LeX-Ray

The growth potential of e-commerce in the Union has not yet been fully exploited. The Digital Single Market Strategy for Europe tackles in a holistic manner the major obstacles to the development of cross-border e-commerce in the Union in order to unleash this potential. Ensuring better access for consumers to digital content and digital services, and making it easier for businesses to supply digital content and digital services, can contribute to boosting the Union's digital economy and stimulating overall growth.

Article 26(1) and (2) of the Treaty on the Functioning of the European Union ( TFEU ) provide that the Union is to adopt measures with the aim of establishing or ensuring the functioning of the internal market, which is to comprise an area without internal frontiers in which the free movement of goods and services is ensured. Article 169(1), and point (a) of Article 169(2), TFEU provide that the Union is to contribute to the attainment of a high level of consumer protection through measures adopted pursuant to Article 114 TFEU in the context of the completion of the internal market. This Directive aims to strike the right balance between achieving a high level of consumer protection and promoting the competitiveness of enterprises, while ensuring respect for the principle of subsidiarity.

Certain aspects concerning contracts for the supply of digital content or digital services should be harmonised, taking as a base a high level of consumer protection, in order to achieve a genuine digital single market, increase legal certainty and reduce transaction costs, in particular for small and medium-sized enterprises (‘SMEs’).

Businesses, especially SMEs, often face additional costs, stemming from differences in national mandatory consumer contract law rules, and legal uncertainty when offering cross-border digital content or digital services. Businesses also face costs when adapting their contracts to specific mandatory rules for the supply of digital content or digital services, which are already being applied in several Member States, creating differences in scope and content between specific national rules governing such contracts.

Consumers are not always confident when buying cross border and especially when it is done online. One of the major factors for consumers' lack of confidence is uncertainty about their key contractual rights and the lack of a clear contractual framework for digital content or digital services. Many consumers experience problems related to the quality of, or access to, digital content or digital services. For instance, they receive wrong or faulty digital content or digital services, or they are not able to access the digital content or digital service in question. As a result, consumers suffer financial and non-financial detriment.

In order to remedy such problems, both businesses and consumers should be able to rely on fully harmonised contractual rights in certain core areas concerning the supply of digital content or digital services across the Union. Full harmonisation of some key regulatory aspects would considerably increase legal certainty for consumers and businesses.

Harmonised consumer contract law rules in all Member States would make it easier for businesses, especially SMEs, to supply digital content or digital services across the Union. They would provide businesses with a stable contract law environment when supplying digital content or digital services in other Member States. They would also prevent legal fragmentation that otherwise would arise from new national legislation regulating specifically digital content and digital services.

Consumers should benefit from harmonised rights for the supply of digital content and digital services that provide a high level of protection. They should have clear mandatory rights when they receive or access digital content or digital services from anywhere in the Union. Having such rights should increase their confidence in acquiring digital content or digital services. It should also contribute to reducing the detriment consumers currently suffer, since there would be a set of clear rights that will enable them to address problems they face with digital content or digital services.

This Directive should fully harmonise certain key rules that have, so far, not been regulated at Union or national level.

This Directive should define its scope in a clear and unequivocal manner and provide clear substantive rules for the digital content or digital services falling within its scope. Both the scope of this Directive and its substantive rules should be technologically neutral and future-proof.

This Directive should lay down common rules on certain requirements concerning contracts between traders and consumers for the supply of digital content or a digital service. For this purpose, rules on the conformity of digital content or a digital service with the contract, remedies in the event of a lack of such conformity or a failure to supply and the modalities for the exercise of those remedies, as well as on the modification of digital content or a digital service, should be fully harmonised. Fully harmonised rules on some essential elements of consumer contract law would make it easier for businesses, especially SMEs, to offer their products in other Member States. Consumers would benefit from a high level of consumer protection and welfare gains by fully harmonising key rules. Member States are precluded within the scope of this Directive from providing for any further formal or substantive requirements. For example, Member States should not provide for rules on the reversal of the burden of proof that are different from those provided for in this Directive, or for an obligation for the consumer to notify the trader of a lack of conformity within a specific period.

This Directive should not affect national law to the extent that the matters concerned are not regulated by this Directive, such as national rules on the formation, validity, nullity or effects of contracts or the legality of the digital content or the digital service. This Directive should also not determine the legal nature of contracts for the supply of digital content or a digital service, and the question of whether such contracts constitute, for instance, a sales, service, rental or sui generis contract, should be left to national law. This Directive should also not affect national rules that do not specifically concern consumer contracts and provide for specific remedies for certain types of defects that were not apparent at the time of conclusion of the contract, namely national provisions which may lay down specific rules for the trader's liability for hidden defects. This Directive should also not affect national laws providing for non-contractual remedies for the consumer, in the event of lack of conformity of the digital content or digital service, against persons in previous links of the chain of transactions, or other persons that fulfil the obligations of such persons.

Member States also remain free, for example, to regulate liability claims of a consumer against a third party other than a trader that supplies or undertakes to supply the digital content or digital service, such as a developer which is not at the same time the trader under this Directive.

Member States should also remain free, for example, to regulate the consequences of a failure to supply, or of a lack of conformity of, digital content or a digital service, where such failure to supply or lack of conformity is due to an impediment beyond the control of the trader and where the trader could not be expected to have avoided or overcome the impediment or its consequences, such as in the event of force majeure.

Member States should also remain free, for example, to regulate the rights of parties to withhold the performance of their obligations or part thereof until the other party performs its obligations. For example, Member States should be free to regulate whether a consumer, in cases of a lack of conformity, is to be entitled to withhold payment of the price or part thereof until the trader has brought the digital content or digital service into conformity, or whether the trader is to be entitled to retain any reimbursement due to the consumer upon termination of the contract until the consumer complies with the obligation provided for in this Directive to return the tangible medium to the trader.

Member States should also remain free to extend the application of the rules of this Directive to contracts that are excluded from the scope of this Directive, or to otherwise regulate such contracts. For instance, Member States should remain free to extend the protection afforded to consumers by this Directive also to natural or legal persons that are not consumers within the meaning of this Directive, such as non-governmental organisations, start-ups or SMEs.

The definition of a consumer should cover natural persons who are acting outside their trade, business, craft or profession. However, Member States should also remain free to determine, in the case of dual purpose contracts, where the contract is concluded for purposes that are partly within and partly outside the person's trade, and where the trade purpose is so limited as not to be predominant in the overall context of the contract, whether and under which conditions that person should also be considered a consumer.

