ONLINE PERSONALIZATION
And the effectiveness of competition law, consumer protection law and data
protection law in protecting consumers against it.
University of Amsterdam - Faculty of Law
Master thesis International and European Law: European Competition Law and Regulation
Babette Dol 10728007
babette.dol@hotmail.com
Abstract
The emergence of big data enables companies to offer consumers advertisements for products or services fully adapted to their preferences, in some instances even with a price based on their willingness to pay. This phenomenon is referred to as personalization, which includes both
personalized offers and personalized prices. This thesis examined to what extent the current
European legal regimes, in particular competition law, consumer protection law and data protection law, are effective in protecting consumers against personalization.
In order to come to an answer to this research question a framework is developed when rules are effective in protecting consumers against personalization. A high level of consumer protection is considered important in this respect. Three major negative consequences for consumers have been identified and it is assessed whether these negative consequences are being hindered or prevented by the legal regimes. The more the legal regime is able to tackle the negative consequences that personalization could have on consumers, the higher the level of consumer protection and thus the more effective the legal regime is.
Neither competition law nor consumer protection law or data protection law alone seems to provide consumers complete protection against personalization. The applicability of Article 102 TFEU to personalization against consumers is uncertain and given the ex post nature of this legal regime the negative consequences for consumers resulting from personalization cannot be fully tackled by competition law. Personalization could under certain circumstances constitute an unfair commercial practice under the UCPD. In particular, the new provisions in the UCPD and the CRD resulting from the Modernization Directive focus on the information requirements about personalization. Nonetheless, UCPD does not prevent the individual consumer from being treated unequally, but merely informs him about it. This will not be a problem if consumers have enough choice for other non-personalized products, but will be if all traders make use of personalization techniques based on certain (even discriminatory) grounds. The GDPR seems to provide the most effective tools to protect consumers against personalization. However, there are different views on the application of the notions in Article 22 GDPR to personalization and some issues are still unaddressed by scholars and the CJEU. Even after it has been advocated that Article 22 GDPR offers consumers protection against personalization, it has been found that due to a lack of awareness of the consequences of personalization, the speed of surfing on internet, the enormous number of companies asking for consent and the laziness of consumers, consumers easily give their explicit consent to apply personalization. The most important outcome of this thesis is therefore that consumer awareness is of primary importance. Making consumers more aware of the consequences of personalization is the first step in effective protection.
List of abbreviations
CRD Consumer Rights Directive
DCC Dutch Civil Code
EDPB European Data Protection Board
EU Charter Charter of Fundamental Rights of the European Union
GDPR General Data Protection Regulation
TFEU Treaty on the Functioning of the European Union
UCPD Unfair Commercial Practices Directive
Table of contents
1. Introduction ... 6
1.1 Cause of writing and research question ... 6
1.2 Methodology ... 6
2. The consequences of personalization for consumers on the European level ... 9
2.1 Defining personalization ... 9
2.2 Different types of personalization ... 9
2.3 Consequences of personalization for consumers ... 10
2.4 Sub-conclusion ... 11
3. The effectiveness of competition law in protecting against personalization ... 12
3.1 Regulatory framework and objectives of European competition law ... 12
3.2 Competition rules applicable to personalization ... 12
3.3 Personalized pricing as abuse of a dominant position ... 13
3.4 The effectiveness of competition law in protecting consumers against personalization 15 3.5 Sub-conclusion ... 16
4. The effectiveness of consumer protection law in protecting against personalization .. 18
4.1 Regulatory framework and objectives of European consumer protection law ... 18
4.2 Scope and principles of the UCPD ... 18
4.3 Personalization as unfair commercial practice under the UCPD ... 19
4.3.1 Personalization as misleading action ... 19
4.3.2 Personalization as misleading omission ... 20
4.4 The average consumer benchmark in an online environment ... 21
4.5 The effectiveness of the consumer protection law in protecting consumers against personalization ... 23
4.6 Case study on Dutch law ... 24
5. The effectiveness of data protection law in protecting against personalization ... 28
5.1 Regulatory framework and objectives of European data protection law ... 28
5.2 Scope and principles of the GDPR ... 28
5.3 Personalization under the GDPR ... 29
5.4 The role of consent in protecting consumers against personalization ... 32
5.5 Additional transparency requirements for personalization ... 33
5.6 The effectiveness of data protection law in protecting consumers against personalization ... 34
5.7 Sub-conclusion ... 36
6. Conclusion ... 37
1. Introduction
1.1 Cause of writing and research question
Data can be used to determine consumer preferences and respond to them with a personal advertisement and sometimes even a personal price. Companies can charge different consumers different prices for the same product, depending on their willingness to pay. If this is the case, consumers are often unaware that they are paying a different price for the same product than other consumers. The reason behind this distinction is most of the time also unclear. This could conflict with the basic principles of consumer protection in the European Union, among other things that consumers should be adequately informed and protected against unfair commercial practices.
Whereas offline personalized pricing on objective and transparent criteria has been practiced for many years, with senior and student discounts as popular examples, personalization based on consumer preferences in an online environment might have a negative impact on consumers. In this thesis I want to investigate whether this is the case, in order to be able to determine whether protection against personalization under the European legal framework is effective or whether additional protection is desired. This is expressed in the following research question:
“To what extent are the current European legal regimes, in particular competition law, consumer protection law and data protection law, effective in protecting consumers against personalization?
1.2 Methodology
In order to answer the research question, I will carry out extensive research, using relevant legal literature, official publications and jurisprudence, supplemented with my own analysis. To come to an answer to my research question, it is necessary to develop a framework in order to answer the research question when rules are effective. I define a legal regime as effective in protecting consumers against personalization if a high level of consumer protection is taken into account by the European legislator when making the rules, as required by Articles 4(2)(f), 12, 114(3) and 169 of Treaty on the Functioning of the European Union (“TFEU”) and Article 38 of the Charter of Fundamental Rights of the European Union (“EU Charter”).
However, merely because a treaty, regulation or directive states its aim of pursuing “a high
protection. In order for a rule to be meaningful it needs to be effectively enforced. National supervisory authorities, together with the CJEU and national courts, are the actors who judge whether the level of consumer protection is high, low or moderate. When they assess the compliance of certain behavior under a legal regime, they examine the negative consequences for consumers. Hence, I will look at the negative consequences that personalization could have on consumers and assess whether these negative consequences are being hindered or prevented by the relevant legal regime. The more the legal regime is able to tackle the negative consequences that personalization could have on consumers, the higher the level of consumer protection and thus the more effective the legal regime is.
