Consumer protection rules: what are your enforcement risks?

This article was produced by Olswang LLP, which joined with CMS on 1 May 2017.

Businesses selling to UK consumers need to comply with a raft of consumer protection provisions, including rules on implied terms and remedies, unfair terms and distance selling. The government has also recently proposed giving regulators powers to impose monetary fines on businesses which do not comply. But what are the current sanctions if you breach these rules, and what is the likelihood of enforcement?

In this article we take a look at the UK’s main consumer regulator, the CMA, including:

• its consumer functions and enforcement powers;
• its work with other enforcement bodies and when it is likely to take action itself; and
• its current investigations (including cloud services and online review services) and its future plans.

Since inheriting theses powers from the OFT in April 2014, the CMA has taken a proactive approach to consumer enforcement, shifting its attention most recently to emerging trends in the e-commerce sector. Therefore, it is more important than ever for businesses to make sure that their consumer-facing terms and conditions are compliant with the law.

What is the CMA’s consumer role and what consumer legislation does the CMA enforce?

The CMA’s role is to tackle market wide-practices which breach consumer law as well as educating businesses in relation to the application of consumer legislation. There are numerous pieces of legislation which currently serve to protect the rights and interests of the consumer, most notably:

• Consumer Rights Act 2015 (CRA 2015): this covers implied terms and remedies for goods, services and digital content and rules on unfair terms;
• Consumer Protection From Unfair Trading Regulations 2008 (CPRs): these provide protection against misleading practices which are likely to distort consumers’ decisions regarding their purchases; and
• Consumer Contracts Regulations 2013 (CCRs): these provide protection for consumers when they enter into distance (e.g. online, telephone) contracts for goods, services or digital content.

What powers does the CMA have?

The CMA has a range of formal investigatory and enforcement powers, detailed below. It is important to note that in practice, informal action by a regulator (negotiations over allegedly non-compliant ts & cs and practices which the business agrees to amend, typically followed by a naming and shaming press release by the regulator) can also be damaging to a brand's reputation.

Investigatory Powers

The CMA usually first issues a call for information or invites the public to comment in order gather more information in relation to a potential breach of consumer law. Once such information has been collated and assessed, the CMA will issue a report on whether or not it intends to commence a full investigation. It may then use its generic investigatory powers, introduced by the CRA 2015, to investigate breaches of consumer law and compel businesses to cooperate and provide certain information. These include the power to:

• require information;
• purchase products (i.e. test purchases);
• observe the carrying on of a business; and
• enter premises without a warrant (for routine inspections).

Once the CMA has concluded its investigations, it may opt to take enforcement action against one or a number of businesses.

Enforcement Powers

In order to enforce the law on unfair contract terms under the CRA 2015, the CMA may apply to the court for an injunction to prevent use of unfair terms or accept undertakings from a business to desist from using certain terms.

In addition to these, the CMA retains a number of enforcement powers held by its predecessor, the OFT, contained in Part 8 of the Enterprise Act 2002 (EA02). This gives the CMA separate powers against traders who breach consumer legislation generally (including the CRA).

Enforcement action can be taken by the CMA against:

• Community infringements: a breach of laws by a business which harms or is likely to harm the collective interest of consumers under certain EU Directives/Regulations; and
• domestic infringements: a breach of UK laws by a business that harms the collective interests of UK consumers.

This may be done in a variety of ways:

• Enforcement Orders: the CMA can apply to the civil courts requiring an offending trader to stop (or not to start) committing a particular breach.
• Undertakings: instead of an enforcement order, the CMA may accept an undertaking from the business that they will not engage in infringing conduct.
• Enhanced Consumer Measurers (ECMs): the CRA has amended the EA02 to provide more flexibility to enforcing consumer law. The CMA is now able to propose measures aimed at achieve one or more of the following:
  • redress measurers: are aimed at achieving redress for customers who have suffered loss as a result of consumer law breaches;
  • compliance measurers: are intended to prevent to reduce the risk of repeat conduct; and
  • consumer information measures: are intended to give more information about offending trader’s record of consumer compliance so that consumers can choose more effectively between different traders.