This Directive should apply to any contract whereby the trader supplies or undertakes to supply digital content or digital service to the consumer. Platform providers could be considered to be traders under this Directive if they act for purposes relating to their own business and as the direct contractual partner of the consumer for the supply of digital content or a digital service. Member States should remain free to extend the application of this Directive to platform providers that do not fulfil the requirements for being considered a trader under this Directive.

The Directive should address problems across different categories of digital content, digital services, and their supply. In order to cater for fast technological developments and to maintain the future-proof nature of the notion of digital content or digital service, this Directive should cover, inter alia, computer programmes, applications, video files, audio files, music files, digital games, e-books or other e-publications, and also digital services which allow the creation of, processing of, accessing or storage of data in digital form, including software-as-a-service, such as video and audio sharing and other file hosting, word processing or games offered in the cloud computing environment and social media. As there are numerous ways for digital content or digital services to be supplied, such as transmission on a tangible medium, downloading by consumers on their devices, web-streaming, allowing access to storage capabilities of digital content or access to the use of social media, this Directive should apply independently of the medium used for the transmission of, or for giving access to, the digital content or digital service. However, this Directive should not apply to internet access services.

This Directive and CSGD of the European Parliament and of the Council ( 3 ) should complement each other. While this Directive lays down rules on certain requirements concerning contracts for the supply of digital content or digital services, CSGD lays down rules on certain requirements concerning contracts for the sale of goods. Accordingly, in order to meet the expectations of consumers and ensure a clear-cut and simple legal framework for traders of digital content, this Directive should also apply to digital content which is supplied on a tangible medium, such as DVDs, CDs, USB sticks and memory cards, as well as to the tangible medium itself, provided that the tangible medium serves exclusively as a carrier of the digital content. However, instead of the provisions of this Directive on the trader's obligation to supply and on the consumer's remedies for failure to supply, the provisions of CRD of the European Parliament and of the Council ( 4 ) on obligations related to the delivery of goods and remedies in the event of the failure to deliver should apply. In addition, the provisions of CRD on, for example, the right of withdrawal and the nature of the contract under which those goods are supplied, should also continue to apply to such tangible media and the digital content supplied on it. This Directive is also without prejudice to the distribution right applicable to these goods under copyright law.

CSGD should apply to contracts for the sale of goods, including goods with digital elements. The notion of goods with digital elements should refer to goods that incorporate or are inter-connected with digital content or a digital service in such a way that the absence of that digital content or digital service would prevent the goods from performing their functions. Digital content or a digital service that is incorporated in or inter-connected with goods in that manner should fall within the scope of CSGD if it is provided with the goods under a sales contract concerning those goods. Whether the supply of the incorporated or inter-connected digital content or digital service forms part of the sales contract with the seller should depend on the content of this contract. This should include incorporated or inter-connected digital content or digital services the supply of which is explicitly required by the contract. It should also include those sales contracts which can be understood as covering the supply of specific digital content or a specific digital service because they are normal for goods of the same type and the consumer could reasonably expect them given the nature of the goods and taking into account any public statement made by or on behalf of the seller or other persons in previous links of the chain of transactions, including the producer. If, for example, a smart TV were advertised as including a particular video application, that video application would be considered to be part of the sales contract. This should apply regardless of whether the digital content or digital service is pre-installed in the good itself or has to be downloaded subsequently on another device and is only inter-connected to the good. For example, a smart phone could come with a standardised pre-installed application provided under the sales contract, such as an alarm application or a camera application. Another possible example is that of a smart watch. In such a case, the watch itself would be considered to be the good with digital elements, which can perform its functions only with an application that is provided under the sales contract but has to be downloaded by the consumer onto a smart phone; the application would then be the inter-connected digital element. This should also apply if the incorporated or inter-connected digital content or digital service is not supplied by the seller itself but is supplied, under the sales contract, by a third party. In order to avoid uncertainty for both traders and consumers, in the event of doubt as to whether the supply of the digital content or the digital service forms part of the sales contract, CSGD should apply. Furthermore, ascertaining a bilateral contractual relationship, between the seller and the consumer, of which the supply of the incorporated or inter-connected digital content or digital service forms part should not be affected by the mere fact that the consumer has to consent to a licensing agreement with a third party in order to benefit from the digital content or the digital service.

In contrast, if the absence of the incorporated or inter-connected digital content or digital service does not prevent the goods from performing their functions, or if the consumer concludes a contract for the supply of digital content or a digital service which does not form part of a sales contract concerning goods with digital elements, that contract should be considered to be separate from the contract for the sale of the goods, even if the seller acts as an intermediary of that second contract with the third-party supplier, and could fall within the scope of this Directive. For instance, if the consumer downloads a game application from an app store onto a smart phone, the contract for the supply of the game application is separate from the contract for the sale of the smart phone itself. CSGD should therefore only apply to the sales contract concerning the smart phone, while the supply of the game application could fall under this Directive, if the conditions of this Directive are met. Another example would be where it is expressly agreed that the consumer buys a smart phone without a specific operating system and the consumer subsequently concludes a contract for the supply of an operating system from a third party. In such a case, the supply of the separately bought operating system would not form part of the sales contract and therefore would not fall within the scope of CSGD, but could fall within the scope of this Directive, if the conditions of this Directive are met.

Digital representations of value such as electronic vouchers or e-coupons are used by consumers to pay for different goods or services in the digital single market. Such digital representations of value are becoming important in relation to the supply of digital content or digital services, and should therefore be considered as a method of payment within the meaning of this Directive. Digital representations of value should also be understood to include virtual currencies, to the extent that they are recognised by national law. Differentiation depending on the methods of payment could be a cause of discrimination and provide an unjustified incentive for businesses to move towards supplying digital content or a digital service against digital representations of value. However, since digital representations of value have no other purpose than to serve as a method of payment, they themselves should not be considered digital content or a digital service within the meaning of this Directive.

