• by Ray Schultz , March 23, 2018

As if the General Data Protection Regulation (GDPR) weren’t enough to worry about, big-tech companies like Gmail and Facebook may face new legal exposure in the European Union.

The EU wants to extend its consumer laws to “free digital services for which consumers provide personal data, instead of paying with money, such as: cloud storage, social media and email accounts,” it says in a draft directive. 

Reuters reports that the draft, an update of a directive proposed last year, is being considered “in the wake of an outcry over Facebook’s handling of data.” It is due to be presented next month.

Among other things, the draft would give consumers the right to cancel contracts with such high-tech services.

As with the GDPR, possible penalties could include 4% of annual turnover.

In the draft, the EU states: "Given the increasing economic value of personal data, these services are not simply 'free.' Hence, consumers should have the same right to pre-contractual information and to cancel the contract within a 14-day right of withdrawal period, regardless of whether they pay for the service with money or whether they provide personal data."

In general, the directive seeks to standardize laws and penalties, promising a "New Deal For Consumers." It would require: 

• More effective, proportionate and dissuasive penalties for widespread cross-border infringements.
• Right to individual remedies for consumers. This would include “the right to damages when there is no contract concluded.”
• More transparency for consumers in online marketplaces. 
• Extending protection of consumers in respect of digital services.
• Removing burdens for business. This would grant traders “more flexibility in choosing the most appropriate means of communication with consumers using new means of online communication, such as web forms or chats instead of traditional email as long as the consumer can keep track of the communication,” it states.

In another recent development, the European Court of Justice, the EU’s Union’s highest court, was asked to determine whether Gmail is a telecommunications company and should be regulated as such.

GDPR, which requires that consumers give express consent for all use of their personal data, takes effect on May 25.