In the circumstances of rapid growth of e-commerce and the increase of digital services and technologies consumption, the lack of modern rules for consumer protection online has become more apparent. That is why many significant steps have been taken in this direction at European Union (EU) level as an integral part of the large-scale strategy for the Digital Single Market and the “New Deal for Consumers”. We shall briefly comment on some of these steps below.
With amendments to the Consumer Protection Act (CPA), which entered into force on 14 February 2020, Bulgaria has created the necessary conditions for the effective implementation of Regulation (EU) 2017/2394 on cooperation between national authorities responsible for the enforcement of consumer protection laws (Regulation 2017/2394 or Regulation).
The amendments resulting from Regulation 2017/2394 affect cross-border online trade within the EU, laying down rules for cooperation between Member States. The Regulation establishes a single framework for the protection of the collective interests of consumers, which confers significant powers on the competent authorities in specific category of infringements.
The primal criterion is that an infringement has occurred (an act or omission) of EU consumer protection laws in one Member State and that it has harmed, harms or is likely to harm the collective interests of consumers in another. Infringements should affect, for example, e-commerce rules, unfair terms in consumer contracts, the liability of traders, the portability of online content services and many others. The Regulation contains an exhaustive list of normative acts (27), the infringement of which falls within the scope of the Regulation.
The amendments to the CPA specify details on the application of the Regulation, designate the competent authorities within the state and establish penalties for infringements, which may amount up to BGN 10,000.
As competent authorities, the legislator has designated the Consumer Protection Commission (CPC) and some administrative bodies operating in specific sectors – e.g. The Council for Electronic Media (on commercial communications in media services), the Communications Regulation Commission (on the prohibition on calls, messages or e-mails with or without human intervention for direct marketing and advertising purposes), the Commission for Protection of Competition (on the prohibition of misleading and comparative advertising), etc.
In our commentary, we will focus on the minimum powers of the authorities provided for in the Regulation, which are conditionally divided into: 1) investigation powers and 2) enforcement powers to protect consumers’ interests.
- The investigation powers include: the right of access to documents, data or information related to infringements covered by the Regulation – regardless of where and how they are stored, the right to require documents, data or information from any public authority within the state; and from any natural/legal person in order to detect an infringement, incl. to track financial and data flows, to ascertain the identity of persons, to ascertain bank account information and ownership of websites, the right to carry out on-site inspections, incl. in order to examine, seise, take or obtain copies of information, data or documents (irrespective of their storage medium or place they are stored), including the power to enter any premises, land or means of transport, the right to purchase goods under а cover identity in order to detect infringements, the right to notify competent authorities in other Member States of infringements taking place in their territory, etc.
It is evident that the CPC is conferred with extended control mechanisms, some of which are exclusive for other administrative bodies supervising the business – e.g. on-site inspections, seizure of information and documents, as well as access to premises carried out by the Commission for Protection of Competition in proceedings for establishment of infringements of fair competition. An important difference, however, is that the latter are admissible and can be carried out only after obtaining prior court authorisation.
The CPC is now enabled to exercise all its investigation powers without such prior judicial control. Such a legislative approach will inevitably provide an opportunity for swift action to protect the interests of consumers. On the other hand, such powers could also lead to unjustified actions against the business (for example, in the case of an unlawful inspection by the commission, the reputation of a trader could be damaged or its activity could be unlawfully obstructed) or even to abuse.
- The enforcement powers are specifically and exhaustively listed in the Regulation and include the power to adopt interim measures to avoid the risk of serious harm to the collective interests of consumers, the power to seek to obtain or to accept commitments from the trader (e.g. how and within what period they will resolve the established infringements), responsible for the infringement, for the cessation of that infringement or for compensations, etc.
Of all the enforcement powers, however, special attention is to be paid to the power of CPC (we specify that it is inherent only to the CPC) in certain cases (according to the text of the regulation „where no other effective means are available“) to order:
- a trader to remove content or restricts access to the online interface or to give a clear warning to users when they access its online interface (e.g. website, application, software used by the trader to access its services). An online interface is any software, including a website or application, used by a trader or on behalf of a trader that allows users to access the goods or services offered by the trader.
- a hosting provider to remove, disable or restrict access to an online interface.
- а telecom operator to remove, disable or restrict access to the online interface. This is an additional hypothesis, which does not exist in the Regulation, but was added by the Bulgarian legislator.
- domain registrars to delete the full domain name, where necessary, and after the infringement has ceased, to allow the domain to be registered again.
These special powers will be exercised only by order of the CPC and without prior judicial control. The regulation of this type of powers is in stark contrast to the existing similar regimes for removing/ disabling/restricting access to content (websites), which provide for prior judicial control. Such are the regimes provided for in the Gambling Act (for the restriction of access to websites without a gambling license), the Counter-Terrorism Act (for the restriction of access to websites whose content incites to terrorism acts or through which knowledge of committing acts of terrorism is disseminated), the Markets in Financial Instruments Act (for restriction of access to websites offering the provision of investment services by persons who are not authorised to provide such services on the territory of the Republic of Bulgaria ) and the Excise Duties and Tax Warehouses Act (to restrict access to websites on which advertisements and notices unlawfully offering excise goods for sale, as well as tobacco product waste are published).
The other competent authorities do not have this power, but they will still have the right to require by reasoned request the CPC to carry out such actions where infringements in their respective field of activity are concerned.
In summary – the new powers of the CPC and other administrative bodies are expected to ensure a higher level of protection of the interests and rights of consumers both in Bulgaria and in the EU. Nevertheless, it is appropriate to reconsider the approach taken with regard to some of the powers of the commission, and in particular powers that are not subject to judicial control, as it may lead to unlawful actions by the administration.
Even greater changes in favor of consumers and at the expense of traders are forthcoming with the transposition of Directive (EU) 2019/2161, which is to be introduced into the local legislation. Its rules shall apply as of 28 May 2022 at the latest and shall provide for:
- additional remedies for seeking liability from traders (e.g. representative claims);
- prohibition of misleading consumer practices related to variability in product quality in different countries (so-called dual standards/dual quality);
- new rights for users of “free of charge” digital services (i.e. when consumers pay only with their data), incl. by achieving more transparency for users of digital services and digital content;
- significant penalties for traders similar to those in the GDPR (with maximum penalties of not less than 4% of the annual turnover of traders, and for cases where there is no information on the annual turnover - the maximum amount should not be less than EUR 2 million.
It is evident that significant changes in consumer law are taking place which will substantially change the way consumers, traders and regulators interact. At the same time, regulators are gaining more and more powers and most importantly - the ability to impose extremely high penalties, similar to those in competition law and personal data protection. Therefore, the business should not turn a blind eye on them.
Hence, it will be very important for traders to analyse and reconsider the conditions under which they operate online (and not only online) – e.g. the general terms and conditions of their website, the pre-contractual information when concluding contracts online, the publication of information about the supervisory authorities and the alternative means of resolving disputes, information about the use of “cookies”, etc. in order to evade a situation where unbearable penalties may be imposed on them.