Digital content or digital services are often supplied also where the consumer does not pay a price but provides personal data to the trader. Such business models are used in different forms in a considerable part of the market. While fully recognising that the protection of personal data is a fundamental right and that therefore personal data cannot be considered as a commodity, this Directive should ensure that consumers are, in the context of such business models, entitled to contractual remedies. This Directive should, therefore, apply to contracts where the trader supplies, or undertakes to supply, digital content or a digital service to the consumer, and the consumer provides, or undertakes to provide, personal data. The personal data could be provided to the trader either at the time when the contract is concluded or at a later time, such as when the consumer gives consent for the trader to use any personal data that the consumer might upload or create with the use of the digital content or digital service. Union law on the protection of personal data provides for an exhaustive list of legal grounds for the lawful processing of personal data. This Directive should apply to any contract where the consumer provides or undertakes to provide personal data to the trader. For example, this Directive should apply where the consumer opens a social media account and provides a name and email address that are used for purposes other than solely supplying the digital content or digital service, or other than complying with legal requirements. It should equally apply where the consumer gives consent for any material that constitutes personal data, such as photographs or posts that the consumer uploads, to be processed by the trader for marketing purposes. Member States should however remain free to determine whether the requirements for the formation, existence and validity of a contract under national law are fulfilled.

Where digital content and digital services are not supplied in exchange for a price, this Directive should not apply to situations where the trader collects personal data exclusively to supply digital content or a digital service, or for the sole purpose of meeting legal requirements. Such situations can include, for instance, cases where the registration of the consumer is required by applicable laws for security and identification purposes. This Directive should also not apply to situations where the trader only collects metadata, such as information concerning the consumer's device or browsing history, except where this situation is considered to be a contract under national law. It should also not apply to situations where the consumer, without having concluded a contract with the trader, is exposed to advertisements exclusively in order to gain access to digital content or a digital service. However, Member States should remain free to extend the application of this Directive to such situations, or to otherwise regulate such situations, which are excluded from the scope of this Directive.

This Directive should apply to contracts for the development of digital content that is tailor-made to the specific requirements of the consumer including tailor-made software. This Directive should also apply to the supply of electronic files required in the context of 3D printing of goods, to the extent that such files fall under the definition of digital content or digital services within the meaning of this Directive. However, this Directive should not regulate any rights or obligations related to goods produced with the use of 3D printing technology.

Given that this Directive should apply to contracts which have as their object the supply of digital content or a digital service to the consumer, it should not apply where the main subject matter of the contract is the provision of professional services, such as translation services, architectural services, legal services or other professional advice services, which are often performed personally by the trader, regardless of whether digital means are used by the trader in order to produce the output of the service or to deliver or transmit it to the consumer. Similarly, this Directive should not apply to public services, such as social security services or public registers, where the digital means are only used for transmitting or communicating the service to the consumer. This Directive should also not apply to authentic instruments and other notarial acts, regardless of whether they are performed, recorded, reproduced or transmitted by digital means.

The market for number-independent interpersonal communications services, which do not connect with publicly assigned numbering resources, is rapidly evolving. In recent years, the emergence of new digital services which allow interpersonal communications over the internet, such as web-based email and online messaging services, has led more consumers to use such services. For such reasons, it is necessary to provide effective consumer protection with respect to such services. This Directive should therefore also apply to number-independent interpersonal communications services.

This Directive should not apply to healthcare as defined in Directive 2011/24/EU of the European Parliament and of the Council ( 5 ) . The exclusion of ‘healthcare’ from the scope of this Directive should also apply to any digital content or digital service that constitutes a medical device, as defined in Council Directive 93/42/EEC ( 6 ) or 90/385/EEC ( 7 ) or Directive 98/79/EC of the European Parliament and of the Council ( 8 ) , where such medical device is prescribed or provided by a health professional as defined in Directive 2011/24/EU. However, this Directive should apply to any digital content or digital service that constitutes a medical device, such as health applications, that can be obtained by the consumer without being prescribed or provided by a health professional.

Union law relating to financial services contains numerous rules on consumer protection. Financial services, as defined by the law applicable to that sector, in particular in DMCFSD of the European Parliament and of the Council ( 9 ) , also cover digital content or digital services relating, or giving access, to financial services and are therefore covered by the protection of Union financial services law. Contracts relating to digital content or digital services that constitute a financial service should therefore be excluded from the scope of this Directive.

This Directive should not apply to digital content or a digital service that is provided to a public audience as part of an artistic performance or other event, such as a digital cinematographic projection or an audiovisual theatrical performance. However, this Directive should apply if digital content or a digital service is provided to a public audience by signal transmission such as digital television services.

Free and open source software, where the source code is openly shared and users can freely access, use, modify and redistribute the software or modified versions thereof, can contribute to research and innovation in the market for digital content and digital services. In order to avoid imposing obstacles to such market developments, this Directive should also not apply to free and open source software, provided that it is not supplied in exchange for a price and that the consumer's personal data are exclusively used for improving the security, compatibility or interoperability of the software.

Digital content or digital services are often combined with the provision of goods or other services and offered to the consumer within the same contract comprising a bundle of different elements, such as the provision of digital television and the purchase of electronic equipment. In such cases, the contract between the consumer and the trader includes elements of a contract for the supply of digital content or a digital service, but also elements of other contract types, such as sale of goods or services contracts. This Directive should only apply to the elements of the overall contract that consist of the supply of digital content or digital services. The other elements of the contract should be governed by the rules applicable to those contracts under national law or, as applicable, other Union law governing a specific sector or subject matter. Likewise, any effects that the termination of one element of the bundle contract could have on the other elements of that bundle contract should be governed by national law. However, in order to ensure consistency with the sector-specific provisions of EECCD of the European Parliament and of the Council ( 10 ) regulating bundle contracts, where a trader offers, within the meaning of that Directive, digital content or a digital service in combination with a number-based interpersonal communications service or an internet access service, the provisions of this Directive on the modification of digital content should not apply to the digital content or digital service element of the bundle. The relevant provisions of EECCD should instead apply to all elements of the bundle, including the digital content or digital service.

The provisions of this Directive concerning bundle contracts should only apply to cases where the different elements of the bundle are offered by the same trader to the same consumer under a single contract. This Directive should not affect national laws governing the conditions under which a contract for the supply of digital content or digital services can be considered to be linked with or ancillary to another contract that the consumer has concluded with the same or another trader, the remedies to be exercised under each contract or the effect that the termination of one contract would have on the other contract.