Although the TFEU and the General Data Protection Regulation (“GPDR”) are directly applicable in all Member States of the European Union, the Unfair Commercial Practices Directive (“UCPD”) needs to be implemented into national law. The effect of protecting consumers by the UCPD can therefore only be seen at Member State level. Hence, I will do a case study of the implementation of the UCPD under the law of a Member State. I have chosen Dutch law as case study since the Netherlands is a country that keeps up very well with technological developments which make it possible to personalize adds and prices. Another reason to take Dutch law as a case study is because there is an abundancy of literature available on each of these subjects.
Even though this thesis is limited to a case study on the implementation of the UCPD under Dutch law, this method will be valuable to answer my research question. This is true, first of all, because the competition law and data protection law rules are the same in the whole European Union. In addition, since the UCPD is based on full harmonization, Member States of the European Union cannot retain or introduce more or less restrictive consumer protection measures. This means that apart from the rules on enforcement of the UCPD, which have not yet been harmonized, also the consumer protection rules are the same across the European Union. Lastly, the possibility of enforcement for consumers is about to be improved with the adoption of the Modernization Directive. This directive provides that consumers must at least be awarded a possibility to get out of a contract and claim damages.
In the first sub-question I will discuss what personalization is and what the consequences of personalization are for consumers. The answer of this sub-question will be of a descriptive nature and is necessary before going into the protection against personalization under the
different European legal regimes. When answering the second, third and fourth sub-question I will elaborate on the protection against personalization under competition law, consumer protection law and data protection law, to research for each legal regime individually if it is applicable to personalization and effective in protecting consumers against it.
2. The consequences of personalization for consumers on the European level
2.1 Defining personalization
Companies can use big data to improve products or services or bring new products or services to the market. Often, this improvement means that products or services can be adapted to personal preferences of the consumer.1 In the academic literature this is called personalization, which refers to a firm’s tailored product offerings to an individual consumer based on the data about that consumer.2 Personalization is about understanding the needs of each individual consumer and helping to satisfy a goal that responds to the needs of each individual in a particular context.3
2.2 Different types of personalization
We can distinguish personalized offers and personalized prices as the different forms of personalization. Personalized offers include both search advertising as non-search advertising.4 Personalized search advertising is a practice which relates to the changing of the order of search results to highlight specific goods and services when consumers search for the same or similar products online.5 Based on the available information about consumers, companies manipulate the products shown.6 Personalized non-search advertising refers to targeted advertising, which consists of studying behavior of consumers (through their repeated site visits, interactions, keywords etc.) but also of studying known characteristics of the data subject (age, sex, location etc.) in order to develop a specific profile and provide these consumers with tailored advertisements which match their interests.7
Personalized pricing can be classified as differentiating the online price for identical products or services based on the information a company has about a potential customer.8 Personalized pricing is also referred as price discrimination, which thus occurs when two users are shown different prices for the same product.9 Companies use big data to extract as much as possible what the consumers are willing to pay for its products or services.10 The academic literature
1 Van Sloten & Wolters Ruckert 2016, 1. 2 ENISA 2012, 12.
3 Riecken 2000, 1.
4 Bourreau, De Streel & Graef 2017, 49.
5 Commission, ‘Consumer Market Study’ 2018, 41.
6 This is also known as price steering; Hannak and others 2014, 1.
7 Commission, ‘Consumer Market Study’ 2018, 35.
8 Poort & Zuiderveen Borgesius 2019, 2.
9 Commission, ‘Consumer Market Study’ 2018, 33; Hannak and others 2014, 3.
distinguishes between three forms of price discrimination, i.e. first degree price discrimination, second degree price discrimination and third degree price discrimination. First degree price discrimination refers to the situation where a company charges each consumer the maximum price it is willing to pay. With second degree price discrimination companies offer differentiated products in order to price discriminate. Third degree price discrimination relies on dividing consumers into groups and charging different prices to these groups of consumers.11 For the scope of this thesis second degree price discrimination will be excluded, since we refer to personalized pricing as consumers being offered different prices for the same good.
2.3 Consequences of personalization for consumers
Although especially the term ‘price discrimination’ evokes negative connotations, it is actually a fundamental concept in economic theory, and it is widely practiced in everyday life.12 In principle there is nothing wrong with charging different customers different prices. This is in line with capitalism, supply-and-demand and the principle of freedom of contract, which is even a constitutional value in the European Union as it is derived from Article 16 of the EU Charter.13 Moreover, the use of personalized offers can bring benefits to consumers, since it allows them to see only the products that they might be interested in.14 Problematic, however, is how this freedom of choice should be assessed. Even if the consumer thinks he has found what he is looking for, he cannot know if this is the most successful result.15 Freedom of choice only exists if the consumer has knowledge of what personalization does, how it can be switched off and what consequences this has.16 One of the possible negative consequences with respect to personalization is therefore a lack of consumer choice.
Another negative consequence leading from personalization is a lack of transparency. Consumers often do not know to what extent their characteristics and behavior are being collected and used for personalization. This will lead to information asymmetry between companies and consumers.17 Transparency is necessary for the proper functioning of the market, since it ensures consumers’ trust in online markets, which would positively affect all
11 Commission, ‘Consumer Market Study’ 2018, 34.
12 Hannak and others 2014, 3; OECD, ‘Price Discrimination’ 2016, 9.
13 C-240/97, Spain v. Commission [1999] ECR I-6571, point 99; Case C‑283/11 Sky Österreich [2013] ECLI:EU:C:2013:28, point 42.
14 Commission, ‘Consumer Market Study’ 2018, 124-125.
15 Oostveen 2012, 147. 16 ibid 147.
17 Botta & Wiedemann, ‘The Interaction of EU Competition, Consumer, and Data Protection Law’ 2019, 432-433.
players.18 Besides, when companies can observe online individual behavior at a highly granular level and can distract an individual’s willingness to pay, this can place consumers at a risk of exploitation.19 Consumers might feel that they have been treated unfairly, which can be seen as another negative consequence of personalization.20
2.4 Sub-conclusion
Personalization can be defined as a firm’s tailored product offerings to an individual consumer based on the data about that consumer. We can distinguish personalized offers and personalized
prices as the different forms of personalization. Personalized offers can benefit consumers by
only showing them relevant products and in principle there is nothing wrong with charging different customers different prices. However, personalization can lead to a lack of consumer choice, a lack of transparency and an unequal treatment of consumers. Regard will be had at these negative consequences when assessing the effectiveness of the different legal regimes in protecting consumers against personalization.
