian Court raised concerns about the Italian legislation’s alignment with neutrality, proportionality, legal certainty, and protection of legitimate expectations.

The Court of Justice, referring to Article 9(1) and Case C-604/19 Gmina Wroclaw, ruled that the concept of a business activity encompasses activities regardless of their purpose or outcome. Thus, VAT taxable person status isn’t contingent on surpassing a predetermined income threshold. The crucial aspect is the actual conduct of a business activity, utilising tangible or intangible property for income generation continuously.

No provision in the VAT Directive links the right to deduct the input VAT to a taxable person’s supplies reaching a specific threshold over a period. The Court of Justice reiterated that VAT deduction is guaranteed regardless of business activity outcomes, with refusal only justified by objective evidence of fraud or abuse. It cited decisions C-154/20 Kemwater ProChemie and C-114/22 Dyrektor Izby Administracji Skarbowej w Warszawie, emphasising that the measures which Member States may take under Article 273 of the VAT Directive to ensure the correct

transmission of VAT and to prevent fraud may not, however, go beyond what is necessary to achieve such objectives. They may not therefore be used in such a way as systematically to call into question the right to deduct input VAT and thus the neutrality of VAT.

Echoing Case C-281/20 Ferimet, the Court emphasised that the right of deduction can only be denied based on proven facts of fraud or irregularity, not presumptions. Legislation relying on a mathematical ratio lacks objective evidence of tax evasion or fraud, contravening the VAT Directive. Thus, a Member State can’t deny deduction if a registered taxable person fails to meet a threshold ruled in Italian legislation.

The Italian provision was deemed contrary to the principles of neutrality and proportionality. The decision of the Court of Justice comes as no surprise and closely follows previous case law of the EU Court of Justice, such as Case 268/83 Rompelman, C-110/94 INZO, C-37/95 Ghent Coal or C-110-147/98 Gabalfrisa, which has strongly argued that the right to deduct is an integral part of the VAT system and cannot, in principle, be restricted unless fraud or abuse is suspected. The person concerned definitively acquires the status of taxable person if he has made a bona fide declaration of his intention to start an economic activity. If this is the case a Member State may not impose any restrictions on the right of deduction by national law.

The case law of the Court of Justice has placed an obligation on the authority to prove based on objective grounds possible fraud or abuse in order to deny the right to deduct. However, recent case law as C-108/20 Finanzamt Wilmersdorf and C-596/21 Finanzamt M has shown worrying signs of situations where there would be no such obligation. It is reassuring to note that in the present case the EU Court has again referred to the Ferimet case and the existence of the obligation to show objective evidence by the tax authority.

Dr Marja Hokkanen is professor of practice at Aalto university, Attorney-at-law, Finland.

SUGGESTED CITATION: Hokkanen, M.; “Based on VAT Directive, a national provision requiring a company to achieve a certain turnover in order to qualify for the right to deduct is prohibited: C-341/22, Feudi di San Gregorio Aziende Agricole”, EU Law Live, 04/04/2024, https://eulawlive.com/ analysis-based-on-vat-directive-a-national-provision-requiring-a-company-to-achieve-a-certain-turnover-in-order-to-qualify-for-the-right-to-deduct-is-prohibited-c-341-22-feudi-di-san-greg/

Rules regarding services enabling contact between pharmacists and consumers in the online sales of OTC medicines : C-606/21, Doctipharma

Katarzyna Mełgieś and Katarzyna Miaskowska-Daszkiewicz

On 29 February 2024, the Court of Justice issued a ruling in case C-606/21, Doctipharma, concerning a request for a preliminary rulings pursuant to Art. 267 TFEU. The request of the the Court of Appeal in Paris has been made in proceedings between Doctipharma SAS and the Union des Groupements de pharmaciens d’officine (Union of Pharmacy Groups; ‘the UDGPO’) concerning the legality of the online sale of medicinal products not subject to compulsory medical prescription (OTC ‘Over-the-counter’ medicines) via a platform designed and managed by Doctipharma. The national court asks the Court of Justice to examine an information society service which, like those used in other sectors of the economy (Asociación Profesional Elite Taxi, C-434/15; Airbnb Ireland, C-390/18; Star Taxi App, C-62/19), enables or at least facilitates the bringing together of professionals and their customers. More specifically, the questions referred by the national court concern the prohibition of certain activities imposed on the provider of such a service, which follows from the interpretation of the applicable national provisions, and the compatibility of that prohibition with Directive 2001/83/EC.

In the considerations contained in its judgment, the Court of Justice makes important findings relating to the scope of the concept of an information society service within the meaning of Directive 98/34/EC and gives enabling guidance for the assessment of the compliance with EU law of the prohibition adopted in a Member State relating to a service provided via a website, consisting in enabling contact between pharmacists and customers for the purpose of online sales of medicinal products subject to medical prescription due to the content of Art. 85c of Directive 2001/83.

The interpretation of the cited provisions given by the Court of Justice referred to factual circumstances as follows. Doctipharma designed the www.doctipharma.fr website, hosted by Pictime Coreyre, where internet users could buy pharmaceutical and medicinal products not subject to compulsory medical prescription from pharmacy websites. Taking the view that the service provided by Doctipharma through its website involved the latter participating in the e-commerce of medicinal products even though it did not have the status of pharmacist, the UDGPO, an association of pharmacy groups, brought proceedings against Doctipharma and Pictime Coreyre before the tribunal de commerce de Nanterre (Commercial Court, Nanterre, France), seeking a declaration that the website was unlawful and an order, subject to a fine, that it cease trading. In accordance with the national regulation contained in Article L. 5125-25, second paragraph, of the Code de la santé publique (Public Health Code), in the version applicable to the facts at issue in the main proceedings, pharmacists were prohibited from accepting

orders among others for medicinal products through customary intermediaries and engaging in sales and home delivery of medicinal products for which the order takes place in this form. Aditionally, according to Article L. 5125-26 of that code, the sale to the public of any medicinal products through brokerage firms, joint buying organisations or establishments owned or managed by persons who do not hold one of the degrees, certificates or other qualifications, is prohibited. The main issue in the case was whether Doctipharma’s website complied with the law regarding the sale of medicinal products and whether it should stop conducting e-commerce of medicinal products on this website.

In a situation where French courts presented divergent legal assessments, the referring court decided to refer several questions to the Court for a preliminary ruling. It asked the Court of Justice questions on the interpretation of Directive 98/34 in order to determine whether the service provided falls within the concept of ‘information society service’ and Article 85c of Directive 2001/83 (2), in order to check whether Member States may prohibit the provision of a given service on the basis of that provision.

