EU's charter om grundlæggende rettigheder

Preamble:

(1) Article 169(1) and point (a) of Article 169(2) of the Treaty on the Functioning of the European Union (TFEU) provide that the Union is to contribute to the attainment of a high level of consumer protection through measures adopted pursuant to Article 114 TFEU. Article 38 of the Charter of Fundamental Rights of the European Union provides that Union policies are to ensure a high level of consumer protection.

(2) In accordance with Article 26(2) TFEU, the internal market is to comprise an area without internal frontiers in which the free movement of goods and services is ensured. In order for consumers to have confidence in and benefit from the digital dimension of the internal market, it is necessary that they have access to simple, efficient, fast and low-cost ways of resolving disputes which arise from the sale of goods or the supply of services online. This is particularly important when consumers shop cross-border.‘

(4) Fragmentation of the internal market impedes efforts to boost competitiveness and growth. Furthermore, the uneven availability, quality and awareness of simple, efficient, fast and low-cost means of resolving disputes arising from the sale of goods or provision of services across the Union constitutes a barrier within the internal market which undermines consumers’ and traders’ confidence in shopping and selling across borders.‘

(13) The definition of ‘consumer’ should cover natural persons who are acting outside their trade, business, craft or profession. However, if the contract is concluded for purposes partly within and partly outside the person’s trade (dual purpose contracts) and the trade purpose is so limited as not to be predominant in the overall context of the supply, that person should also be considered as a consumer.‘

(14) The definition of ‘online sales or service contract’ should cover a sales or service contract where the trader, or the trader’s intermediary, has offered goods or services through a website or by other electronic means and the consumer has ordered those goods or services on that website or by other electronic means. This should also cover cases where the consumer has accessed the website or other information society service through a mobile electronic device such as a mobile telephone.

(26) The right to an effective remedy and the right to a fair trial are fundamental rights laid down in Article 47 of the Charter of Fundamental Rights of the European Union. ODR is not intended to and cannot be designed to replace court procedures, nor should it deprive consumers or traders of their rights to seek redress before the courts. This Regulation should not, therefore, prevent parties from exercising their right of access to the judicial system.

(35) This Regulation respects fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union and specifically Articles 7, 8, 38 and 47 thereof.

Article 1: Subject matter
The purpose of this Regulation is, through the achievement of a high level of consumer protection, to contribute to the proper functioning of the internal market, and in particular of its digital dimension by providing a European ODR platform (‘ODR platform’) facilitating the independent, impartial, transparent, effective, fast and fair out-of-court resolution of disputes between consumers and traders online.

Article 12: Processing of personal data

1. Access to information, including personal data, related to a dispute and stored in the database referred to in Article 11 shall be granted, for the purposes referred to in Article 10, only to the ADR entity to which the dispute was transmitted in accordance with Article 9. Access to the same information shall be granted also to ODR contact points, in so far as it is necessary, for the purposes referred to in Article 7(2) and (4).

2. The Commission shall have access to information processed in accordance with Article 10 for the purposes of monitoring the use and functioning of the ODR platform and drawing up the reports referred to in Article 21. It shall process personal data of the users of the ODR platform in so far as it is necessary for the operation and maintenance of the ODR platform, including for the purposes of monitoring the use of the ODR platform by ADR entities and ODR contact points.

3. Personal data related to a dispute shall be kept in the database referred to in paragraph 1 of this Article only for the time necessary to achieve the purposes for which they were collected and to ensure that data subjects are able to access their personal data in order to exercise their rights, and shall be automatically deleted, at the latest, six months after the date of conclusion of the dispute which has been transmitted to the ODR platform in accordance with point (iii) of point (c) of Article 10. That retention period shall also apply to personal data kept in national files by the ADR entity or the ODR contact point which dealt with the dispute concerned, except if the procedural rules applied by the ADR entity or any specific provisions of national law provide for a longer retention period.

4. Each ODR advisor shall be regarded as a controller with respect to its data processing activities under this Regulation, in accordance with point (d) of Article 2 of Directive 95/46/EC, and shall ensure that those activities comply with national legislation adopted pursuant to Directive 95/46/EC in the Member State of the ODR contact point hosting the ODR advisor.

5. Each ADR entity shall be regarded as a controller with respect to its data processing activities under this Regulation, in accordance with point (d) of Article 2 of Directive 95/46/EC, and shall ensure that those activities comply with national legislation adopted pursuant to Directive 95/46/EC in the Member State where the ADR entity is established.

6. In relation to its responsibilities under this Regulation and the processing of personal data involved therein, the Commission shall be regarded as a controller in accordance with point (d) of Article 2 of Regulation (EC) No 45/2001.

Article 13: Data confidentiality and security

1. ODR contact points shall be subject to rules of professional secrecy or other equivalent duties of confidentiality laid down in the legislation of the Member State concerned.

2. The Commission shall take the appropriate technical and organisational measures to ensure the security of information processed under this Regulation, including appropriate data access control, a security plan and a security incident management, in accordance with Article 22 of Regulation (EC) No 45/2001.