18 Bourreau, De Streel & Graef 2017, 8-9. 19 Townley, Morrison & Yeung 2017, 50. 20 ibid 50.
3. The effectiveness of competition law in protecting against personalization
3.1 Regulatory framework and objectives of European competition law
The main source of European competition law is the TFEU. The TFEU contains several articles governing competition law in the European Union, with Articles 101 and 102 TFEU as the main provisions. European competition law aims at safeguarding undistorted competition within the European internal market by prohibiting or sanctioning the anticompetitive behavior of undertakings. By doing so, competition law indirectly protects the aggregate welfare of consumers.21 Effective competition is benefiting consumers in terms of greater choice, lower prices and higher levels of output.22 Competition law’s challenge is to prohibit behavior that is harmful to consumer welfare, without precluding behavior that is welfare-enhancing.23 In essence, competition law is about creating a level playing field between all parties operating in the economic sphere.24
3.2 Competition rules applicable to personalization
The existence of a concerted practice or an agreement between companies to apply personalization could infringe Article 101 TFEU. However, as defined in paragraph 2.1, personalization refers to the situation where a company offers tailored products to an individual consumer based on the data about that consumer. It is not a matter of making agreements with
other companies, but of applying personalization to consumers by a particular company. For
the scope of this thesis Article 101 TFEU is thus not relevant, which means that personalization will only be assessed under Article 102 TFEU. This thesis addresses the question whether personalization can be considered as an abuse of a dominant position.
As elaborated on in paragraph 2.3, the use of personalized offers can bring benefits to consumers, since it allows them to see only the products that they might be interested in. Personalized offers lead to a high probability of a good match, reducing wasteful advertising, which is beneficial to consumers.25 If the data collected by a company about a consumer reveals that one consumer is interested in baking cakes and another consumer is interested in painting, it is beneficial for both consumers if they only receive advertisements for their individual specific interest. It is therefore not conceivable how merely offering personalized offers could
21 Botta & Wiedemann, ‘The Interaction of EU Competition, Consumer, and Data Protection Law’ 2019, 7. 22 Townley, Morrison & Yeung 2017, 40.
23 Graef 2018, 6.
24 De Streel & Jacques 2019, 23.
lead to an abuse of a dominant position. This is different when companies observe consumer behavior at such a granular level that they can distract a consumer’s willingness to pay and manipulate product offerings in a way that consumers with a high willingness to pay only see expensive products and vice versa. The risk of exploitation is mainly related to the price companies charge consumers. Therefore, only personalized pricing will be discussed under Article 102 TFEU.
3.3 Personalized pricing as abuse of a dominant position
In order to qualify as abuse under Article 102 TFEU, regard must be had at the non-exhaustive list of examples listed in Article 102 TFEU. Looking at those examples, Article 102(c) seems relevant as the main legal basis for assessing discrimination when assessing personalization.26 At this moment there is no case law that directly addresses the legality of personalization under Article 102 TFEU. There are a couple of cases that have dealt with price discrimination, but these all focuses on price discrimination at the business-to-business level.27 However, these cases can be useful to evaluate the legality of personalization to consumers. Especially since there are in general very few competition law cases that address the practice of direct sales to consumers.28
In order to qualify as an abuse under Article 102(c), the following conditions must be satisfied: (i) dissimilar conditions to (ii) equivalent transactions with other trading parties and (iii) the dissimilar conditions for equivalent transactions must result in a competitive disadvantage.29 The first condition is met if the conditions applied are dissimilar. It is irrefutable that this includes a difference in price. The second condition refers to equivalent transactions with other trading parties. In order to fulfill this condition, two transactions must be identical. From the Court’s ruling in United Brands and British Airways it can be inferred that two transactions are identical if they contain the same quantity and quality of the same good or service.30 This condition has also been fulfilled undisputedly when personalization is applied.
Difficulties arise, however, with the other part of the second condition and the third condition. The equivalent transaction must be with other trading parties and the dissimilar conditions for equivalent transactions must result in a competitive disadvantage. These conditions indicate
26 Graef 2018, 546.
27 Townley, Morrison & Yeung 2017, 33. 28 ibid.
29 ibid 35.
that Article 102(c) TFEU essentially seeks to prevent favoring some customers over others, since it seeks to protect the customers of the dominant company instead of its competitors.31 The question arises whether consumers can be qualified as trading parties and whether they can be placed at a competitive disadvantage.
All case-law on price discrimination focuses on the business-to-business level. In British
Airways the Court explicitly states that in order for the conditions of Article 102(c) TFEU to be
met “there must be a finding not only that the behaviour of an undertaking in a dominant market
position is discriminatory, but also that it tends to distort that competitive relationship, in other words to hinder the competitive position of some of the business partners of that undertaking”.32 From this case can be inferred that the Court focuses on the competitive relationship with business partners. In later cases such as MEO, the Court ruled that price discrimination “is
capable of distorting competition between those trade partners. A finding of such a ‘competitive disadvantage’ does not require proof of actual quantifiable deterioration in the competitive situation”.33 Although this case indicates that a more effects-based approach should be
followed, the considerations about trading partners and competitiveness remain the same. It can be deduced from the text of Article 102(c) TFEU and the case law on price discrimination that personalization vis-à-vis consumers does not fit the definition of Article 102(c) TFEU.34 Where personalization involves discrimination between consumers, the court explicitly refers to trading partners and competition between them when applying Article 102(c) TFEU.35 However, an opening to address personalization against consumers under Article 102(c) TFEU can be deduced from the cases Football World Cup and Deutsche Post. In Football World Cup the Commission sanctioned the organizers of the World Cup in France with a symbolic fine, since it discriminated foreign consumers with the sale of football tickets.36 In Deutsche Post the Commission argued that Article 102(c) TFEU may also be applied in situations where a dominant undertakings behavior causes damage directly to consumers.37 The Commission argued that “due to the existence of the postal monopoly in Germany, the term trading partner
– which normally refers to a voluntary commercial relationship between two undertakings –
31 Geradin & Petit 2005, 8-9. 32 [2007] ECR I-2331, point 144.
33 [2018] ECLI:EU:C:2018:270, point 37. 34 Van Damme, Graef & Sauter 2018, 119. 35 Graef 2018, 548.