Firstly, with regard to the conditions to be met in order to qualify a service as falling within the concept of ‘information society service’ for the purposes of Directives 98/34 and 2015/1535, the Court considers that it would be irrelevant, on the one hand, that Doctipharma was remunerated by the pharmacists who subscribed to its platform, on the basis of a fixed price, and, on the other hand, that the service provided by it it was the subject of a monthly subscription paid to it by pharmacists and a retrocession of a percentage of the amount of sales, taken by the platform, since these circumstances, if proven, imply that the service in question must be considered as fulfilling the condition of being provided for remuneration. Then, the classification of the service in question as an ‘information society service’ also results from the fact that it is provided through an Internet site which does not require the simultaneous presence of the service provider and of the customer or pharmacist, as well as by the fact that the service is provided at the individual request of pharmacists and customers.

The Court concluded that a service, provided on an Internet site, connecting pharmacists and customers for the sale, from the pharmacy sites of pharmacies having subscribed to this service, of medicines not subject to medical prescription, falls under the notion of ‘information society service’. Secondly, with regard to the possibility for Member States to prohibit such an intermediation service under Article 85c of Directive 2001/83, the Court recalled that Member States alone are competent to determine natural or legal persons authorised or empowered to deliver, remotely, by means of information society services, medicines to the public. It considered that Article 85c(1)(a) of Directive 2001/83 requires the referring court to verify whether the provider of the service in question must be regarded as limiting itself to a specific and distinct service of the sale, to put sellers in contact with customers, or if this service provider must be considered as being itself a service provider of the sale.

In this regard, if Doctipharma were to be considered as itself being a provider of the sale, Article 85c(1)(a) would not preclude not to the prohibition of this service by the Member State in whose territory it is established. In fact, a Member State may reserve the distance selling to the public, by means of information society services, of medicines without a prescription, only to persons qualified as pharmacists. On the other hand, if it turns out that

Doctipharma provides a specific service distinct from sales, then the service provided could not be prohibited on the basis of Article 85c paragraph 2 Directive 2001/83 and would not fall under the notion of ‘conditions of retail supply’ of medicines offered for distance sale to the public. Indeed, the service provided must be qualified as an ‘information society service’. This assumes that such an entity does not require, for example, obtaining a permit to operate a pharmacy. However, Article 85c(1) explicitly provides that, without prejudice to national legislation prohibiting the offering for distance sale to the public of medicinal products subject to prescription, Member States shall ensure that medicinal products are offered to the public for sale at a distance. It would therefore be inconsistent to consider that the use of such a service could be prohibited by Member States.

The prospect of introducing restrictions in the above scope requires Member States to meet two cumulative conditions. Firstly, a positive premise, allowing for national restrictions justified solely for reasons of public health protection. Secondly, there is a negative premise, which assumes that the restrictions introduced cannot be of a discriminatory nature.

In its judgment of 29 February 2024 (C-606/21), the Court of Justice specified the conditions under which a Member State may prohibit the provision of a service that allows contact between pharmacists and customers for the purpose of selling medicinal products online. The position presented by the Court also confirms that it is not permissible for Member States to prohibit activities that only enable the purchase of OTC medicines remotely in pharmacies, if such activity does not directly constitute the sale of medicinal products by unauthorized entities.

Katarzyna Mełgieś is Assistant Professor of Administrative Law at the Casimir Pulaski Radom University, Poland.

Katarzyna Miaskowska-Daszkiewicz is Assistant Professor in the Department of Administrative Law at te John Paul II Catholic University of Lublin, Poland

SUGGESTED CITATION: Mełgieś, K. and Miaskowska-Daszkiewicz, K; “Rules regarding services enabling contact between pharmacists and consumers in the online sales of OTC medicines: C-606/21, Doctipharma”, EU Law Live, 05/04/2024, https://eulawlive.com/analysis-rules-regarding-servicesenabling-contact-between-pharmacists-and-consumers-in-the-online-sales-of-otc-medicines-c-606-21-doctipharma-by-katarzyna-melgies-andkatarzyna-miaskowsk/

SRF ex ante contributions and statement of reasons in SRB decisions before the General Court – 2023

Christy Ann Petit

On the 20 December 2023, the General Court (GC) rendered its judgments in Banque postale v CRU, T-383/21, Confédération nationale du Crédit mutuel and Others v CRU, T-384/21, BPCE and Others v CRU, T-385/21, Société Générale and Others v CRU, T-387/21, Crédit Agricole and Others v CRU, T-388/21, Landesbank BadenWürttemberg v CRU, T-389/21, and BNP Paribas v CRU, T-397/21

The seven judgments from the General Court of the EU were related to the calculation of the ex ante contributions to the Single Resolution Fund (SRF) applicable for 2021, and set in an administrative decision adopted by the Single Resolution Board (SRB) (Decision SRB/ES/2021/22 of 14 April 2021, non-published but some elements are available here). This group of judgments pertains to a growing corpus of jurisprudence on the resolution framework and determination of SRF ex ante contributions (here inclusive of Directive 2014/59, Regulation 806/2014 and Delegated Regulation 2015/63) and while they raise novel legal issues, there is some precedent from the EU Courts (see in particular, Commission v Landesbank Baden-Württemberg and SRB, C-584/20 P and C-621/20 P and the Analysis by Laura Wissink). Considering the impact of the SRF contributions on the banks, it is an area of the resolution framework prone to litigation. In mid-2023, 2021 ex ante contributions represented 24% of the pending litigation cases concerning ex ante contributions (see SRB Annual Report 2023). On 20 March 2024, the General Court annulled the same decision for six other banks established in Germany who challenged it on the basis of different grounds, including the lack of clarity and motivation, and procedural and substantive grounds (see EU Law Live News).

The General Court of the EU annulled the SRB decision, related to some credit institutions established in France and Germany, on the ground that the SRB failed to fulfil its obligation to state adequate reasons in setting the 2021 target level for the banks’ SRF ex ante contributions. Two judgments are available in English at the time of writing (Banque postale v CRU, T-383/21 and Landesbank Baden- Württemberg v CRU, T-389/21), the remainder is available in French. The judgment Banque postale v CRU will be mainly analysed unless otherwise provided. However, to maintain legal certainty, the effects of the SRB decision in these cases have been maintained until a new decision of the SRB is adopted, within six months. Indeed, the General Court considered that the SRB infringed an essential procedural requirement (i.e. the statement of reasons) but did not find any error affecting the lawfulness of the substance of the decision (Banque postale v CRU, T-383/21 paras. 369-370).

Put simply, the application of the resolution framework led to a situation in which institutions’ annual contributions to the SRF have been often higher than those of the institutions of the other participating Member States, due to a higher share of total liabilities, that increased between 2016 and 2021 (see paragraphs 69-71, T-383/21),

and became subject to a phase-in mechanism (paragraph 73-74). We learn in the other case Landesbank BadenWürttemberg v CRU, T-389/21 that for the 2021 SRF contribution year, a total of 1 627 institutions were subject to an ex ante contribution adjusted to their risk profile (para. 363).