The commercial practice of bundling offers of digital content or digital services with the provision of goods or other services is subject to UBCCPD of the European Parliament and of the Council ( 11 ) concerning unfair business-to-consumer commercial practices in the internal market. Such bundling is not in itself prohibited under UBCCPD. However, it is prohibited where it is deemed unfair, following a case-by-case assessment pursuant to the criteria laid down in that Directive. Union law on competition also allows addressing tying and bundling practices, when they affect the competitive process and harm consumers.

This Directive should be without prejudice to other Union law governing a specific sector or subject matter, such as telecommunications, e-commerce and consumer protection. It should also be without prejudice to Union and national law on copyright and related rights, including the portability of online content services.

The pursuit of activities falling within the scope of this Directive could involve the processing of personal data. Union law provides a comprehensive framework on the protection of personal data. In particular, this Directive is without prejudice to GDPR ( 12 ) and PECD ( 13 ) of the European Parliament and of the Council. That framework applies to any personal data processed in connection with the contracts covered by this Directive. Consequently, personal data should only be collected or otherwise processed in accordance with GDPR and PECD. In the event of a conflict between this Directive and Union law on the protection of personal data, the latter should prevail.

This Directive should not regulate the conditions for the lawful processing of personal data, as this question is regulated, in particular, by GDPR. As a consequence, any processing of personal data in connection with a contract falling within the scope of this Directive is lawful only if it is in conformity with the provisions of GDPR relating to the legal grounds for the processing of personal data. Where processing of personal data is based on consent, in particular pursuant to point (a) of Article 6(1) of GDPR, the specific provisions of that Regulation including those concerning the conditions for assessing whether consent is freely given apply. This Directive should not regulate the validity of the consent given. GDPR also contains comprehensive rights as to the erasure of data and data portability. This Directive should be without prejudice to those rights, which apply to any personal data provided by the consumer to the trader or collected by the trader in connection with any contract falling within the scope of this Directive, and when the consumer terminated the contract in accordance with this Directive.

The right to erasure and the consumer's right to withdraw consent for the processing of personal data should apply fully also in connection with the contracts covered by this Directive. The right of the consumer to terminate the contract in accordance with this Directive should be without prejudice to the consumer's right under GDPR to withdraw any consent given to the processing of the consumer's personal data.

This Directive should not regulate the consequences for the contracts covered by this Directive in the event that the consumer withdraws the consent for the processing of the consumer's personal data. Such consequences should remain a matter for national law.

There are various ways for the trader to supply digital content or digital services to consumers. It is opportune to set simple and clear rules as to the modalities and the time for performing that obligation to supply which is the main contractual obligation of the trader, by making the digital content or a digital service available or accessible to the consumer. The digital content or digital service should be considered to be made available or accessible to the consumer when the digital content or digital service, or any means suitable for accessing or downloading it, has reached the sphere of the consumer and no further action is required by the trader in order to enable the consumer to use the digital content or digital service in accordance with the contract. Considering that the trader is not in principle responsible for acts or omissions of a third party which operates a physical or virtual facility, for instance an electronic platform or a cloud storage facility, that the consumer selects for receiving or storing the digital content or digital service, it should be sufficient for the trader to supply the digital content or digital service to that third party. However, the physical or virtual facility cannot be considered to be chosen by the consumer if it is under the trader's control or is contractually linked to the trader, or where the consumer selected that physical or virtual facility for receipt of the digital content or digital service but that choice was the only one offered by the trader to receive or access the digital content or digital service. Where the physical or virtual facility cannot be considered to have been chosen by the consumer, the obligation of the trader to supply the digital content or digital service should not be considered to have been fulfilled if the digital content or digital service is supplied to the physical or virtual facility but the consumer cannot receive or access the digital content or digital service in accordance with this Directive. In those cases, the consumer should have the same remedies as would apply if the trader had failed to supply the digital content or digital service. With regard to the time of supply, in line with market practices and technical possibilities, and in order to provide for a certain degree of flexibility, the digital content or digital service should be supplied without undue delay, unless the parties decide to agree otherwise in order to cater for other supply models.

The digital content or digital service should comply with the requirements agreed between the trader and the consumer in the contract. In particular, it should comply with the description, quantity, for example the number of music files that can be accessed, quality, for example the picture resolution, language and version agreed in the contract. It should also possess the security, functionality, compatibility, interoperability and other features, as required by the contract. The requirements of the contract should include those resulting from the pre-contractual information which, in accordance with CRD, forms an integral part of the contract. Those requirements could also be set out in a service level agreement, where, under the applicable national law, such type of agreement forms part of the contractual relationship between the consumer and the trader.

The notion of functionality should be understood to refer to the ways in which digital content or a digital service can be used. For instance, the absence or presence of any technical restrictions such as protection via Digital Rights Management or region coding could have an impact on the ability of the digital content or digital service to perform all its functions having regard to its purpose. The notion of interoperability relates to whether and to what extent digital content or a digital service is able to function with hardware or software that is different from those with which digital content or digital services of the same type are normally used. Successful functioning could include, for instance, the ability of the digital content or digital service to exchange information with such other software or hardware and to use the information exchanged.

Given that digital content and digital services are constantly developing, traders may agree with consumers to provide updates and features as they become available. The conformity of the digital content or digital service should, therefore, also be assessed in relation to whether the digital content or service is updated in the manner that has been stipulated in the contract. Failure to supply updates that had been agreed to in the contract should be considered a lack of conformity of the digital content or digital service. Moreover, defective or incomplete updates should also be considered a lack of conformity of the digital content or digital service, given that that would mean that such updates are not performed in the manner stipulated in the contract.

In order to be in conformity and to ensure that consumers are not deprived of their rights, for example in cases where the contract sets very low standards, the digital content or digital service should not only comply with the subjective requirements for conformity, but should in addition comply with the objective requirements for conformity set out in this Directive. Conformity should be assessed, inter alia, by considering the purpose for which digital content or digital services of the same type would normally be used. It should also possess the qualities and performance features which are normal for digital content or digital services of the same type and which consumers can reasonably expect, given the nature of the digital content or digital service, and taking into account any public statements on the specific characteristics of the digital content or digital service made by or on behalf of the trader or other persons in previous links of the chain of transactions.

The standard of reasonableness with regard to any reference in this Directive to what can be reasonably expected by a person should be objectively ascertained, having regard to the nature and purpose of the digital content or digital service, the circumstances of the case and to the usages and practices of the parties involved. In particular, what is considered to be a reasonable time for bringing the digital content or digital service into conformity should be objectively ascertained, having regard to the nature of the lack of conformity.