36 [2000] OJ L005/55, point 121-125. 37 [2001] OJ L331/40, point 133.
must be given a slightly different interpretation” and ruled that under the circumstances of the
case the senders must be regarded as trading partners within the meaning of Article 102(c) TFEU.38 The senders of post included consumers.39 Scholars as Akman, Townley, Morrison and Yeung argue that personalization against consumers can fall under Article 102(c).40 However, since both cases never reached the EU Courts, the question whether they agree with this application of Article 102(c) on the effects on consumers remains unanswered.41
Since it is not clear if personalization fits directly in the definition of Article 102(c) TFEU, regard must be had to the fact that the list of abuses mentioned in Article 102 is not exhaustive but only serves as examples of possible ways for a dominant company to abuse its market power.42 It might be better to assess personalization under Article 102 TFEU in general, instead of trying to fit personalization in one of the examples mentioned in (a) till (d) of Article 102 TFEU. Looking at Article 102 TFEU in general instead of at Article 102(c) in particular does not require that the consumer can be qualified as a trading party and be placed at a competitive disadvantage.43 At the same time, the precise scope of Article 102(c) TFEU cannot be ignored, as it is the leading interpretation of the extent to which discriminatory conduct is anti-competitive.44 Although there may be a possibility to qualify personalization as an abuse of a dominant position under Article 102 TFEU in general, there is uncertainty as to whether it will actually be applied in this way by the CJEU.
3.4 The effectiveness of competition law in protecting consumers against personalization Based on the assessment of personalization under Article 102 TFEU above it can be concluded that the digital economy generates new challenges for the enforcement of European competition law.45 Whereas the text of Article 102 does not directly lead us to the applicability of Article 102 TFEU to personalization against consumers and no cases have dealt with this yet, some cases leave room to assess personalization against final consumers under Article 102 TFEU. This broad interpretation of Article 102 TFEU means an enforcement choice which would not require any amendment of the Treaty.46
38 ibid 130. 39 ibid 133.
40 Akman 2006, 36; Townley, Morrison & Yeung 2017, 36. 41 Graef 2018, 549.
42 [2001] OJ L331/40, point 133.
43 Townley, Morrison & Yeung 2017, 37. 44 Graef 2018, 549.
45 Botta & Wiedemann, ‘To Discriminate or Not to Discriminate?’ 2019, 10. 46 ibid 10.
Whether competition law is actually effective to protect consumers against personalization will be assessed with regard to the negative consequences of personalization: a lack of consumer choice, a lack of transparency and an unequal treatment of consumers. To what extent is competition law able to hinder or prevent these negative consequences?
If personalization can be considered as an abuse of a dominant position under Article 102 TFEU, this can improve competition in the market which in turn can lead to greater choice for consumers. In spite of this, competition law does not provide safeguards to ensure that consumers have the choice, once they visit the website of a company, to indicate that they do not want personalization techniques to be applied. However, in most cases it is not even transparent for consumers to what extent companies use personalization techniques.47 Competition law provides for the possibility to restrict anticompetitive behavior and Article 102 TFEU can only be applied ex post, which means that that only once the behavior has taken place a competition authority will assess whether this is abusive under Article 102 TFEU.48 Although it follows from the case-law that holding a dominant position confers a special responsibility on the undertaking concerned to maintain the structure of the market and the degree of competition49, there is no obligation for a company under competition law to be transparent about the personalization techniques it applies.
Moreover, competition law aims at safeguarding undistorted competition in the market and thereby has its focus on the effects on the market as a whole instead of on the effects for specific individuals. The Court of Justice stressed this in Asnef-Equifax, where it ruled that “it is the
beneficial nature of the effect on all consumers in the relevant markets that must be taken into consideration, not the effect on each member of that category of consumers”.50 It is therefore possible that although the consumer surplus increases, many individual consumers will still be harmed by the use of personalization. As competition law only looks at the aggregate consumer welfare, the risk of possible consumer exploitation cannot be fully tackled by competition law.
3.5 Sub-conclusion
Whether personalization can be considered an abuse of a dominant position is assessed having regard to Article 102(c) TFEU and to that Article in general. Based on the definition of Article
47 Botta & Wiedemann, ‘The Interaction of EU Competition, Consumer, and Data Protection Law’ 2019, 433. 48 De Streel 2008, 57-58.
49 Case 322/81 Michelin I [1983] ECLI:EU:C:1983:313, point 57. 50 [2006] ECR I-11125, point 70.
102(c) TFEU and the interpretation of this provision in the case law, Article 102(c) TFEU should only apply in the business-to-business context. However, some cases might foresee in an opening to assess personalization to consumers under Article 102(c) TFEU. This broad interpretation of Article 102 TFEU will not require any amendment of the Treaty but means an enforcement choice. Another possibility is to assess personalization under Article 102 TFEU in general, which doesn’t require that the consumer can be qualified as a trading party and be placed at a competitive disadvantage. Since no NCA or the Commission investigated personalization against consumers under Article 102 TFEU yet, clarity on this is desirable. Although the prohibition of personalization as abuse of dominance can lead to a greater choice for consumers, competition law does not provide safeguards to ensure that consumers have a choice to whether personalization will be used or an obligation for a company to be transparent about the personalization techniques it applies. In addition, since competition law focuses on the aggregate consumer welfare instead of the individual welfare, it is possible that although the consumer surplus increases, many consumers will still be harmed by the use of personalization. Based on the uncertain application of Article 102 TFEU to personalization against consumers and the fact that the negative consequences for consumers resulting from personalization cannot be fully tackled by competition law, it should be concluded that competition law alone is not highly effective in protecting consumers against personalization.
4. The effectiveness of consumer protection law in protecting against personalization
4.1 Regulatory framework and objectives of European consumer protection law
The objective of consumer law is safeguarding the informed free choice of consumers. In contrast to competition law, which protects the aggregate welfare of consumers, consumer law focuses on protecting the welfare of individual consumers.51 The consumer is considered the weaker party in relation to companies, since he often has less information than the professional party and little influence on the conditions under which he can purchase products.52 The use of big data, in particular, threatens to upset this balance, as companies can use smart ways to entice consumers to make purchases that they might not have made otherwise. Consumer law tries to redress this balance by, among other things, imposing information obligations on traders.53 During the past decades a number of directives have been adopted to harmonize consumer law in the Member States.54 Regarding the use of data for personalized offers or prices, the most important consumer protection instrument is the UCPD.55 The accompanying Commission Guidance provides explanation on how to apply the directive in practice.56
4.2 Scope and principles of the UCPD
The UCPD aims to achieve a high level of consumer protection and to increase the smooth functioning of the internal market.57 It covers the contractual relationship between undertakings and final consumers, whereas business-to-business relationships fall outside the scope of this legal regime.58 As follows from Article 2(d) the UCPD covers a broad scope of commercial practices, since “any act, omission, course of conduct or representation, commercial
communication including advertising and marketing, by a trader, directly connected with the promotion, sale or supply of a product to consumers” can be qualified as such.