The applicants relied upon eight pleas, almost identical across the cases (with case T-389/21 about the German bank differing slightly). The applicants alleged the breach of the principles of: (i) equal treatment, (ii) proportionality, (iii) legal certainty, (iv) good administration; (v) effective judicial protection, (vi) the duty to state reasons, (vii) manifest errors of assessment and (viii) an error in law. For the latter two pleas, they related specifically to the limitation of the use of irrevocable payment commitments in the amount of the ex ante contributions due for 2021. It should be noted that as the defendant, the SRB was supported by the European Parliament, the Council and the European Commission in all cases (except Case T-389/21 which had the support of the European Commission only).

The following analysis focuses on the General Court’s reasoning regarding the determination of the SRF ex ante contributions and the legal issue in the duty to state reasons for determining the annual target level, right after a short reminder about the SRF. The analysis concludes on the broader implications for the Banking Union and the financial stability objective.

Background to the Single Resolution Fund

The SRF has been built over eight years from January 2016 with levies on the banking industry. The SRF amount reached 78 billion euros to date (SRB, 2024) with financial means that are now fully mutualised and merged (as we have reached the end of the transitional period, see Articles 5 and 7, Intergovernmental Agreement, 2014). The SRF is aimed at providing financial means in the resolution of failing or likely to fail banks, and in particular allows the SRB to rely efficiently on available resolution tools in order to resolve an entity. Having a Single Fund contributes to a ‘uniform administrative practice’ in resolution financing (Recital 19, SRM Regulation 806/2014) and is very simply depicted as an ‘emergency fund’ (SRB). Moreover, the SRF essentially contributes to avoiding the resort to taxpayers’ money in the event of a bank’s failure.

SRF ex ante contributions and determination of the annual target level

The main contentious point is due to the ex ante contributions that have been higher for some institutions. This higher amount is possible through the combination of legal provisions, which in essence contains criteria that ‘seek to ensure that institutions with more risky methods of operation are required to pay higher ex ante contributions than those which have adopted a less risky model’ (paragraph 165). The General Court stressed that these criteria overall seek ‘to apportion the amount of the annual target level between all of the institutions concerned’ (para. 169), following prior Case C-584/20 P and C-621/20 P.

The annual target level is one constitutive element of the SRB methodology to calculate ex ante contributions. The annual target level has been set for each year since 2016, and follows a legal framework composed of the SRM

Regulation 806/2014, Commission Delegated Regulation 2015/63, Council Implementing Regulation 2015/81. The SRB explained its methodology in its decision, as observed and restated in the judgment. The SRF ex ante contribution is determined within the overall objective to reach the SRF final target level by the end of 2023. There are therefore two dimensions to consider: the eight years built up of the SRF (see above) and the specific determination of the annual target level.

In general, the ex ante contributions must be ‘spread out in time as evenly as possible until the final target level (…) is reached, but with due account taken of the phase of the business cycle and the impact that pro-cyclical contributions may have on the financial position of the institutions’ (paragraph 273). The judgment recalled the applicable legal framework that provides some constraints and reference points:

• The yearly contributions by all the institutions cannot exceed 12.5% of the final target level (paragraph 274),

• The method to calculate ex ante contributions is based on: i) the annual target level, taking into account the final target level, ii) the average amount of covered deposits in the previous year, calculated quarterly, which helps determining the contribution at entity level (paras. 275-276).

Applying these steps to the case, the General Court restated a significant part of the contested decision setting the methodology (paras. 278-284). Without restating all the steps of this approach, the SRB is reported to have determined a coefficient applied to one eight of the average amount of covered deposits calculated quarterly, of all of the institutions in 2020 (‘the average amount of covered deposits in 2020’). In other words, it reflects a numerical and economic approach to account for its analysis of the covered deposits evolution so far (i.e. for 2016-2020), the economic situation, the business cycle, the pro-cyclical impact of contributions on the financial positions of the institutions and the SRF financial means (including through a forecast). As a result, the SRB contested decision set the SRF annual target level at one eighth of 1.35% of the average amount of covered deposits in 2020, of which the mathematical formula is ‘Target0 [amount of the annual target level] = Total covered deposits2020 * 0.0135 * ⅛ = EUR 11 287 677 212.56’ (paragraph 284).

However, the General Court precisely identified an inconsistency in the determination of the annual target level for 2021 compared with the SRB’s methodology stated during the hearing (paragraphs 286-289). This inconsistency is the heart of the SRB failure to state reasons in the contested decision.

Failure to state reasons

The duty to state reasons is an essential requirement of due process. Not only does it allow the addressees of the administrative decision (here the banks receiving the SRB decision) to challenge it in an informed manner, but also, ensures an effective judicial protection, and effective judicial review, as guaranteed by Article 47 of the Charter of Fundamental Rights (see para. 293, and the case cited C-584/20 P and C-621/20 P, 103-104).

The following gives an overview of the inconsistencies identified by the General Court in the SRB’s explanations that breached the duty to state reasons as far as the annual target level determination is concerned.

The General Court pointed out that explanations provided in the course of procedure before the EU Courts must be consistent with the considerations set out in the decision (paragraph 296). Otherwise, an inconsistency prevents the addressee from knowing the ‘real reasons for the contested decision’ before introducing a legal challenge, and from preparing their defence; it also prevents the EU Courts from identifying the reasons for the actual legal basis, and hence the compatibility with the applicable rules (paragraph 297). The General Court also recalled that the SRB must inform the institutions concerned of the method of calculating the SRF ex ante contributions, when it adopts such a decision (paragraph 298, and as affirmed by the Court of Justice in C-584/20 P and C-621/20 P). In the case at hand, the General Court considered that the same requirement applies in the determination of the annual target level (paragraphs 299-300). The SRB must provide the explanations about the method of determining the annual target level.

What stands out is the discrepancy between the methodology set in the contested decision (with the above mathematical formula) and the methodological components the SRB explained during the hearing. The latter added two more steps of calculation which were not present in the contested decision: the SRB deducted from the final target level the available financial means in the SRF, in order to calculate the amount still to be collected until end of 2023 and divided the obtained result by three (corresponding to the remaining years until the SRF build-up). In contrast, the General Court implies that the coefficient that considered, among other things, the forecasted growth in covered deposits until 2023 was used by the SRB to justify retrospectively the amount that was reached (para. 304).

Moreover, the additional information published in May 2021 (2021 fact sheet) and the SRF financial resources indicated on the SRB website, were not sufficient to enable the institution to understand the whole methodology explained during the hearing, and the General Court actually demonstrated inconsistencies in numbers as well (see para. 305).

Therefore, in the context of the determination of the annual target level, the SRB applied a methodology explained at the hearing that ‘does not correspond to that described in the contested decision’, and the General Court concluded that the institutions or the Court could not identify ‘the real reasons in the light of which that target level was set’ in the contested decision (para. 306). The SRB decision was thus found vitiated by defects in the statement of reasons, specifically as regards the determination of the annual target level.