What other enforcement bodies can bring action?

As with competition law, the CMA enforces consumer law alongside a group of partner organisations, known collectively as the Consumer Protection Partnership (CPP), which include the Department for Business, Innovation and Skills, local authority Trading Standards Services (TSS), the Trading Standards Institute, the Citizens Advice Bureau and the Consumer Counsel for Northern Ireland. The CMA also works alongside sector regulators, such as the FCA, Ofcom, Ofgem and the ICO, who also have powers to enforce some consumer legislation, through Memoranda of Understanding.

The aim of the CCP and these Memoranda of Understanding is to coordinate enforcement and prevent the duplication of efforts. The CMA shares the vast majority of its consumer protection powers with TSS, with which it works very closely. TSS has in recent years been given more responsibility, including national and cross-local authority boundary enforcement authorities, so it may sometimes be more appropriate to take on a particular case instead of the CMA.

So, when is the CMA likely to take enforcement action?

The CMA will make strategic choices about what cases it involves itself in according to a set of prioritisation principles and will only usually do so if it believes it can secure wide-ranging changes to markets and tackle significant customer detriment. For example, it is very unlikely to take a case against a single company, even when the company is a large national corporation and the case requires significant resources.

Enforcement action by the CMA is likely to be appropriate where:

• it determines that breaches of law indicated systemic failures in a market, whether in a particular sector or geographical area;
• changing the behaviour of one business would set a precedent or have other market-wide implications;
• such action can be expected to have wider implications, such as a development in the law; or
• there is a strong need for deterrence or to secure compensation for consumers.

What areas and business models is the CMA currently investigating?

The CMA is currently conducting are a number of consumer investigations targeting emerging trends in the e-commerce sector, for example:

Potential fake online reviews

The CMA announced on 8 December 2014 that it had opened a full investigation into online review sites following a report outlining number of concerning practises in the sector which may potentially breach consumer legislation, namely:

• businesses writing or commissioning fake positive reviews about themselves;
• business or individuals writing or commissioning fake negative reviews about their rivals;
• review sites ‘cherry-picking’ positive reviews; and
• review sites’ moderation processes potentially causing some negative reviews not to be published.

Since then, the CMA has named and shamed marketing company SEO & Marketing Ltd, which it found had written over 800 fake positive reviews for 86 small businesses and has announced that the company has since given undertakings to cease the practice.

Alongside the ongoing investigation, the CMA has also published guidance on how to comply with consumer protection law in relation to online reviews.

Cloud storage: consumer compliance review

On 1 December 2015, the CMA launched a review of compliance with consumer law in relation to the price and service changes for cloud storage. Areas of interest include significant price increases and reductions after contracts had been agreed and the loss or deletion of consumers’ data.

We currently await the outcome of the CMA’s public consultation, which closed on 15 January 2016.

For more information on these projects and to view all ongoing CMA consumer enforcement investigations, please visit the CMA’s website.

What is the CMA’s plan with regard to consumer enforcement in the future?

In its draft annual plan for 2016/17, the CMA has said that it will continue to enforce actions against business so that they are fully aware of the implications of their own behaviour, targeting sectors where compliance seems to be especially poor. Similarly it also intends to raise awareness amongst consumers of the legal rights and capability to make complaints.

During 2016/17 the CMA aims to launch as many consumer cases or projects as possible where it has the requisite evidence, setting a minimum target of three, and aims to conclude the majority of its cases, whether by agreement or proceeding litigation, within 18 months of being publicly opened.

As to what these projects will be, the CMA has said it plans concentrate on projects concerning the commercial use of consumer data, continuing work in relation to online reviews and possibly opening new projects to investigate price comparison websites.

If you would like to speak to anyone in relation to any of the issues in this article, or other aspects of consumer law, please contact Olswang Senior Associate Anna Soilleux.