Protect your consumers or pay the price: mega fines for breaches of consumer protection laws


November 2019 saw the adoption of the Enforcement and Modernisation Directive which amends four existing consumer-facing European directives: the Unfair Commercial Practices Directive, the Consumer Rights Directive, the Unfair Contract Terms Directive and the Price Indication Directive. Member states are required to implement national laws to comply with the Directive from 28 May 2022.

What does the Directive say about fines?

One of the key changes under the Directive is the introduction of turnover-based fines for EU consumer-facing businesses which fail to comply with the Unfair Commercial Practices Directive, the Consumer Rights Directive and the Unfair Contract Terms Directive.

The Directive requires member states to provide for maximum fines of at least 4% of the infringing trader’s annual turnover in the relevant member state(s). So these are GDPR-sized fines.

Some member states already have a fining regime for consumer protection law breaches. Whilst fines tend to be low, we have seen incidents of significant, multi-million euro fines being imposed. In other member states, no fining regime currently exists, so the risk of non-compliance for businesses operating in those countries will significantly increase from 28 May 2022.

However, consumer-facing businesses should note that these maximum fine levels are only likely to apply for very serious consumer protection law breaches, and of course a court or regulator may impose other penalties (instead of, or in addition to fines) for non-compliance. Indeed, the Directive specifies a list of non-exhaustive and indicative criteria that member states must consider when imposing penalties (including fines) for non-compliance. These include the nature, gravity, scale and duration of the infringement; any previous infringements by the trader; and the financial benefits gained or losses avoided by the trader due to the infringement.

What other changes does the Directive make?

The Directive is not just about fines. It also includes some amendments to the existing directives that consumer-facing businesses will need to pro-actively comply with. These include additional information requirements, the introduction of a new concept of digital services to the Consumer Rights Directive, and new provisions in relation to misleading actions and omissions. For example, online marketplaces will need to provide information to consumers on the main parameters determining the ranking of search results.

What happens between now and 28 May 2022?

Member states will need to adopt domestic laws which comply with the Directive and apply them from 28 May 2022.

A degree of discretion is afforded to member states when implementing the Directive. For example, member states could provide for maximum fine levels which are even in excess of 4% of annual turnover – for example, by capping fines at 10% of annual turnover. Consumer-facing businesses – particularly well-known brands with healthy annual turnover figures – may therefore wish to consider encouraging individual member states to implement only the minimum requirements of the Directive.

Of course, from a UK perspective, Brexit means that the UK is unlikely to be required to adopt domestic laws which comply with the Directive. It is possible that the UK will introduce similar fines anyway, given that the Government and Competition and Markets Authority has historically supported the introduction of fines for consumer law breaches. However, currently, we have no clarity on what will happen next; the Government could significantly depart from its pre-Brexit position with regards to consumer protection law. 

The bigger picture

The Directive is part of a bigger package of European consumer protection law reforms. Some of these will require proactive compliance effort by businesses (see our separate article on two new directives relating to the sale and supply of goods and digital content and services to consumers, here). However, the focus of European legislators is firmly on enforcement, with fines being one of the penalties that courts and/or regulators will be able to deploy in future. Other changes in terms of enforcement include the freshly replaced Consumer Protection Cooperation Regulation which gives more powers to national authorities in respect of the co-ordination of cross-border enforcement action. In the future, European consumers may also be able to bring class action style claims against non-compliant businesses, under the Directive on Representative Actions which is currently working its way through the legislative process.

The advent of fines and possibly class actions, together with an enhanced ability for European regulators to co-ordinate enforcement action, significantly changes the risk profile in terms of consumer protection law compliance in Europe.

Of course, the best way to minimise the risk of receiving penalties for non-compliance is to take steps to ensure compliance in the first place. This may require a reset in a business’ approach towards its consumers, moving away from a lax or minimal compliance approach (which may represent a commercially acceptable approach now), to a more stringent, consumer-friendly outlook. To a certain extent, the relevant consumer laws (the Unfair Commercial Practices Directive, the Consumer Rights Directive and the Unfair Contract Terms Directive) are principles-based, which sometimes makes it difficult to achieve compliance. Adopting a position which benefits the consumer will represent the lower risk approach from a compliance perspective. In practice, businesses will need to review the terms and conditions on which they deal with consumers, as well as related policies, processes, notices, advertising materials and other communications.