SRF ex ante contributions and stability of the financial system

The General Court recalled the earlier judgment from the Court of Justice in Commission v Landesbank BadenWürttemberg and SRB, C-584/20 P and C-621/20 P, namely, that the resolution legal framework introduced the ex ante contributions, the specific nature of which consists (…) in ensuring, according to an insurance-based logic, that the financial sector provides adequate financial resources for the SRM to be able to fulfil its functions, and in encouraging the institutions to adopt less risky methods of operation (in para. 42, reiterated in paragraphs 56, 105 and 176, Banque postale v CRU, T-383/21). This is specific to the SRM, second pillar of the Banking Union (BU),

and stressing the diligent methods of operation that the institutions are incentivised to adopt in their business models.

In maintaining the effects of the SRB decision until a new decision is adopted within six months, the General Court also relied on the same Case C-584/20 P and C-621/20 P. Otherwise, it could ‘undermine the implementation of Directive 2014/59, Regulation No 806/2014 and Delegated Regulation 2015/63, which form an integral part of the banking union, thereby contributing to the stability of the euro area’ (para. 371). So, we see a scenario in which the BU financial stability objective represents another ground to maintain legal effects of administrative decisions, next to legal certainty. The new decision should be adopted by the SRB by 20th June 2024.

Recently, the SRF has reached its target level at the end of 2023 (SRB, 2024). In other words, the financial means available from the Fund reached at least 1% of the amount of covered deposits held by credit institutions authorised in the Banking Union participating Member States (as per Article 69(1), SRM Regulation 806/2014). In figures, it means that the SRF-78-billion euros pot is even slightly higher than the 1% of 7 500 billion euros – which is the amount of deposits held in the participating Member States (SRB, 2024). This is an important development that may smoothen or at least temporarily halt the banks’ eagerness to litigate towards the SRF levies (unless a resolution was to be supported in 2024).

Dr. Christy Ann Petit is Assistant Professor in EU Law and EU Banking & Finance Law at the School of Law and Government, Dublin City University (DCU) and Deputy Director of DCU Brexit Institute. Her most recent publication is available Open Access as follows: Petit, C. A., ‘Financial Union’ (2024) Jean Monnet Centre of Excellence REBUILD Working Paper Series 1(22) https:// doi.org/10.5281/zenodo.10671975

SUGGESTED CITATION: Petit, C. A. ; “SRF ex ante contributions and statement of reasons in SRB decisions before the General Court – 2023”, EU Law Live, 02/04/2024, https://eulawlive.com/analysis-srf-ex-ante-contributions-and-statement-of-reasons-in-srb-decisions-before-the-general-court2023-by-christy-ann-petit/

THE LONG READ

EU Data Protection Law and Pay-or-Consent Business Models

Martin Nettesheim 1

I. Data protection law at a crossroads

Alarmist tones are currently being heard from the European data protection authorities. European data protection law is said to be currently facing a ‘huge fork in the road’.2 Even if one does not follow the excitement, it is easy to see that the authorities are faced with an important decision. The restrictive interpretation of European Data Protection law and new digital regulation advocated by the European data protection authorities and the European Data Protection Board (‘EDPB’) required the digital company Meta (as others before) to deploy a ‘Pay or Consent’ model in order to ensure freely given and valid consent and at the same time safeguard the viability of its business model. As from November 2023, Meta has no longer offered the social network service Facebook free of charge exclusively, but has also offered a parallel pay model that provides for a monetary price for the use of the social network service, eliminates the use of data for advertising, and will therefore not show advertisements. The introduction of this model has resulted in European data protection authorities raising questions that go to the heart of data protection law, its teleological core concern and essence.

How can Meta’s business decision force data protection law to clarify its nature? The GDPR3 stipulates that the data protection consent that authorises a controller to process data (Article 6(1)(a) GDPR) must be freely given (Article 4(11) GDPR). Article 7(4) GDPR, the ambiguity of which reflects differences of opinion in the legislative process, stipulates that the assessment of this requirement of voluntariness of consent in a horizontal contractual relationship between the controller and the user depends, among other things, on whether the processed data is necessary for the fulfilment of the contract (‘prohibition of tying’). Recital 42(5) GDPR also stipulates that consent can only be assumed to be freely given if the data subject ‘has a genuine or free choice’ and is able ‘to refuse or withdraw consent without suffering detriment’. In a recent judgment of 4 July 2023 in Meta/Bundeskartellamt, the Court of Justice has established that the characteristic of ‘genuine or free choice’ of the options offered by a company processing data as a controller forms part of the voluntariness dogma of Article 6 (1)(a) GDPR in conjunction with Article 4(11) GDPR, at least where it has a dominant market position.4

1. Professor of Constitutional Law and EU Law at the University of Tübingen Law School (www.nettesheim.org). Currently, he also serves as the president of the German Association of Professors of Public Law (www.staatsrechtslehrer.de). He has advised both the German Federal Parliament (Bundestag) and the German Federal Government on questions of constitutional and EU law. The article builds on an examination of Art. 6 (1) GDPR, available here (updated version currently in print (Lexxion Publishers)).

2. This is the assessment of the Norwegian Data Protection Commissioner, available here

3. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, OJ L 119, 4.5.2016, p.1, (the ‘GDPR’).

4. Judgment of 4 July 2023, C-252/21, Meta Platforms Inc. and others v Bundeskartellamt, EU:C:2023:537, para. 148. On the position of the

In Meta/Bundeskartellamt, the Court of Justice ruled that a company with a dominant market position can obtain consent under data protection law that is free, i.e. fulfils the criterion of voluntariness (para. 147). However, depending on its particular market power, it must offer its users ‘an equivalent alternative’ to a business model based on the collection and use of personal data (in particular for advertising purposes) in order to guarantee voluntariness. This equivalent alternative, ‘which does not involve such data processing operations’, can be offered ‘where appropriate, for a reasonable fee’ (para. 150). For the Court, the concept of ‘genuine or free choice’ thus centres on the possibility of choosing between different but equivalent service offers.5

In November 2023, this judgment (along with the requirements of the Digital Markets Act)6 prompted Meta to expand its business offering so that a pay model and an advertising-financed model based on consent to the collection and use of personal data for personalised advertising purposes will be applied side by side. The company guarantees the right to ‘genuine or free choice’ under data protection law by giving users and data subjects the choice between two offers – a more data-use intensive but monetarily free model on the one hand and a less data-use intensive but fee-based model on the other. In particular, the fee-based option entails that no advertising personalisation takes place at all. However, this step has not brought peace in terms of data protection policy. Data protection activists say that the future of digital privacy is ‘hanging in the balance’.7

II. A ‘social justice turn’ in EU data protection law?

The compatibility of ‘pay or consent’ models8 with the provisions of the GDPR9 is viewed differently by commentators. In many cases, the introduction of such models is seen as a benefit for data protection – on the one hand, because it allows users to switch to data-minimalist offers, and, on the other hand, because it makes it clear that the free alternative also has a ‘price’.10 Some European data protection authorities explicitly consider ‘pay or consent’ models to be permissible, but others raise some concerns. A group of data protection authorities11 recently approached the EDPB in order to obtain a data protection assessment of ‘pay or consent’ business models.