For the period of time that the consumer would reasonably expect, the trader should provide the consumer with updates, including security updates, in order to keep the digital content or digital service in conformity and secure. For instance, as regards digital content or digital services, the purpose of which is limited in time, the obligation to provide updates should be limited to that time, while for other types of digital content or digital service the period during which updates should be provided to the consumer could be equal to the liability period for lack of conformity or could extend beyond that period, which might be the case particularly with regard to security updates. The consumer should remain free to choose whether to install the updates provided. Where the consumer decides not to install the updates, the consumer should, however, not expect the digital content or digital service to remain in conformity. The trader should inform the consumer that the consumer's decision not to install updates which are necessary for keeping the digital content or digital service in conformity, including security updates, will affect the trader's liability for conformity of those features of the digital content or digital service which the relevant updates are supposed to maintain in conformity. This Directive should not affect obligations to provide security updates laid down in Union law or in national law.

GDPR or any other Union law on data protection should fully apply to the processing of personal data in connection with any contract falling within the scope of this Directive. In addition, this Directive should be without prejudice to the rights, obligations and non-contractual remedies provided for by GDPR. Facts leading to a lack of compliance with requirements provided for by GDPR, including core principles such as the requirements for data minimisation, data protection by design and data protection by default, may, depending on the circumstances of the case, also be considered to constitute a lack of conformity of the digital content or digital service with subjective or objective requirements for conformity provided for in this Directive. One example could be where a trader explicitly assumes an obligation in the contract, or the contract can be interpreted in that way, which is also linked to the trader's obligations under GDPR. In that case, such a contractual commitment can become part of the subjective requirements for conformity. A second example could be where non-compliance with the obligations under GDPR could, at the same time render the digital content or digital service unfit for its intended purpose and, therefore, constitute a lack of conformity with the objective requirement for conformity which requires the digital content or digital service to be fit for the purposes for which digital content or digital services of the same type would be normally used. This would be the case, for example, if the trader of data encryption software fails to implement appropriate measures as required by GDPR to ensure that by design personal data are not disclosed to unauthorised recipients, thus rendering the encryption software unfit for its intended purpose which is the secure transferring of data by the consumer to their intended recipient. Finally, there could be cases where the trader's non-compliance with its obligations under GDPR can also constitute a lack of conformity of the digital content or digital service with the objective requirement for conformity which requires the digital content or digital service to possess the features which are normal for digital content or digital services of the same type and which the consumer can reasonably expect. For instance, if the trader of an online shopping application fails to take the measures provided for in GDPR for the security of processing of the consumer's personal data and as a result the consumer's credit card information is exposed to malware or spyware, that failure could also constitute a lack of conformity of the digital content or digital service within the meaning of this Directive, as the consumer would reasonably expect that an application of this type would normally possess features preventing the disclosure of payment details. Where the facts leading to non-compliance with requirements under GDPR also constitute a lack of conformity of the digital content or digital service with subjective or objective requirements for conformity as provided for in this Directive, the consumer should be entitled to the remedies for the lack of conformity provided for by this Directive, unless the contract is already void or voidable under national law.

In order to ensure sufficient flexibility, it should be possible for the parties to deviate from the objective requirements for conformity. Such a deviation should only be possible if the consumer was specifically informed about it and if the consumer accepts it separately from other statements or agreements and by way of active and unequivocal conduct. Both conditions could, for instance, be fulfilled by ticking a box, pressing a button or activating a similar function.

When applying the rules of this Directive, traders should make use of standards, open technical specifications, good practices and codes of conduct, including in relation to the commonly used and machine-readable format for retrieving the content other than personal data, which was provided or created by the consumer when using the digital content or digital service, and including on the security of information systems and digital environments, whether established at international level, Union level or at the level of a specific industry sector. In this context, the Commission could call for the development of international and Union standards and the drawing up of a code of conduct by trade associations and other representative organisations that could support the uniform implementation of this Directive.

Many types of digital content or digital services are supplied continuously over a period of time, such as access to cloud services. It is therefore necessary to ensure that the digital content or digital service is in conformity throughout the duration of the contract. Short-term interruptions of the supply of digital content or a digital service should be treated as instances of lack of conformity where those interruptions are more than negligible or recur. Moreover, given the frequent improvement of digital content and digital services, in particular by updates, the version of digital content or of a digital service supplied to the consumer should be the most recent one available at the time of the conclusion of the contract, unless the parties have agreed otherwise.

In order to work properly, the digital content or digital service needs to be correctly integrated into the consumer's hardware and software environment. A lack of conformity of the digital content or digital service that results from an incorrect integration should be regarded as a lack of conformity of the digital content or digital service itself, where it was integrated by the trader or under its control, or by the consumer following the trader's instructions for integration, and the incorrect integration was due to shortcomings in the required integration instructions, such as incompleteness or a lack of clarity making the integration instructions difficult to use for the average consumer.

Restrictions of the consumer's use of the digital content or digital service in accordance with this Directive could result from limitations imposed by the holder of intellectual property rights in accordance with intellectual property law. Such restrictions can arise from the end-user license agreement under which the digital content or digital service is supplied to the consumer. This can be the case when, for instance, an end-user licence agreement prohibits the consumer from making use of certain features related to the functionality of the digital content or digital service. Such a restriction could render the digital content or digital service in breach of the objective requirements for conformity laid down in this Directive, if it concerned features which are usually found in digital content or digital services of the same type and which the consumer can reasonably expect. In such cases, the consumer should be able to claim the remedies provided for in this Directive for the lack of conformity against the trader who supplied the digital content or digital service. The trader should only be able to avoid such liability by fulfilling the conditions for derogating from the objective requirements for conformity as laid down in this Directive, namely only if the trader specifically informs the consumer before the conclusion of the contract that a particular characteristic of the digital content or digital service deviates from the objective requirements for conformity and the consumer has expressly and separately accepted that deviation.

