The View from Where I Sit

Tag: consumer protection

  • Storage Limitation vs Purpose Limitation in GDPR

    Under GDPR, the storage limitation principle mandates that personal data should only be retained as long as necessary for its intended purpose, while the purpose limitation principle requires that data be collected for specific, legitimate purposes and not further processed in a way that is incompatible with those purposes.


    Storage Limitation Principle
    The storage limitation principle is outlined in Article 5(1)(e) of the GDPR. It states that personal data must be kept in a form that allows identification of data subjects for no longer than necessary for the purposes for which the data is processed. Here are the key points:


    Retention Periods: Organizations must define and document how long they will retain personal data based on its intended purpose. Once the purpose is fulfilled, the data should be deleted or anonymized.


    Regular Reviews: It is essential to conduct periodic reviews of stored data to ensure compliance with retention policies and to delete any data that is no longer necessary.


    Legal Obligations: In some cases, data may need to be retained for longer periods due to legal obligations, such as tax or accounting laws.


    Purpose Limitation Principle
    The purpose limitation principle, also found in Article 5(1)(b) of the GDPR, requires that personal data be collected for specified, explicit, and legitimate purposes. Key aspects include:


    Specified Purposes: Organizations must clearly define the purposes for which personal data is collected at the time of collection. This helps ensure transparency and accountability.


    Incompatibility of Further Processing: Data collected for one purpose cannot be used for another purpose that is incompatible with the original intent. For example, if data is collected for marketing, it cannot be used for recruitment without a valid legal basis.


    Function Creep Prevention: Organizations should regularly review their data processing activities to prevent “function creep,” where data is used for purposes beyond those originally specified.

    Best Practices for Compliance
    Develop Retention Policies: Organizations should create clear data retention policies that specify how long different types of data will be kept and the conditions for deletion.


    Conduct Data Audits:     Regular audits of data holdings can help identify unnecessary data and ensure compliance with both storage and purpose limitation principles.


    Educate Staff: Training staff on GDPR compliance and the importance of these principles can help mitigate risks associated with data retention and processing.

    By adhering to these principles, organizations can protect individuals’ privacy and ensure compliance with GDPR regulations.

  • The Digital Markets, Competition and Consumers Act 2024

    The Digital Markets, Competition and Consumers Act (DMCC Act) aims to regulate competition in digital markets, enhance consumer rights, and provide the Competition and Markets Authority (CMA) with new enforcement powers.


    Overview of the DMCC Act
    The Digital Markets, Competition and Consumers Act 2024 was enacted to address the unique challenges posed by digital markets, where a small number of companies hold significant market power. The act aims to promote competition, protect consumers, and ensure fair trading practices in the digital economy.


    Key Provisions
    Regulation of Digital Markets:     The act empowers the CMA to designate certain undertakings as having strategic market status. This designation allows the CMA to impose specific conduct requirements on these companies to promote competition and prevent anti-competitive practices.


    Consumer Protection: The DMCC Act enhances consumer rights by addressing unfair commercial practices, including misleading advertising and fake reviews. It imposes duties on businesses to ensure transparency and fairness in their dealings with consumers.


    Enforcement Powers: The CMA has been granted significant new enforcement tools, including the ability to impose monetary penalties of up to 10% of global turnover for non-compliance. This includes streamlined settlement options and new offenses for failing to provide essential information in marketing practices.


    Impact on Businesses: The act applies not only to direct sellers but also to online platforms and any parties involved in promoting or supplying products to consumers. Businesses must ensure compliance with the new regulations, even if they do not sell directly to end users.


    Implications for Consumers and Businesses
    The DMCC Act is expected to foster a more competitive digital marketplace, benefiting consumers through improved choices and protections. For businesses, it necessitates a thorough understanding of the new regulations and compliance requirements to avoid penalties and ensure fair trading practices.

    In summary, the DMCC Act represents a significant step towards regulating digital markets and enhancing consumer rights in the UK, reflecting the government’s commitment to addressing the challenges posed by the digital economy. For more detailed information, you can refer to the official legislation here.
    Legislation.gov.uk

  • Consumer Protection from Unfair Trading Regulations 2008 (CPRs)

    The Consumer Protection from Unfair Trading Regulations 2008 (CPRs) were largely reinstated in the Digital Markets, Competition and Consumers Act (DMCC Act) from 6 April 2025. The CPRs will apply to unfair commercial practices that took place before this date.

    These protection from unfair trading provisions address:

    A general ban on unfair commercial practices
    A ban on misleading and aggressive practices, which are assessed in light of the effect they have, or are likely to have, on the average consumer
    A ban on omitting material information from an ‘invitation to purchase’ (including drip pricing)
    A ‘blacklist’ of commercial practices which will always be unfair and so are banned outright. There are 32 banned practices under the DMCC Act, and one new banned practice is fake reviews.

    https://www.which.co.uk/consumer-rights/regulation/consumer-protection-from-unfair-trading-regulations-2008-asO0C3p6VZQR

    https://www.legislation.gov.uk/uksi/2008/1277/contents