The EDPB has a deadline of eight weeks in accordance with Article 64(2) GDPR; this deadline can be extended by six weeks, which would appear to take us to a deadline in early May at the very latest. The timeframe is tight

European Data Protection Board: EDPB, Guidelines 5/2020 on consent under Regulation 2016/679, 4 May 2020.

5. The Court of Justice has thus –rightly– decided against an interpretation of the GDPR according to which the company must provide the same service to users who refuse consent as to those who give consent. The view that the GDPR establishes an obligation to contract in the event that consent under data protection law is refused or withdrawn has no basis either in the text of the GDPR or in its history; it also does not correspond to its purpose.

6. Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act), OJ L 265, 12.10.2022, p. 1.

7. See here.

8. The phrase ‘Pay or Ok’ is also used in some cases.

9. The EU Commission has initiatied an inquiry into “pay or consent”-models under the DMA (see https://ec.europa.eu/commission/ presscorner/detail/en/ip_24_1689).

10. Only recently there have been calls to introduce pay models in order to improve data protection (See Kerber et al. Study for the consumer advice centre, available here).

11. These are the authorities of the Netherlands, Norway and Hamburg. The application was received by the EDPB on 25 January 2024.

and may not do justice to the significance that the requested decision will have for the future of data protection and digital business models in the European Union.

Resolute and vocal opposition to the introduction of monetised alternative service offerings comes from a rather surprising quarter. Some data protection activists are of the opinion that the introduction of pay models is incompatible with the provisions of the GDPR, at least if an ad-financed free model is provided or operated at the same time. At first, it sounds like a silly joke when one hears that the decision of a large digital company to introduce a data-minimalist service that eliminates the tracking for personalised advertising is being attacked by data protection NGOs and activists. Indeed, one is inclined to believe that there has been a misunderstanding when one learns that EU data protection law is to be used against the introduction of data-minimalist business models. The distorted logic of such political moves becomes clear when one takes a closer look at the arguments put forward and realises that data protection law is to be charged with protective purposes and concerns that lie far beyond the protection of digital autonomy and privacy.

The NGOs behind this movement argue that fee-based access to media content and social networks is socially unfair and contrary to equality. They argue that an end to the ‘free’ culture would lead to personal economic hardship and possibly even bankruptcy, social exclusion and political voicelessness for many people. The transition to a world in which media offerings and business services such as social networks must always be paid for (‘pay model’) would result in the commercialisation of the right to informational self-determination. In future, the extent of privacy and data protection would depend on the willingness and ability to pay, and data protection would become a right of the rich. The introduction of prices for business services is compared by these NGOs to the introduction of a price for exercising the democratic right to vote. In essence, the aim is to turn data protection law into an instrument that can be used to pursue socio-political goals. Socio-political concerns (‘social justice’) are to take the place of only safeguarding digital autonomy and privacy.

But the NGOs go even further. They don’t just want to replace a protection goal that focuses on digital autonomy and privacy with a much broader, vague and easily manipulated protective approach aimed at achieving social justice. They also want to declare this approach to be absolute, with the result that opposing protection concerns and other legitimate interests at stake (including the fundamental right to conduct a business) cannot come into play. Proponents of this approach close their eyes to the fact that without pay or consent models, many providers of digital services or content may only resort to subscriptions as only means to finance their services and therefore paywalls would start dominating. This would have the exact opposite effect of promoting a ‘free’ culture.

III. The alternative: valorisation of data or limitation of the protective approach of EU data protection law

Against this background, it becomes clear why some of the European data protection authorities are talking about being at a crossroads. It is not entirely wrong to see these authorities confronted with an almost tragic decisionmaking situation.

The data protection authorities would only be able to make a comprehensive comparison of the economic ‘equivalence’ of the pay model (monetary costs, but gain in privacy) with the consent model (no monetary costs, but consent to the processing of personal data for personalised ads) if they were to abandon the alleged dogma that the GDPR does not permit the treatment of personal data as marketable goods and their valorisation.12 They could then assess the equivalence of the services by comparing the monetary price of the service in the pay model with the utility or market value of the data collected in the consent model. The data protection authorities would gain a (data protection) legal lever with which they could carry out comprehensive monitoring of the new ‘payor-consent’ business model on the basis of market fairness. However, the theoretical and idealistic price would be high: the data protection authorities would then also be forced to classify personal data as marketable goods, to no longer categorically deny the existence of data markets and to recognise the interests of the data subjects in the economic exploitation of their data.

If, on the other hand, the data protection authorities were to stick to the dogma that personal data cannot be valorised, they would not be able to consider the economic value of personal data and compare the equivalence of pay models and consent models through the lens of a standard of market fairness. Their scrutiny of Meta’s new business model would have to be limited to the question of how the pay model relates to the consent model with regard to the specific data protection objectives (digital autonomy and protection of privacy). They would have to restrict their approach to the question that the EDPB decision was focused on, i.e., the legal basis for the processing of personal data for personalised ads, enlightened by the Court of Justice.13 Further protection goals (market contestability, prevention of financial exploitation, etc.) would have to be pursued by the competition and consumer protection authorities, also within the scope of their specific remit. The social security law of the EU Member States would ensure, through financial support, that all persons are in the position to take advantage of the pay models, thus ensuring ‘genuine or free choice’.

The alternative outlined above must not be misunderstood. The EU legislator14 and academic data science studies (both in economics, social sciences and law) assume that data must be understood as valuable goods on the market. However, there is no reason for data protection law to adopt this construction of social reality and identify with this pattern of meaning. On the contrary: there are good reasons for data protection law to reject a market ideology in the field of its application.

12. Opinion 4/2017 of the European Data Protection Supervisor on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content, of 14 March 2017, (denouncing the scenario ‘that people can pay with their data in the same way as they do with money’). A summary is available at OJ 2017 C 200, p. 10.

13. The DMA explicitly mentions equivalence (Recital 36).

14. Digital Content Directive 2019/770 (Recital 24, Art 3(1)) (OJ 2019 L 136, p. 1) and the Consumer rights Omnibus Directive 2019/2161 (OJ 2019 L 328, p. 7) expressly mention that a service can be provided in consideration of the provision and use of personal data. In addition, the Data Governance Act (Regulation 2022/868, OJ 2022 L 152, p. 1) goes a step further by setting out the framework for individuals to commercialize their own personal data.