Article 14: Consumer information

1. Traders established within the Union engaging in online sales or service contracts, and online marketplaces established within the Union, shall provide on their websites an electronic link to the ODR platform. That link shall be easily accessible for consumers. Traders established within the Union engaging in online sales or service contracts shall also state their e-mail addresses.

2. Traders established within the Union engaging in online sales or service contracts, which are committed or obliged to use one or more ADR entities to resolve disputes with consumers, shall inform consumers about the existence of the ODR platform and the possibility of using the ODR platform for resolving their disputes. They shall provide an electronic link to the ODR platform on their websites and, if the offer is made by e-mail, in that e-mail. The information shall also be provided, where applicable, in the general terms and conditions applicable to online sales and service contracts.

3. Paragraphs 1 and 2 of this Article shall be without prejudice to Article 13 of Directive 2013/11/EU and the provisions on consumer information on out-of-court redress procedures contained in other Union legal acts, which shall apply in addition to this Article.

4. The list of ADR entities referred to in Article 20(4) of Directive 2013/11/EU and its updates shall be published in the ODR platform.

5. Member States shall ensure that ADR entities, the centres of the European Consumer Centres Network, the competent authorities defined in Article 18(1) of Directive 2013/11/EU, and, where appropriate, the bodies designated in accordance with Article 14(2) of Directive 2013/11/EU provide an electronic link to the ODR platform.

6. Member States shall encourage consumer associations and business associations to provide an electronic link to the ODR platform.

7. When traders are obliged to provide information in accordance with paragraphs 1 and 2 and with the provisions referred to in paragraph 3, they shall, where possible, provide that information together.

Article 2 - Processing of personal data
‘1. Processing of personal data pursuant to this Directive shall be carried out in accordance with Directive 95/46/EC.
2. Processing of personal data by Union institutions and bodies pursuant to this Directive shall be carried out in accordance with Regulation (EC) No 45/2001.‘

Article 1 - Subject-matter and objectives
‘1. This Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
2. In accordance with this Directive, Member States shall:
(a) protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data‘
Article 4
‘Principles relating to processing of personal data
1. Member States shall provide for personal data to be:
(a) processed lawfully and fairly;
(b) collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;
(c) adequate, relevant and not excessive in relation to the purposes for which they are processed;
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed;
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
2. Processing by the same or another controller for any of the purposes set out in Article 1(1) other than that for which the personal data are collected shall be permitted in so far as:
(a) the controller is authorised to process such personal data for such a purpose in accordance with Union or Member State law; and
(b) processing is necessary and proportionate to that other purpose in accordance with Union or Member State law.
3. Processing by the same or another controller may include archiving in the public interest, scientific, statistical or historical use, for the purposes set out in Article 1(1), subject to appropriate safeguards for the rights and freedoms of data subjects.
4. The controller shall be responsible for, and be able to demonstrate compliance with, paragraphs 1, 2 and 3.‘

Article 57. Penalties:
Member States shall lay down the rules on penalties applicable to infringements of the provisions adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.

Article 13 - Protection of personal data
‘1. Each Member State shall provide that, in respect of all processing of personal data pursuant to this Directive, every passenger shall have the same right to protection of their personal data, rights of access, rectification, erasure and restriction and rights to compensation and judicial redress as laid down in Union and national law and in implementation of Articles 17, 18, 19 and 20 of Framework Decision 2008/977/JHA. Those Articles shall therefore apply.‘

Preamble
(30) The protection of personal data is a fundamental right in accordance with Article 16(1) TFEU and Article 8 of the Charter on Fundamental Rights of the European Union. Therefore, any processing of personal data in the context of the implementation of this Directive should fully comply with the relevant Union law on data protection

Article 5 - Illegal data interference
‘Member States shall take the necessary measures to ensure that deleting, damaging, deteriorating, altering or suppressing computer data on an information system, or rendering such data inaccessible, intentionally and without right, is punishable as a criminal offence, at least for cases which are not minor.‘

Article 6 - Illegal interception
‘Member States shall take the necessary measures to ensure that intercepting, by technical means, non-public transmissions of computer data to, from or within an information system, including electromagnetic emissions from an information system carrying such computer data, intentionally and without right, is punishable as a criminal offence, at least for cases which are not minor.‘

Article 1 - Subject-matter and objectives
‘1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.
2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.
3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.‘

Article 28 - General data protection principles
‘1. Personal data shall be:
(a) processed fairly and lawfully;
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Further processing of personal data for historical, statistical or scientific research purposes shall not be considered incompatible provided that Europol provides appropriate safeguards, in particular to ensure that data are not processed for any other purposes;
(c) adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
(d) accurate and kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
(e) kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed; and
(f) processed in a manner that ensures appropriate security of personal data.‘
Article 31 - Time-limits for the storage and erasure of personal data
‘1. Personal data processed by Europol shall be stored by Europol only for as long as is necessary and proportionate for the purposes for which the data are processed.‘
Article 36 - Right of access for the data subject
‘1. Any data subject shall have the right, at reasonable intervals, to obtain information on whether personal data relating to him or her are processed by Europol.‘