51 Botta & Wiedemann, ‘The Interaction of EU Competition, Consumer, and Data Protection Law’ 2019, 435. 52 See for example: Case C-388/13 Nemzeti [2015] EU:C:2015:225, point 53; Case C-110/14 Horațiu [2015] EU:C:2015:538, point 18; Joined cases C-54/17 and C-55/17 Autorità Garante della Concorrenza e del Mercato
v. Wind Tre and Vodafone Italia [2018] EU:C:2018:710, point 54. 53 Mak 2018, 274.
54 Botta & Wiedemann, ‘The Interaction of EU Competition, Consumer, and Data Protection Law’ 2019, 435. 55 Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2015 concerning unfair business-to-consumer commercial practices (Unfair Commercial Practices Directive), OJ L 149.
56 Commission, ‘Guidance on the implementation of Directive 2005/29/EC’ 2016.
57 Article 1 UCPD; Duivenvoorde 2015, 15.
4.3 Personalization as unfair commercial practice under the UCPD
Under the general clause of Article 5 UCPD, unfair commercial practices shall be prohibited. We can distinguish two specific categories of commercial practices which can be regarded as unfair, namely misleading commercial practices and aggressive commercial practices. Neither the European nor the national court have ruled on the question under which circumstances personalization can be considered an unfair commercial practice, therefore the application of the UCPD to personalization could benefit from legal clarification.59 In this section it will be examined whether personalization can be considered an unfair commercial practice.
Since the threshold for the assumption of an unfair commercial practice under the general clause of Article 5 UCPD is considerably high60 and it is not apparent how personalization can be classified as aggressive commercial practice61, only personalization as misleading commercial practice will be assessed. Two types of misleading commercial practices are prohibited under the UCPD: misleading actions and misleading omissions.
4.3.1 Personalization as misleading action
According to Article 6 UCPD, a commercial practice shall be regarded as misleading “if it
contains false information and is therefore untruthful” or in any way “deceives or is likely to deceive the average consumer to take a transactional decision that he would not have taken otherwise”, even when the information is factually correct. However, the CJEU in Trento Sviluppo decided that a commercial practice cannot be classified as ‘misleading’ on the sole
ground that that practice contains false information, but that it is also necessary to cause the consumer to take a transactional decision that he would not have taken otherwise.62
In Article 6(1)(d) UCPD the price or the price calculation method are explicitly referred to as elements which the trader must not disseminate false information or mislead the consumer about. The European Commission clarified in its Guidance that a breach of the UCPD may occur when personalized pricing is combined with certain commercial practices.63 It refers to the example of a company who falsely claims that only a few flight tickets are left when the company is aware that a consumer is running out of time to buy a specific flight ticket.64 So,
59 Bulten 2018, 185. 60 Pavillon 2011, 366. 61 Bulten 2018, 187.
62 [2013] ECLI:EU:C:2013:859, point 30.
63 Commission, ‘Guidance on the implementation of Directive 2005/29/EC’ 2016, 135; Graef 2018, 551.
based on the data the trader collected about the consumer, it can persuade the consumer to buy a ticket at a price way higher than needed. This can be qualified as misleading action under Article 6(1)(a) UCPD and Annex I No 7 UCPD if the traders advertisement contains false information and causes a consumer to make a transactional decision that he would not otherwise have taken. Another possibility for a misleading action to occur in the case of personalization, is when a trader uses personalization techniques but states the contrary.65
4.3.2 Personalization as misleading omission
Although it seems possible for a misleading action to occur in the case of personalization, such as the examples given above, the hazard in the case of personalization by means of big data mainly lies in the omission of information.66 Consumers are often unaware and uninformed about the fact that the offer or the price they see is based on their online consumer behavior. In that sense, we do not speak of a misleading action, but of a misleading omission. According to Article 7 UCPD, a misleading omission means that a trader fails to provide “material
information” which the average consumer needs to make an informed transactional decision.
Here we can distinguish two steps. First, there must be information that has been omitted or that has been provided in an “unclear, unintelligible, ambiguous or untimely manner”.67 Second, this information must be essential for the average consumer in order to make an informed decision about a transaction.68
Although the UCPD does not give a definition of “material information”69, in the case of an
invitation to purchase the price or the price calculation method is explicitly referred to under Article 7(4)(c) UCPD. Moreover, the Commission in its Guidance states that due to the increasing awareness of the economic value of information related to consumers’ preferences, this could possibly qualify as material information.70 This might already lead to the conclusion that information about the application of personalized offers or prices can be regarded as material information. This conclusion is confirmed by the Modernization Directive’s71 insertion
65 De Streel & Jacques 2019, 5. 66 Bulten 2018, 188.
67 Article 7(1) and 7(2) UCPD. 68 Bulten 2018, 188.
69 Commission, ‘Guidance on the implementation of Directive 2005/29/EC’ 2016, 63.
70 ibid 63.
71 Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019 amending
Council Directive 93/13/EEC and Directives 98/6/EC, 2005/29/EC and 2011/83/EU of the European Parliament and of the Council as regards the better enforcement and modernisation of Union consumer protection rules, OJ L 328.
of Article 7(4a) UCPD, Article 6a(1)(a) and Article 6(1)(ea) of the Consumer Rights Directive (“CRD”). Article 7(4a) UCPD and Article 6a(1)(a) CRD require the trader to provide general information on the main parameters determining the order of the search results and their relative importance as opposed to other parameters.72 Moreover, 6(1)(ea) CRD requires the trader to inform consumers whenever a price presented to them is personalized on the basis of automated decision-making. Although these information requirements are inserted in the CRD and not in the UCPD, it shall be regarded as material information under the UCPD on the basis of Article 7(5) UCPD. This provision states that information requirements established by Community law, such as the new information requirements in the CRD, shall be regarded as material. Failure to provide such material information would constitute a misleading omission.