IV. ‘Power paradigm’ and ‘harm paradigm’

Many of the contributions to the discussion that are currently being made on the question of how to categorise ‘pay or consent’ models under data protection law have no depth in terms of data protection theory or teleology. An in-depth discussion of the problem requires an argument based on data protection theory. It makes sense to analyse ‘pay or consent’ models against the background of the two basic paradigms of data protection law behind the specific provisions of the GDPR: the ‘power paradigm’, according to which data protection law serves to empower data subjects, and the ‘harm paradigm’, according to which data protection law serves to combat threats and harm in the area of personal privacy Both paradigms are fundamentally complementary and complement each other; however, as will be shown below, they can also come into conflict.

1. Data protection law as empowerment

The first and most important teleological purpose of data protection law is the empowerment of data subjects. Data protection law enables people to exercise control over the personal information that is available about them in the social spaces in which they are active (control of the information environment). To this end, the GDPR provides them with legal means to control the collection, processing and use of personal data (privacy-related or not).15 This power of control is established above all by the prohibition with reservation of authorisation and the right of consent (as well as other legal bases) set out in Article 6 GDPR.16 The empowerment approach is neutral as to the way a data subject uses its control power: Anyone who releases personal data for collection and use through consent exercises this power of control in the same way as someone who refuses consent. The ‘power paradigm’ under data protection law can therefore raise no objections to the decision of the data subject to commercialise their data, as long as the consent in this regard is truly self-determined (sufficient information and transparency, no external duress, etc.). On the other hand, this paradigm provides a particular reason to ask in horizontal contractual relationships between companies and consumers whether structural circumstances turn the exercise of the right of consent into an act of merely formal self-determination. This could be the case in contractual relationships with the provider of an ‘essential facility’,17 but not, as the Court of Justice rightly emphasises, where a company merely has a dominant market position.

If data protection law is understood as an instrument of empowerment, the evaluation and assessment of ‘pay or consent’ models results in the following: In principle, if the data subject is given the option of choosing between a monetarily priced service that is provided without the processing of personal data for ads and an unpriced service

15. Accordingly, the concept of privacy refers to the type and scope of control over personal information. The control can relate to various factors (subject of an authorisation to obtain, use or exploit information; type of information; purposes of the authorisation to use or exploit, etc.).

16. Article 6 (1)(c) to (f) GDPR makes it clear that the power of control is not unlimited.

17. Obviously, Meta services are not essential services. This is not even claimed by progressive data protection activists. Moreover, even in the case of an essential facility, the competition rules do not conclude that a company is obliged to provide a service for free and that the taxpayers assume all or part of the price. To name just a couple of examples: all of us (individually) pay for electricity and water.

that is associated with the processing of personal data for ads, it benefits from a gain in digital autonomy. This applies in both directions: if a company that has previously financed its service through personalised advertising now offers a pay model, the gain in digital self-determination lies in being in a better position in terms of privacy interests in the future. If a company that has so far financed its services via a monetary price were to add a service financed via personalised advertising, the empowering effect would be that the data subject could now use their data to ‘pay’.

However, empowerment would not occur if the alternative offer was too disadvantageous so that it did not entail any expansion of individual options for action on the basis of a material concept of autonomy. A pay model cannot entail genuine empowerment if the price demanded is so high that it is beyond the financial capacity of the average user. Anyone who is given the option to make use of a pay model but decides against it due to a lack of willingness to pay or for reasons of preference has been offered a genuine alternative, has then made a self-determined decision, and has thus been empowered. It would therefore obviously be wrong from a data protection law perspective to ignore the difference between the data subjects’ ability and willingness to pay.18 It would also be wrong to question the empowering effect of a pay model by pointing out that people prefer to spend their money differently – the realisation of preferences is an expression of exercised autonomy, not a curtailment of it.19

The reference to the financial capacity of the ‘average user’ here is important, because in order to assess whether the provision of a pay model constitutes genuine empowerment for the possible users, data protection law must make a generalised assessment. It cannot consider the circumstances of each specific user, because this would result in the abandonment of the normative generality of European data protection law. The general application of laws such as the GDPR is not only a practical necessity (how could each case be treated individually?), but also an expression of a normative ideal of equality before the law. To be clear: The concern that the introduction of a pay model could lead to discrimination and social or political exclusion of a minority of users must be taken seriously. However, it would be a conceptional mistake and an abuse of data protection law to use it as an instrument to achieve social justice. EU data protection law is not an instrument, with which a differentiating social policy could be pursued. Those who take these concerns seriously will not call for remedies under data protection law, but will argue in favour of EU Member State’s social support covering access to the services deemed politically and socially necessary. It is the task of the general social security system of the EU Member States to react to any injustices resulting from the economic situation of the potential users of digital services, particularly with regard to the goal of giving everyone access to media offerings or social networks, provided that it should be one the EU Member States should be concerned with. None of the statements by data protection activists fighting for a ‘social justice turn’ in data protection law even mentions the fact that there is another area of law for achieving these goals.

18. For example: C. Carugati, ‘The “pay-or-consent” challenge for platform regulators’, Bruegel analysis, 32/2023, 6 November 2023.

19. In the opposite case (a company places a consent model alongside the pay model), digital authorisation always occurs. However, this scenario can give rise to problems of ‘digital harms’ (see below).

What follows from these considerations in terms of legal doctrine? Anyone who understands data protection law as an instrument of empowerment will not relate the criterion of ‘equivalence’ of the pay model and the consent model (as options that open up autonomy) to market prices and market justice. It would be a misconception to assume that data protection law utilises (or must utilise) a market ideology that can only consider everything according to criteria of economic utility and market price. What matters for data protection law is the gain of autonomy or self-determination (legal power) in the handling of personal data. If the pay model introduced later and offered as an alternative to a consent model brings more or different benefits in this respect than the previous model, it must be regarded as ‘equivalent’. A pay model that offers the option of better privacy protection and is not beyond the data subjects’ financial capacity is therefore always ‘equivalent’.

Consequently, EU data protection law should not even begin to make an economic comparison between the monetary costs of a pay model and the economic value of the data used in a consent model for the placement of personalised advertising. A further examination of questions of the utility or market value of data and the market fairness of the two exchange relationships would change the nature of data protection law in a harmful way: an instrument for the protection of personal self-determination would become an instrument for the implementation of a certain market ideology.

2. Data protection law as an instrument for defence against privacy risks and damage

Data protection law can also be understood as an instrument to combat risks and harm in the sphere of digital privacy of data subjects. It is obvious and requires no further explanation that entering into a social relationship with another actor always entails a loss of privacy. This also necessarily applies in the event that an individual enters into a business relationship with a company in order to receive its services. In a liberal society, it is fundamentally the competence and responsibility of the individuals to decide for themselves whether, when establishing horizontal private law relationships, the give and take in the reciprocal relationship corresponds to their own benefit calculation. This also applies to the costs of privacy incurred in this relationship. In principle, paternalistically patronising people in their assessment of the costs of privacy is unacceptable.