Legal defects are a particularly important issue in relation to digital content or digital services, which are subject to intellectual property rights. Restrictions on the consumer's use of digital content or a digital service in accordance with this Directive could be a result of a violation of third-party rights. Such violation might effectively bar the consumer from enjoying the digital content or digital service or some of its features, for instance when the consumer cannot access the digital content or digital service at all or cannot do so lawfully. That might be due to the fact that the third party rightfully compels the trader to stop infringing those rights and to discontinue offering the digital content or digital service in question or that the consumer cannot use the digital content or digital service without infringing the law. In the event of a violation of third-party rights that results in a restriction that prevents or limits the use of the digital content or digital service in accordance with the subjective and objective requirements for conformity, the consumer should be entitled to the remedies for the lack of conformity, unless national law provides for the nullity of the contract, or for its rescission, for example for breach of legal warranty against eviction.

The trader should be liable to the consumer in the event of a lack of conformity of the digital content or digital service, and for any failure to supply the digital content or digital service. As digital content or digital services can be supplied to consumers through one or more individual acts of supply or continuously over a period of time, it is appropriate that the relevant time for the purpose of establishing conformity of the digital content or digital service be determined in the light of those different types of supply.

Digital content or digital services can be supplied to consumers through a single act of supply, for instance when consumers download an e-book and store it on their personal device. Similarly, the supply can consist of a series of such individual acts, for instance where consumers receive a link to download a new e-book every week. The distinctive element of this category of digital content or digital service is the fact that consumers thereafter have the possibility to access and use the digital content or digital service indefinitely. In such cases, the conformity of the digital content or digital service should be assessed at the time of supply, and therefore the trader should only be liable for any lack of conformity which exists at the time when the single act of supply or each individual act of supply takes place. In order to ensure legal certainty, traders and consumers should be able to rely on a harmonised minimum period during which the trader should be held liable for a lack of conformity. In relation to contracts which provide for a single act of supply or a series of individual acts of supply of the digital content or digital service, Member States should ensure that traders are liable for not less than two years from the time of supply, if under their respective national law the trader is only liable for any lack of conformity that becomes apparent within a period of time after supply.

Digital content or digital services could also be supplied to consumers in a continuous manner over a period of time. Continuous supply can include cases whereby the trader makes a digital service available to consumers for a fixed or an indefinite period of time, such as a two-year cloud storage contract or an indefinite social media platform membership. The distinctive element of this category is the fact that the digital content or digital service is available or accessible to consumers only for the fixed duration of the contract or for as long as the indefinite contract is in force. Therefore, it is justified that the trader, in such cases, should only be liable for a lack of conformity which appears during that period of time. The element of continuous supply should not necessarily require a long-term supply. Cases such as web-streaming of a video clip should be considered continuous supply over a period of time, regardless of the actual duration of the audio-visual file. Cases where specific elements of the digital content or digital service are made available periodically or on several instances during the fixed duration of the contract, or for as long as the indefinite contract is in force, should also be considered a continuous supply over a period of time, for instance where the contract stipulates that a copy of anti-virus software can be used for a year and will be automatically updated on the first day of each month of this period, or that the trader will issue updates whenever new features of a digital game become available, and the digital content or digital service is available or accessible to consumers only for the fixed duration of the contract or for as long as the indefinite contract is in force.

Member States should remain free to regulate national limitation periods. However, such limitation periods should not prevent consumers from exercising their rights throughout the period of time during which the trader is liable for a lack of conformity. While this Directive should therefore not harmonise the starting point of national limitation periods, it should nevertheless ensure that such periods still allow consumers to exercise their remedies for any lack of conformity that becomes apparent at least during the period during which the trader is liable for a lack of conformity.

Due to the specific nature and high complexity of digital content and digital services, as well as the trader's better knowledge and access to know-how, technical information and high-tech assistance, the trader is likely to be in a better position than the consumer to know why the digital content or digital service is not supplied or is not in conformity. The trader is also likely to be in a better position to assess whether the failure to supply or the lack of conformity is due to the incompatibility of the consumer's digital environment with the technical requirements for the digital content or digital service. Therefore in the event of a dispute, while it is for the consumer to provide evidence that the digital content or digital service is not in conformity, the consumer should not have to prove that the lack of conformity existed at the time of supply of the digital content or digital service or, in the event of continuous supply, during the duration of the contract. Instead, it should be for the trader to prove that the digital content or digital service was in conformity at that time or during that period. That burden of proof should be on the trader for a lack of conformity which becomes apparent within one year from the time of supply where the contract provides for a single act of supply or a series of individual acts of supply, and for the duration of the contract where the contract provides for continuous supply over a period of time. However, where the trader proves that the consumer's digital environment is not compatible with the technical requirements, of which the trader informed the consumer in a clear and comprehensible manner before the conclusion of the contract, the consumer should have the burden of proving that the lack of conformity of the digital content or digital service existed at the time of supply of the digital content or digital service where the contract provides for a single act of supply or a series of individual acts of supply or, where the contract provides for continuous supply over a period of time, for the duration of the contract.

Without prejudice to the fundamental right to the protection of private life, including confidentiality of communications, and to the protection of personal data of the consumer, the consumer should cooperate with the trader in order for the trader to ascertain whether the cause of the lack of conformity lies in the consumer's digital environment using the technically available means which are least intrusive for the consumer. This can often be done for instance by providing the trader with automatically generated incident reports or with details of the consumer's internet connection. Only in exceptional and duly justified circumstances where, despite the best use of all other means, there is no other way possible, consumers may need to allow virtual access to their digital environment. However, where the consumer does not cooperate with the trader and the consumer had been informed of the consequences of non-cooperation, it should be for the consumer to prove not only that the digital content or digital service is not in conformity, but also that the digital content or digital service was not in conformity at the time of supply of the digital content or digital service where the contract provides for a single act of supply or a series of individual acts of supply or, where the contract provides for continuous supply over a period of time, for the duration of the contract.

Where the trader has failed to supply the digital content or digital service, the consumer should call upon the trader to supply the digital content or digital service. In such cases, the trader should act without undue delay, or within an additional period of time as expressly agreed to by the parties. Considering that digital content or a digital service is supplied in digital form, the supply should not require, in the majority of situations, any additional time to make the digital content or digital service available to the consumer. Therefore, in such cases, the obligation of the trader to supply the digital content or digital service without undue delay should mean having to supply it immediately. If the trader then fails to supply the digital content or digital service, the consumer should be entitled to terminate the contract. In specific circumstances, such as where it is clear that the trader will not supply the digital content or digital service or where a specific time for the supply is essential for the consumer, the consumer should be entitled to terminate the contract without first calling upon the trader to supply the digital content or digital service.

