[gnso-rds-pdp-wg] Additional Key Input for Phase 1 - VKI v Amazon EU Sárl judgement of CJEU

[Ayden Férdeline]

Greetings all,
I would like to introduce a new key input for your consideration and for Phase 1
of our work.
The Court of Justice of the European Union (CJEU) has recently delivered a judgment on the applicability of data protection laws in reference to VKI v Amazon EU
Sárl (Case C-191/15). I have summarised the Court’s judgement below, as it may
have a bearing on our work when we come to consider what data should be
collected, stored, and disclosed.
In this case, the defendant (Amazon) was established in Luxembourg. It
maintained a website which was accessible to Austrian consumers and allowed
persons in this territory to enter into electronic sales contracts. However,
Amazon has no registered office or employees in Austria. It also did not allow
consumers to negotiate their sales contract – they could either accept it, or
were asked to exit the website. Inside this contract, the terms permitted Amazon
to make use of data supplied by consumers and stated that Luxembourg law
applied, despite the fact that the consumers themselves were not established in
Luxembourg. The claimant (VKI) applied to the Austrian court for an injunction
to prohibit the use of these terms. The Austrian Supreme Court referred the case
to the CJEU.
The CJEU held, among other things, that the fact that Amazon does not have an
office or subsidiary in Austria does not preclude it from having an
establishment there. Therefore the CJEU held that it is for the national court
to ascertain whether or not Amazon carries out the data processing in question
in the context of the activities of an establishment situated in Austria or in
Luxembourg or elsewhere. The CJEU also held that the choice of law clause in
Amazon’s contract was unfair, because under the Rome I Regulation, European
consumers enjoy the protection of the mandatory provisions of the law which
apply in the location where they are established. Amazon was wrong to give consumers the impression that only
the laws where Amazon is established apply.
You can read the entire judgement here (it is available in multiple languages,
if more convenient): 
http://curia.europa.eu/juris/document/document.jsf?text=&docid=182286&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=909782
I am not a lawyer, but from my reading of this case it would appear to have some
implications for domain name registrars and other parties doing business with
European consumers. This would be especially true for such entities registered
themselves in the European Union.
Best wishes,
Ayden Férdeline
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-rds-pdp-wg/attachments/20160813/12aa4aed/attachment.html>