4.4 The average consumer benchmark in an online environment
Whether a commercial practice is unfair ultimately depends on whether the commercial practice is capable of causing an average consumer to take a transactional decision that he would not have taken otherwise. Both Article 6 and 7 UCPD refer to this so-called average consumer benchmark. This is a normative benchmark established by the CJEU in Gut Springenheide and depicts the average consumer as the“reasonably well-informed and reasonably observant and
circumspect” consumer.73 This benchmark is being used to assess the fairness of a commercial practice and is based on the offline commercial environment, as the commercial practice assessed in Gut Springenheide contained the labeling and sales packaging of eggs. It can be questioned whether the existing average consumer benchmark is appropriate or flexible enough to be applied in the online environment, since the characteristics of the offline commercial environment are significantly different from the ones of the online environment.74
Since the emergence of Internet, consumers have better access to information about products and services: they can search all information needed, can compare products on different websites and make use of consumer reviews. For this reason, it can be argued that the average consumer is better informed in an online environment. However, it can also be argued that the abundance of information available may lead to an information overload and thereby confuse the consumer.75 Benning argues that consumers should invest more time in online purchases to
72 Recital 22 Modernization Directive.
73 C-210/96 Gut Springenheide [1998] ECR I-4657, point 31; Recital 18 UCPD.
74 Benning 2018, 222. 75 ibid 221.
make sure they get the best information, but concluded on the basis of old studies that online consumers are mainly overhasty and careless instead of observant.76
In the second place, as elaborated on in paragraph 2.2, with the use of data companies can develop a specific profile and provide consumers with tailored product or service offerings. This will lead to consumers being exposed to manipulated information, since they will not find all information available or the same information as other consumers to be able to make the right choice.77 Benning is of the opinion that since the online average consumer who is individually targeted will not find all information available and is therefore highly influenced in his choice, he cannot be reasonably well-informed.78
Contrary to the arguments of Benning, I do believe the existing benchmark is flexible enough to be applied both in the offline and online world for the following reasons. Initially, the CJEU applies the same benchmark in the offline and online environment. The application of the average consumer benchmark in the offline environment is shown in for example the cases Lidl
Belgium, a case about misleading and comparative advertising for retail basic consumables, and Teekanne, a case about misleading labelling of fruit tea.79 That the same benchmark is used in
the online environment is evidenced in for instance Carrefour Hypermarchés SAS, a case about misleading advertising on television, and in Scotch Whisky Association v. Michael Klotz,a case about the online distribution of whiskey.80 These cases illustrate that the CJEU makes no distinction between the offline and online environment in applying the average consumer benchmark.
Moreover, the average consumer benchmark is not statistical test, but leaves discretion to the court to determine whether a commercial practice is able to mislead the average consumer.81 In addition, recitals of directives are not legally binding and just serve as guidance, so they provide for flexibility, as Benning herself admits.82 This leaves room for the court to make sure that a commercial practice is assessed having regard to the specific characteristics of personalization and an average consumer who sees information which is manipulated. The reasonably
well-76 ibid 224. 77 ibid 222. 78 ibid 223.
79 [2006] ECR I-8501, point 78; [2015] ECLI:EU:C:2015:36, point 36.
80 [2017] ECLI:EU:C:2017:95, point 31; [2018] ECLI:EU:C:2018:415, point 47.
81 Commission, ‘Guidance on the implementation of Directive 2005/29/EC’ 2016, 38.
informedness of the average consumer could therefore be assessed on the informedness about
the application of personalization, instead of on the informedness about all information available on the Internet. In addition, it appears from recent studies that increasing the number of options does not generally reduce choice quality. Especially displaying recommended products causes consumers to search less and make them able to compare offers and prices to help them make better decisions.83
As a final point, regard can be had at the target group benchmark or the vulnerable consumer
benchmark laid down in Article 5(2)b and 5(3) UCPD as alternatives of the average consumer
benchmark.84 These benchmarks imply that when a commercial practice is targeted at a specific group, in particular a group of vulnerable consumers, the fairness of the practice should be determined based on the effect it will have on the average consumer of that group.85 However, the target group depends on what kind of personalization takes place. With first degree price discrimination, the target group coincides with the individual consumer. Since third degree price discrimination relies on dividing consumers into groups and charging different prices to these groups, the target group encompasses all consumers who are charged the same price. On the basis of these benchmarks, personalization as misleading practice could be determined on the average (vulnerable) consumer of this specific group or even on the individual consumer, namely a consumer who (is unaware that he) receives personalized offers or prices. These benchmarks provide for the opportunity to take into account the specific vulnerability of consumers being faced by personalization.86
4.5 The effectiveness of the consumer protection law in protecting consumers against personalization
From the previous paragraphs it can be deduced that personalization can under certain circumstances be qualified as unfair commercial practice. Whether the UCPD is effective to protect consumers against personalization will be assessed having regard to the negative consequences of personalization: a lack of consumer choice, a lack of transparency and an unequal treatment of consumers. As highlighted in paragraph 4.1, the objective of consumer law is safeguarding the informed free choice of consumers. Under the UCPD, a commercial practice will only be regarded as unfair if it impairs the consumer’s freedom of choice and cause
83 Dellaert & Häubl 2012, 285; Hoyer, MacInnis & Pieters 2016, 191. 84 Duivenvoorde 2015, 23.
85 ibid 220.
the consumer to make a transaction that he would not have taken otherwise.87 In contrast to competition law, consumer protection law provides safeguards to ensure consumer choice and transparency. However, it can be concluded that personalized offers or prices in itself are not prohibited under the UCPD. As long as traders are transparent about the application of personalized offers or prices and do not engage in misleading practices, traders are allowed to use personalized offers or determine their prices on the basis of data.88
Another possible negative consequence of personalization can be the unequal treatment of consumers. Consumers might feel that they have been treated unfairly if they find out that they have to pay a higher price for the same product based on the data the trader collected. As consumer law focuses on protecting the welfare of the individual consumer instead of the aggregate welfare of consumers (which is the case in competition law), regard will be had at the negative consequences for an individual consumer. As indicated earlier, personalization is not prohibited under consumer protection law as long as the traders are transparent that they apply personalization techniques. The UCPD therefore does not prevent the individual consumer from being treated unequally, it merely informs him that this may take place. By fulfilling the information obligations, the average consumer gets the opportunity to not conclude a contract based on personalization. As long as there are enough other options for the consumer, the consumer can choose to purchase their product or service from another trader who does not make use of personalization. However, if all traders make use of personalization or the specific product or service a consumer wants can only be obtained by a personalization, the UCPD with its information obligations cannot fully tackle the problem of unequal treatment of consumers. This is all the more important when the personalization techniques are based on prohibited discriminatory grounds such as race, sex or ethnic origin. The UCPD does not provide safeguards to prevent this from happening.
