Consumer rights rules will not apply where personal data, not money, is exchanged for digital content

Where businesses agree such contracts with consumers then consumers will not enjoy qualified rights to refunds, or repair or replacement of digital content that will otherwise be given to them under the Consumer Rights Act when it comes into force on 1 October, according to the Competition and Markets Authority (CMA).

Under the Act, those rights would only apply if consumers have either directly or indirectly paid for digital content with money or something else that has itself been paid for with money, or if the content has been supplied for free in conjunction with something else that has been paid for.

The CMA has issued new guidance on unfair contract terms (144-page / 1.17MB PDF) which provides more information on how those provisions are to be interpreted.

It said consumers that pay for goods with virtual currency will enjoy the rights laid out under the Act, but that those that exchange personal data for digital content that is otherwise free will not, "except where damage has been caused by the digital content supplied", the CMA said.

"In some cases, digital content may have been supplied in return for something other than money – for instance where a consumer gives the trader access to their personal data," the CMA said. "This is not the same as a situation in which digital content has been ‘paid for either directly or indirectly’ as those words are used in this guidance, and in such cases, the consumer does not enjoy the rights and remedies set out in Part 1 of the Act, except where damage has been caused by the digital content supplied."

The CMA confirmed, though, that all agreements between digital content suppliers and consumers must abide by fairness and transparency rules set out in the Act, even if consumers do not benefit from most of the statutory rights and remedies available under the legislation.

Commercial contract and data protection expert Claire Edwards of Pinsent Masons, the law firm behind Out-Law.com, said: "In the age of big data gaining an insight into consumer preferences and behaviours is becoming increasingly important. Companies are devoting increasing resources to gathering data and utilising the latest software and systems for analysing and making sense of it, with the aim of improving and personalising the products and services they provide or delivering more targeted advertising."

"The CMA's guidance highlights the interesting question of what value can be put on personal data and the price of consumers' privacy. Digital content developers, licensors and suppliers that develop a business model that does not rely on payment from consumers but on gaining access to their personal data should, though, be mindful that whilst some of the liabilities they might encounter under the Consumer Rights Act will not apply, data privacy rules will still need to be respected," she said.

"Profiling and analytics is expressly part of the new EU data protection laws, and clear notices will have to be set out which explain such purpose of use and consent to such use will need to be obtained from the individuals. Businesses should also be mindful that misuse of personal data could result in substantial fines under new EU data protection laws on the horizon," Edwards said.