In this context, however, the GDPR is not content with a purely formal concept of autonomy based on the external act of declaring one’s will. It aims to ensure an informed and rational decision by the data subject under conditions of transparency and sufficient predictability of the consequences of one’s decision. Data protection law therefore rightly assumes that the privacy interests of a person can be impaired or damaged if consent is not an expression of a decision that meets these criteria of material autonomy. Furthermore, it is conceivable that data protection law protects certain spheres of privacy even against the will of the data subject – for example, by an unqualified prohibition of the commercial use of certain types of personal data (or for other overriding reasons provided in Article 6(1) GDPR). It depends on the context and is ultimately an expression of the political will of the legislator as to whether and where privacy should also be protected against the will of the individual. Such legislative will cannot be replaced by the exercise of political discretion of data protection authorities. The concern to protect privacy can come into conflict with the empowerment concern of data protection law insofar as there

may be cases in which data subjects are prevented from commercializing their data (empowerment) for overriding reasons of privacy protection.

For the classification of ‘pay or consent’ under data protection law, this means that the privacy costs that arise on the part of the ‘consent’ model are relevant under data protection law. If a company that previously relied entirely on a pay model introduces a model with consent elements alongside it (example: an insurance company that offers a rate reduction in the event that the policyholder allows their behaviour to be monitored), the resulting privacy costs must be taken into account when assessing whether this is a genuine case of free consent. If, on the other hand, a company introduces a data-minimalist pay model alongside a ‘consent’ model, no privacy risks arise that could give data protection law cause to intervene. To put it very simply and directly: if a digital company supplements its existing consent model with a new data-minimalist pay model, there is absolutely no new risk to the privacy of potential users.

What does this mean with regard to the doctrinal concept of ‘equivalence’ of alternatives in data protection law? While data protection law must map risks and damages in the area of personal privacy, it cannot cover the financial interests of the data subject. The doctrinal concept of ‘equivalence’ must compare the alternatives offered by the company, but it cannot take into account any financial disadvantage resulting from the need to pay a monetary price. The fact that the pay model establishes a monetary payment burden lies outside the protective purpose of data protection law.

The above considerations make it clear that ‘pay or consent’ models certainly raise data protection issues with regard to the defence against privacy risks. However, this does not apply in the event that a data-minimalist pay model is introduced alongside a ‘consent’ model. In this case, there is no impairment of privacy interests from the outset.

3. No protective ‘paradigm’ beyond empowerment and information privacy

It is important to emphasise that data protection law pursues two protection goals that are on equal footing: the goal of empowerment and the goal of protecting personal spheres of privacy. In contrast, European data protection law does not recognise any further protection concerns, such as the protection of the financial interests of market actors, the establishment of free access to business services or ‘social justice’. The EU data protection authorities would misunderstand the meaning of the GDPR and overuse their legitimacy as independent administrative authorities if they tried to replace the two protection objectives contained in the GDPR with additional political concerns not approved by the EU legislature.

V. Conclusion: pay or consent models can raise data protection issues, but do not necessarily have to do so

The above considerations make it clear that the ‘equivalence’ criterion used by the Court of Justice in its Meta/ Bundeskartellamt judgment must be interpreted through the lens of the protective purposes of EU data protection law. The criterion must be given a specific meaning under data protection law. It would be normatively wrong to

tear the criterion out of its normative context. As a matter of legal methodology, the interpretation and application of the criterion must be guided by the fact it deals with the specific equivalence of the alternatives offered by the company evaluated on the basis the interests of the EU citizens as data subjects. On the other hand, an evaluation based on the interests of EU citizens as market citizens with financial interests would be misguided.

It is in line with the protective purpose of data protection law if data protection law empowers the data subjects and intervenes against privacy risks. If ‘pay or consent’ models are evaluated through the lens of the empowerment paradigm, they are always and without limitation a win for the data subject. This would only not be the case if the monetary price for the pay model were so high that it exceeded the average user’s ability to pay. If, on the other hand, one takes the ‘harm’ paradigm as an evaluative standard, there is reason for differentiation: the introduction of a consent model alongside an existing pay model can give rise to data protection intervention if the privacy costs are too high. In contrast, in the opposite case there is no approach to data protection concerns.

To conclude: Data protection authorities are not called upon to deal with the protection of people’s financial interests. Data protection law is also not an instrument with which the unwillingness of recipients of a business service to pay can be legally protected. Social policy concerns are of course relevant in digital markets; however, they cannot be made the subject of EU data protection law via the doctrinal characteristic of the concept of ‘equivalence’. Instead, they must be pursued under social security law and be addressed by EU Member state social security administrations. It cannot be the concern of data protection law to process general considerations of ‘social justice’. Calls for a ‘social justice turn’ of EU data protection law are unwarranted.

SUGGESTED CITATION: Martin Nettesheim: “EU Data Protection Law and Pay-or-Consent Business Models”, EU Law Live Weekend Edition nº181, https://eulawlive.com/weekend-edition/weekend-edition-no181/

HIGHLIGHT F THE WEEK S O

Action against Commission decision concerning a fine for the participation in a cartel for wholesale price formation mechanism for ethanol, published in OJ

Tuesday 2 April

Official publication was made of an action brought on 19 February 2024 by Lantmännen and Lantmännen Biorefineries against the European Commission concerning the annulment of a Commission’s decision regarding ethanol benchmarks: Lantmännen and Lantmännen Biorefineries v Commission (T-93/24).

Read on EU Law Live

Four French banks bring actions against European Central Bank over irrevocable payment commitments measures

Tuesday 2 April

Four actions brought by French banks against the European Central Bank (ECB) seeking annulment of certain measures concerning irrevocable payment commitments were published in the Official Journal.

Read on EU Law Live

Court of Justice to clarify grounds for invalidity set out in Council Regulation (EC) No 207/2009 on the Community trade mark

Tuesday 2 April

The Cour de cassation (France) referred a preliminary ruling to the Court of Justice concerning the interpretation of Article 52 of Council Regulation 207/2009 on the Community trade mark.

Read on EU Law Live

Preliminary ruling request concerning the compatibility of national law with freedom of establishment, freedom to provide services, and competition regulations within the energy market

Tuesday 2 April

Official publication was made of a request for a preliminary ruling from the Curtea de Apel București (Romania) lodged on 15 December 2023 concerning the compatibility of national provisions with European Union law, particularly regarding freedom of establishment, freedom to provide services, and competition regulations within the energy market.