4.6 Case study on Dutch law
Consumer law is less harmonized at EU level than competition law and data protection law, since directives, such as the UCPD, are not directly applicable in all Member States of the European Union but have to be implemented in national law. For this reason, to conclude on the effectivity of the UCPD a case study on Dutch law has been done. The UCPD has been implemented into Dutch law in section 3A of the Dutch Civil Code (“DCC”). If we compare
87 Helberger 2016, 20.
the provisions of the DCC with the UCPD, we notice that the UCPD’s provisions are almost exactly reproduced. This is not surprising, given that the UCPD is based on full harmonization, which means that Member States cannot retain or introduce more or less restrictive consumer protection measures.89 The substantive requirements are thus the same for all Member States of the European Union.
As touched upon in the introduction, in order for rules to be meaningful they need to be effectively enforced. National supervisory authorities are the main enforcers of the UCPD. The rules on enforcement have not yet been harmonized in the European Union, but will be by the Modernization Directive as part of the “New Deal for Consumers”.90 This directive provides new private enforcement possibilities as consumers must at least be awarded a possibility to get out of a contract, have a right to price reduction and claim damages.91 How this is to be implemented is a choice left to the Member States.
Under Dutch law a sanction of nullity is laid down in Article 6:193j(3) DCC, which states that a contract concluded as a result of an unfair commercial practice is voidable. On the one hand, it can be argued that this provision is effective in protecting consumers from personalization. As misleading the consumer or omitting information about personalization can under certain circumstances be qualified as an unfair commercial practice, the consumer is protected against the contract it concluded since it can declare the contract voidable. On the other hand, practical issues arise. First, because consumers are generally unaware of their rights.92 Consumers can simply send a letter to the trader stating that the contract will be voided. Initially, the consumer must be aware of this possibility, and in parallel, the trader must cooperate. It is also possible for the consumer to go to court to declare an agreement void. However, even if the consumer is aware of this possibility, he should have the financial means and the stamina to do so. Second, the risk of proving the causal link lies with the consumer.93 The consumer will have to prove that by the trader failing to provide or providing incorrect information about the use of personalization techniques, he (the consumer) has concluded a contract that he would not have concluded if he had been informed correctly. It has been found that consumer claims often fail
89 Cseres 2014, 22.
90 Commission, ‘Communication A New Deal for Consumers’ 2018.
91 Loos 2019, 4. 92 EPRS 2020, 4.
because of hurdles of proof: establishing the causal link and establishing the damage suffered by the consumer can be difficult to prove.94
Where Member States are currently being given wide discretion with regard to the enforcement of the UCPD, when the Modernization Directive is implemented it requires all Member States to introduce a similar remedy as is already laid down in Article 6:193j(3) DCC. As a result of the Modernization Directive, the information requirements under the UCPD can be dissuasive for traders to use misleading commercial practices. Primarily, since the Modernization Directive provides for improved private and public enforcement options for breaches of the UCPD, including the possibility for the imposition of a high administrative fine.95 In addition, these information obligations make it easier for consumers to enforce protection in the event that they do go to court, given that consumers are in a more favourable position to adduce evidence than in the absence of such an obligation.96
However, even after the implementation of the Modernization Directive the practical issues of enforcing rights for consumers will persist. It is therefore important to make consumers aware of their rights. One can think of information campaigns by the national consumer protection organizations to promote and enhance consumer awareness, which have been proven successful in the past.97 Unfortunately, the issues relating to the causality and proof are not resolved by the Modernization Directive. The Modernization Directive only requires that consumers must be able to terminate the contract, provided that the remedies are proportionate and effective.98 Since the new Article 11a UCPD only provides for minimum harmonization, it is up to the Member States to determine the conditions under which the consumer can terminate the contract in case of an unfair commercial practice. Under Article 6:193j(3) DCC, the mere fact that a company has made use of an unfair commercial practice is not sufficient, as the consumer needs to prove the causal link. A company will always take the view that even if it had adequately informed the consumer, the consumer would have concluded the contract anyway.99 Proving causality for the consumer therefore remains as difficult as before the Modernization Directive. Moreover, differences in countries may arise on this point, to the detriment of
94 Bulten 2018, 189; Giesen & Maes 2014, 219. 95 Loos 2019, 7.
96 Bulten 2018, 189.
97 Commission, ‘Consumer Market Study’ 2017, 98-99.
98 Article 3(5) of the Modernization Directive. 99 Giesen & Maes 2014, 221.
consumers. As this is something that can be addressed very differently per Member State, it has to be concluded that the effectiveness of both the current and the new UCPD on this point is limited. This could be resolved by for example a presumption of a causal link between the use of an unfair commercial practice by a company and the subsequent conclusion of a contract with a consumer.
4.7 Sub-conclusion
It can be concluded that under certain circumstances personalization could constitute an unfair commercial practice. This could be the case if a traders’ advertisement contains false personalized information, if a trader uses personalization techniques but states the contrary or after the implementation of the Modernization Directive if a trader fails to provide consumers
material information on the main parameters determining the order of the search results or on
the fact that the price presented to them is personalized. Nonetheless, personalization is not prohibited under the UCPD as long as traders inform consumers about the application of personalization, so consumers are able to make an informed choice. The effectiveness of the UCPD in combating unequal treatment of consumers is disputable. The UCPD does not prevent the individual consumer from being treated unequally, but merely informs him about it. This will not be a problem if consumers have enough choice for other non-personalized products, but will be if all traders make use of personalization techniques based on certain (even discriminatory) grounds.
After the implementation of the Modernization Directive all Member States must introduce a similar remedy as the Dutch one laid down in Article 6:193j(3) DCC. With the new enforcement possibilities for consumers as part of the “New Deal for Consumers” the information requirements under the UCPD can be dissuasive. However, practical issues of enforcing rights for consumers will persist. Information campaigns and a presumption of a causal link are recommended.