In the case of lack of conformity, consumers should be entitled to have the digital content or digital service brought into conformity, to have a proportionate reduction in the price, or to terminate the contract.

Depending on the technical characteristics of the digital content or digital service, the trader should be allowed to select a specific way of bringing the digital content or digital service into conformity, for example by issuing updates or making a new copy of the digital content or digital service available to the consumer.

Given the diversity of digital content and digital services, it is not appropriate to set fixed deadlines for the exercise of rights or the fulfilling of obligations related to digital content or digital services. Such deadlines would not take account of such diversity and could be either too short or too long, depending on the case. It is therefore more appropriate to require that digital content and digital services be brought into conformity within a reasonable time. Such requirement should not prevent the parties from agreeing on a specific time for bringing the digital content or digital service into conformity. The digital content or digital service should be brought into conformity free of any charge. In particular, the consumer should not incur any costs associated with the development of an update for the digital content or digital service.

Where bringing digital content or a digital service into conformity is legally or factually impossible or where the trader refuses to bring the digital content or digital service into conformity because to do so would impose disproportionate costs on the trader, or where the trader has failed to bring the digital content or digital service into conformity within a reasonable time, free of charge and without causing significant inconvenience to the consumer, the consumer should be entitled to the remedies of price reduction or termination of the contract. In certain situations, it is justified that the consumer should be entitled to have the price reduced or the contract terminated immediately, for instance where the trader previously failed to successfully bring the digital content or digital service into conformity or where the consumer cannot be expected to maintain confidence in the ability of the trader to bring the digital content or digital service into conformity due to the serious nature of the lack of conformity. For example, the consumer should be entitled to directly request a price reduction or the termination of the contract where the consumer is supplied with anti-virus software which is itself infected with viruses and would constitute an instance of lack of conformity of such a serious nature. The same should apply where it is clear that the trader will not bring the digital content or digital service into conformity within a reasonable time or without significant inconvenience for the consumer.

In a situation where the consumer is entitled to a reduction of the price paid for the digital content or digital service which is supplied over a period of time, the calculation of the price reduction should take into consideration the decrease of value of the digital content or digital service due both to the lack of conformity and to the time during which the consumer was unable to enjoy the digital content or digital service in conformity.

Where the digital content or digital service is supplied in exchange for a price, the consumer should be able to terminate the contract only if the lack of conformity is not minor. However, where the digital content or digital service is not supplied in exchange for a price but personal data are provided by the consumer, the consumer should be entitled to terminate the contract also in cases where the lack of conformity is minor, since the remedy of price reduction is not available to the consumer. In cases where the consumer pays a price and provides personal data, the consumer should be entitled to all available remedies in the event of a lack of conformity. In particular, provided all other conditions are met, the consumer should be entitled to have the digital content or digital service brought into conformity, to have the price reduced in relation to the money paid for the digital content or digital service or to have the contract terminated.

Where the consumer terminates the contract, the trader should reimburse the price paid by the consumer. However, there is a need to balance the legitimate interests of consumers and traders where the digital content or digital service is supplied over a period of time and the digital content or digital service was in conformity only for part of that period. Therefore, upon termination, the consumer should only be entitled to the part of the price paid that corresponds and is in proportion to the length of time during which the digital content or digital service was not in conformity. The consumer should also be entitled to any part of the price paid in advance for any period that would have remained after the contract was terminated.

Where personal data are provided by the consumer to the trader, the trader should comply with the obligations under GDPR. Such obligations should also be complied with in cases where the consumer pays a price and provides personal data. Upon termination of the contract, the trader should also refrain from using any content other than personal data, which was provided or created by the consumer when using the digital content or digital service supplied by the trader. Such content could include digital images, video and audio files and content created on mobile devices. However, the trader should be entitled to continue to use the content provided or created by the consumer in cases where such content either has no utility outside the context of the digital content or digital service supplied by the trader, only relates to the consumer's activity, has been aggregated with other data by the trader and cannot be disaggregated or only with disproportionate efforts, or has been generated jointly by the consumer and others, and other consumers can continue to make use of it.

The consumer could be discouraged from exercising remedies for a lack of conformity of digital content or a digital service if the consumer is deprived of access to content other than personal data, which the consumer provided or created through the use of the digital content or digital service. In order to ensure that the consumer benefits from effective protection in relation to the right to terminate the contract, the trader should therefore, at the request of the consumer, make such content available to the consumer following the termination of the contract.

The consumer should be entitled to retrieve the content within a reasonable time, without hindrance from the trader, in a commonly used machine-readable format and free of charge, with the exception of costs generated by the consumer's own digital environment, for instance the costs of a network connection as those costs are not specifically linked to the retrieval of the content. However, the obligation of the trader to make available such content should not apply where the content only has utility within the context of using the digital content or digital service, or relates only to the consumer's activity when using the digital content or digital service or has been aggregated with other data by the trader and cannot be disaggregated or only with disproportionate efforts. In such cases, the content does not have significant practical use or interest for the consumer while taking into account also the interests of the trader. Moreover, the obligation of the trader to make available to the consumer, upon termination of the contract, any content that is not personal data and has been provided or created by the consumer should be without prejudice to the trader's right not to disclose certain content in accordance with applicable law.

Where the contract is terminated, the consumer should not be required to pay for the use of the digital content or digital service for any period during which the digital content or a digital service was not in conformity because that would deprive the consumer of effective protection. However, the consumer should also refrain from using the digital content or digital service and from making it available to third parties, for instance by deleting the digital content or any usable copy or rendering the digital content or digital service otherwise inaccessible.

The principle of the liability of the trader for damages is an essential element of contracts for the supply of digital content or digital services. Therefore, the consumer should be entitled to claim compensation for detriment caused by a lack of conformity or a failure to supply the digital content or digital service. The compensation should put the consumer as much as possible into the position in which the consumer would have been had the digital content or digital service been duly supplied and been in conformity. As such a right to damages already exists in all Member States, this Directive should be without prejudice to national rules on the compensation of consumers for harm resulting from infringement of those rules.