Read on EU Law Live

Preliminary ruling request on the extent of distributor’s obligation to verify medical device made available on market, published in OJ

Tuesday 2 April

A request for a preliminary ruling from the Bundesgerichtshof (Germany), lodged on 9 January 2024, concerning primarily the question of whether a distributor is obliged under Article 14(1) and point (a) of the first subparagraph of Article 14(2) of the Medical Device Regulation to verify whether the product which it makes available on the market is to be regarded as a medical device and therefore bears a CE marking as a medical device, was officially published in the Official Journal of the EU: Case C-10/24, Cattani. Read on EU Law Live

Preliminary references concerning interpretation of EU rules in context of construction projects affecting certain habitats and species, published in OJ

Tuesday 2 April

The Official Journal of the EU published two references for a preliminary ruling, from the High Court of Ireland, concerning, primarily, the interpretation of certain provisions of Directive 2011/92/EU on the assessment of the effects of certain public and private projects on the environment, Council Directive 92/43/EEC on the conservation of natural habitats and of wild fauna and flora: Case C-58/24, Drumakilla and Case C-41/24, Waltham Abbey Residents Association. Read on EU Law Live

EU and Japan forge advanced materials partnership for Green and Digital Transitions

Tuesday 2 April

The EU and Japan announced the initiation of the EU-Japan Enhanced Dialogue on Advanced Materials, aimed at fostering collaboration in the development of cutting-edge materials crucial for various sectors of the economy.

Read on EU Law Live

Malta Communications Authority draft measure boosting regulation of wholesale infrastructure access market, vetoed by the Commission

Tuesday 2 April

The Commission adopted a decision urging the Malta Communications Authority (MCA), to retract its proposed draft measure aimed at strengthening the regulation of the wholesale physical and virtual infrastructure access market in Malta.

Read on EU Law Live

Commission approves French State aid supporting investments in use of biomass and renewable hydrogen in energy and fuel production

Tuesday 2 April

The European Commission approved a €900 million French State aid scheme to support companies investing in the use of biomass and renewable hydrogen in energy and fuel production, thus fostering the transition towards a net-zero economy in line with the REPowerEU Plan and the Green Deal Industrial Plan.

Read on EU Law Live

European Declaration on Cycling, published in OJ

Wednesday 3 April

The European Parliament, Council, and Commission jointly issued a comprehensive declaration affirming the significance of cycling as a sustainable mode of transport and recreation, addressing the urgent need to mitigate environmental impacts and enhance social inclusion.

Read on EU Law Live

Formal investigation on measures exempting processing industry from excise duty on incineration and CO2 tax, initiated by EFTA Surveillance Authority

Wednesday 3 April

Following doubts regarding the measures’ compliance with State aid rules under the EEA Agreement, the EFTA Surveillance Authority (ESA) decided to open a formal investigation into planned exemptions from an excise duty on waste incineration and a CO2 tax on the processing industry for emissions already covered by the European Emissions Trading System (ETS).

Read on EU Law Live

Vacancy announcement: Legal Advisor at the European Agency for Safety and Health at Work

Wednesday 3 April

The European Agency for Safety and Health at Work (EU-OSHA) published a vacancy notice regarding the position of Legal Advisor, providing advice to the Executive Director, Management Board and EU-OSHA Units in compliance with Union law with a view to ensuring a sound legal environment for the operations of the Agency including identifying and mitigating legal risks, as well as providing legally sound proposals, analyses and opinions in case of pre-litigations and litigations.

Read on EU Law Live

Commission opens two investigations into Foreign Subsidies in solar photovoltaic sector

Wednesday 3 April

The European Commission initiated two in-depth investigations under the Foreign Subsidies Regulation, targeting potential distortions in the market resulting from foreign subsidies granted to bidders in a public procurement process.

Read on EU Law Live

Decision of EFTA Surveillance Authority concerning Norwegian aid scheme supporting the Catapult programme, published in OJ

Thursday 4 April

The Official Journal of the EU published EFTA Surveillance Authority (‘ESA’) Decision No 185/23/COL of 13 December 2023 on certain State aid granted under the Catapult-scheme.

Read on EU Law Live

Commission Delegated Regulation (EU) 2024/873 amending Delegated Regulation (EU) 2019/331 as regards transitional Union-wide rules for harmonised free allocation of emission allowances, published in OJ

Thursday 4 April

The European Commission issued Regulation (EU) 2024/873 to amend Delegated Regulation (EU) 2019/331 concerning transitional Union-wide rules for harmonised free allocation of emission allowances.

Read on EU Law Live

ECtHR finds violation of freedom of expression in case concerning right to obtain information from two Hungarian foundations

Thursday 4 April

The European Court of Human Rights (‘ECtHR’) delivered its judgement in Zöldi v. Hungary (no. 49049/18), a case concerning the use of public funds and the efforts in 2015 of the applicant, an investigative journalist, to obtain information on the finances of two foundations created by the Hungarian National Bank (Article 10 ECHR on the freedom of expression).

Read on EU Law Live

Official publication of the Protocol on cooperation between the European Commission and the European Committee of the Regions

Thursday 4 April

The Protocol on Cooperation between the European Commission and the European Committee of the Regions, signed in March 2024, underscores the significance of the territorial dimension within the EU, by recognizing the principles of self-government and territorial cohesion enshrined in the EU treaties. Mandating consultation with the Committee of the Regions for certain EU bodies, the Protocol emphasises multilevel governance and active subsidiarity as crucial for EU policy design and implementation.

Read on EU Law Live

ECtHR: Several violations of the ECHR and no violation of the right to access to a court in Tamazount and Others v. France concerning living conditions of Harki children in Bias camp

Thursday 4 April

The European Court of Human Rights (ECtHR) reached a unanimous decision in the case of Tamazount and Others v. France, concerning five French nationals who are descendants of “Harkis” – Algerians who fought alongside the French army during the Algerian War of Independence.

Read on EU Law Live

New Council Regulation amending existing rules on sanctions against serious human rights violations, published in OJ

Friday 5 April

Official publication has been made today of Council Regulation EU) 2024/1034 of 4 April 2024 amending Regulation (EU) 2020/1998 concerning restrictive measures against serious human rights violations and abuses.

Read on EU Law Live

Regulation (EU) 2024/982 on the automated search and exchange of data for police cooperation, published in OJ

Friday 5 April

Official publication was made of Regulation (EU) 2024/982 of the European Parliament and of the Council of 13 March 2024 on the automated search and exchange of data for police cooperation, and amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, (EU) No 2019/817 and (EU) 2019/818 of the European Parliament and of the Council (the Prüm II Regulation).

Read on EU Law Live

Czech support scheme for large agricultural companies found incompatible with EU State aid rules by Commission

Friday 5 April

The European Commission found Czechia’s investment support granted to large agricultural companies in 2017 and 2018 to not be in line with EU State aid rules.

Read on EU Law Live

EU and international partners launch minerals security partnership forum

Friday 5 April

The European Union (EU), the United States, and other Minerals Security Partnership (MSP) members, including Kazakhstan, Namibia, Ukraine, and Uzbekistan, have initiated the Minerals Security Partnership Forum (MSP Forum). This forum aims to enhance cooperation on critical raw materials (CRMs) crucial for global green and digital transitions.

Read on EU Law Live