5. The effectiveness of data protection law in protecting against personalization
5.1 Regulatory framework and objectives of European data protection law
Data protection law safeguards the fundamental rights and freedoms of individuals whose personal data is being collected, in particular the right to the protection of personal data.100 It could help mitigate the risks of unfair and illegal discrimination based on data.101 The most important data protection instrument is the GDPR, which is established on the basis of Article 16 TFEU and became effective on 25 May 2018.102 On the same date the European Data Protection Board (“EDPB”) was established, which is a body where all national data protection supervisors from the European Union cooperate in their supervision of the GDPR. The EDPB publishes guidelines on the application of the GDPR. The EDPB's predecessor was the Article 29 Working Party (“WP29”), which guidelines are endorsed and updated by the EDPB.103 Although the guidelines are non-binding, they are helpful when assessing personalization under the GDPR.
5.2 Scope and principles of the GDPR
Data protection law has a different scope than competition law and consumer protection law, since the GDPR is only applicable when personal data are processed.104 According to Article 4(1) GPDR, personal data is defined as “any information relating to an identified or identifiable
natural person”. This natural person is also referred to as data subject. Given the broad
definition of personal data, almost any form of information collected about an individual could qualify as such. When particular information as the name and address of an individual is used to apply personalization, this data can be qualified as personal data. Even if the company only collects information which can lead to a unique and specific profile of a consumer without identifying the traditional information as name and address, this could qualify as personal data.105
Companies that collect individuals’ personal data to personalize adds and prices qualify as controllers within the meaning of the GPDR and therefore have to comply with the data
100 Botta & Wiedemann, ‘The Interaction of EU Competition, Consumer, and Data Protection Law’ 2019, 435. 101 Zuiderveen Borgesius 2018, 21.
102 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection
of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119.
103 EDPB 2018.
104 Botta & Wiedemann, ‘The Interaction of EU Competition, Consumer, and Data Protection Law’ 2019, 435. 105 Zuiderveen Borgesius & Poort 2017, 10-11.
protection rules.106 According to Article 6(1) GPDR, the controller must have a legitimate ground to lawfully process personal data, such as the consent of the data subject. When the data subject did not give its consent, relevant in the case of personalization could be the necessity for the performance of a contract or the necessity of the legitimate interest of the controller, which requires a balancing exercise between the legitimate interests of the controller and the data subject’s interests or fundamental rights or freedoms.107 However, it is highly unlikely that the collection of personal data for the purpose of personalization could be based on one of these legal bases. The fact that personalization can be useful or profitable for companies does not make the processing necessary.108 Not only the EDPB sees the term necessary as a high hurdle109, also the CJEU interprets the term restrictively.110 Thus, the data subject’s consent seems the only legal basis for applying personalization under the GDPR.
5.3 Personalization under the GDPR
In particular Article 22(1) GDPR is relevant in the case of personalization, as data subjects have the right to not be subject to a decision based solely on automated processing, including profiling, which have a legal or similarly significantly effect on him or her. When data processing without human involvement leads to personalized offers or prices, this processing has to be considered as solely based on automated processing.111 Yet, the key issue with regard to Article 22 GDPR is that there needs to be a ‘decision’ based solely on automated processing, which raises the question whether making an offer or price to a consumer based on personalization is such a decision.
While the CJEU has not ruled on this yet, different scholars argue that each individual offer can be considered a ‘decision’ based on the processing of personal data for automated processing.112 According to Mendoza and Bygrave the condition of a ‘decision’ essentially means that a particular attitude or stance is taken towards a person which has some degree of binding effect in the sense that it is likely to be acted upon.113 This could be argued in the case of personalization, since an algorithm decides a particular offer or price for a consumer,114 which
106 Bourreau, De Streel & Graef 2017, 45.
107 OECD, ‘Personalised Pricing in the Digital Era’ Note by the European Union 2018, 11. 108 Zuiderveen Borgesius & Poort 2017, 14.
109 EDPB, ‘Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR’, 9.
110 Case C-524/06 Heinz Huber v Bundesrepublik Deutschland [2008] ECLI:EU:C:2008:724, point 66.
111 OECD, ‘Personalised Pricing in the Digital Era’ Note by the European Union 2018, 11. 112 Vermeulen 2019, 193; Zuiderveen Borgesius & Poort 2017, 16.
113 Mendoza & Bygrave 2017, 10-11. 114 Zuiderveen Borgesius & Poort 2017, 16.
the consumer is bound by when he wants to purchase the product. Whether or not the consumer ultimately accepts the offer and purchases the product does not seem to be decisive.
Some link can be made with the consumer law judgment of Trento Sviluppo, which is discussed in paragraph 4.3.1. In this case, the CJEU interpreted the concept of ‘transactional decision’ broadly. It does not only cover the decision whether or not to purchase a product, but also the decision directly related to that decision, so without requiring the consumer to actually purchase the product.115 In that case, the decision of the consumer whether to enter the shop was therefore qualified as transactional decision in itself. On the basis of the Trento Sviluppo judgment, it could be suspected that the CJEU in the data protection law sphere would give a similar broad interpretation of the concept of ‘decision’. However, important to note here is that Trento
Sviluppo is about the decision a consumer makes, whereas Article 22 GPDR focuses on the
fully automated decision offered to the consumer. Scholars as Mendoza and Bygrave focus on what the consumer does with the personalized offer, and that is not relevant here, since it concerns the decision based on the personalization itself. Based on Vermeulen, Zuiderveen Borgesius and Poort and the community law interpretation of the concept of 'decision' I would argue that each personalized offer would constitute a ‘decision’ within the meaning of Article 22 GDPR.
The other requirement under Article 22(1) is that the automated decision must produce legal or similarly significant effects. Some say it is not apparent how personalization will lead to a decision producing legal effects concerning the data subject.116 One could also argue that the legal effects follow from contract law, namely the binding nature on the company to respect the acceptance of the personalized offer by the consumer. However, it is unclear from the GDPR whether legal effects from other disciplines, such as contract law, are included in this provision. That is a problematic issue that needs to be clarified. Nevertheless, even where there is no change in legal effects, the decision could significantly affect other interests of the data subject. These interests can be inferred from Recital 71 GDPR, where the reference to “personal
preferences or interests (…) or behaviour” seems to refer to personalized offers or prices.117
115 [2013] ECLI:EU:C:2013:859, point 36.
116 OECD, ‘Personalised Pricing in the Digital Era’ Note by the European Union 2018, 11; Malgieri and Comandé, 6-7.