This Directive should also address modifications, such as updates and upgrades, which are carried out by traders on the digital content or digital service which is supplied or made accessible to the consumer over a period of time. Considering the fast-evolving character of digital content and digital services, such updates, upgrades or similar modifications may be necessary and are often advantageous for the consumer. Some modifications, for instance those stipulated as updates in the contract, may form part of the contractual commitment. Other modifications can be required to fulfil the objective requirements for conformity of the digital content or digital service as set out in this Directive. Yet other modifications, which would deviate from the objective requirements for conformity and which are foreseeable at the time of conclusion of the contract, would have to be expressly agreed to by the consumer when concluding the contract.

In addition to modifications aimed at maintaining conformity, the trader should be allowed under certain conditions to modify features of the digital content or digital service, provided that the contract gives a valid reason for such a modification. Such valid reasons could encompass cases where the modification is necessary to adapt the digital content or digital service to a new technical environment or to an increased number of users or for other important operational reasons. Such modifications are often to the advantage of the consumer as they improve the digital content or digital service. Consequently, the parties to the contract should be able to include clauses in the contract which allow the trader to undertake modifications. In order to balance consumer and business interests, such a possibility for the trader should be coupled with a right for the consumer to terminate the contract where such modifications negatively impact the use of or access to the digital content or digital service in more than only a minor manner. The extent to which modifications negatively impact the use of or access to the digital content or digital service by the consumer should be objectively ascertained having regard to the nature and purpose of the digital content or digital service and to the quality, functionality, compatibility and other main features which are normal for digital content or digital services of the same type. The rules provided for in this Directive concerning such updates, upgrades or similar modifications should however not concern situations where the parties conclude a new contract for the supply of the digital content or digital service, for instance as a consequence of distributing a new version of the digital content or digital service.

Consumers should be informed of modifications in a clear and comprehensible manner. Where a modification negatively impacts, in more than a minor manner, the access to or use of digital content or a digital service by the consumer, the consumer should be informed in a way that allows the information to be stored on a durable medium. A durable medium should enable the consumer to store the information for as long as is necessary to protect the interests of the consumer arising from the consumer's relationship with the trader. Such media should include, in particular, paper, DVDs, CDs, USB sticks, memory cards or hard disks as well as emails.

Where a modification negatively impacts, in more than a minor manner, the access or use of the digital content or digital service by the consumer, the consumer should enjoy as a result of such a modification the right to terminate the contract free of any charge. Alternatively, the trader can decide to enable the consumer to maintain access to the digital content or digital service at no additional cost, without the modification and in conformity, in which case the consumer should not be entitled to terminate the contract. However, if the digital content or digital service that the trader enabled the consumer to maintain is no longer in conformity with the subjective and the objective requirements for conformity, the consumer should be able to rely on the remedies for a lack of conformity as provided for under this Directive. Where the requirements for such a modification as laid down in this Directive are not satisfied and the modification results in a lack of conformity, the consumer's right to bring the digital content or digital service into conformity, have the price reduced or the contract terminated, as provided for under this Directive, should remain unaffected. Similarly, where, subsequent to a modification, a lack of conformity of the digital content or digital service that has not been caused by the modification arises, the consumer should continue to be entitled to rely on remedies as provided for under this Directive for the lack of conformity in relation to this digital content or digital service.

The lack of conformity of the digital content or digital service as supplied to the consumer is often due to one of the transactions in a chain that links the original designer to the final trader. While the final trader should be liable towards the consumer in the event of a lack of conformity, it is important to ensure that the trader has appropriate rights vis-à-vis different persons in the chain of transactions in order to be able to cover the liability towards the consumer. Such rights should be limited to commercial transactions and they should therefore not cover situations where the trader is liable towards the consumer for the lack of conformity of digital content or a digital service that is composed of or built upon software which was supplied without the payment of a price under a free and open-source licence by a person in previous links of the chain of transactions. However, it should be for the Member States under their applicable national law to identify the persons in the chain of transactions against which the final trader can turn and the modalities and conditions of such actions.

Persons or organisations regarded under national law as having a legitimate interest in protecting consumer contractual and data protection rights should be afforded the right to initiate proceedings to ensure that the national provisions transposing this Directive are applied, either before a court or before an administrative authority which is competent to decide upon complaints, or to initiate appropriate legal proceedings.

Nothing in this Directive should prejudice the application of the rules of private international law, in particular Regulations RI ( 14 ) and (EU) No 1215/2012 ( 15 ) of the European Parliament and of the Council.

The Annex to Regulation 2017/2394 of the European Parliament and of the Council ( 16 ) should be amended to include a reference to this Directive so as to facilitate cross-border cooperation on enforcement of this Directive.

Annex I to Directive 2009/22 of the European Parliament and of the Council ( 17 ) should be amended to include a reference to this Directive so as to ensure that the collective interests of consumers laid down in this Directive are protected.

Consumers should be able to benefit from their rights under this Directive as soon as the corresponding national transposition measures begin to apply. Those national transposition measures should, therefore, also apply to contracts of an indefinite or fixed duration which were concluded before the application date and provide for the supply of digital content or digital services over a period of time, either continuously or through a series of individual acts of supply, but only as regards digital content or a digital service that is supplied from the date of application of the national transposition measures. However, in order to ensure a balance between the legitimate interests of consumers and traders, the national measures transposing the provisions of this Directive on the modification of the digital content or digital service and the right to redress should only apply to contracts concluded after the application date pursuant to this Directive.

In accordance with the Joint Political Declaration of 28 September 2011 of Member States and the Commission on explanatory documents ( 18 ) , Member States have undertaken to accompany, in justified cases, the notification of their transposition measures with one or more documents explaining the relationship between the components of a directive and the corresponding parts of national transposition instruments. With regard to this Directive, the legislator considers the transmission of such documents to be justified.

The European Data Protection Supervisor was consulted in accordance with Regulation 2001/45 of the European Parliament and of the Council ( 19 ) and delivered an opinion on 14 March 2017 ( 20 ) .

Since the objectives of this Directive, namely to contribute to the functioning of the internal market by tackling in a consistent manner contract law related obstacles for the supply of digital content or digital services while preventing legal fragmentation, cannot be sufficiently achieved by the Member States but can rather, by reasons of ensuring the overall coherence of the national laws through harmonised contract law rules which would also facilitate coordinated enforcement actions, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve those objectives.

This Directive respects the fundamental rights and freedoms and observes the principles recognised, in particular, by the Charter of Fundamental Rights of the European Union, including those enshrined in Articles 16, 38 and 47 thereof,