rec_48

(48) Regulation (EU) 2016/679 or any other Union law on data protection should fully apply to the processing of personal data in connection with any contract falling within the scope of this Directive. In addition, this Directive should be without prejudice to the rights, obligations and non-contractual remedies provided for by Regulation (EU) 2016/679. Facts leading to a lack of compliance with requirements provided for by Regulation (EU) 2016/679, including core principles such as the requirements for data minimisation, data protection by design and data protection by default, may, depending on the circumstances of the case, also be considered to constitute a lack of conformity of the digital content or digital service with subjective or objective requirements for conformity provided for in this Directive. One example could be where a trader explicitly assumes an obligation in the contract, or the contract can be interpreted in that way, which is also linked to the trader's obligations under Regulation (EU) 2016/679. In that case, such a contractual commitment can become part of the subjective requirements for conformity. A second example could be where non-compliance with the obligations under Regulation (EU) 2016/679 could, at the same time render the digital content or digital service unfit for its intended purpose and, therefore, constitute a lack of conformity with the objective requirement for conformity which requires the digital content or digital service to be fit for the purposes for which digital content or digital services of the same type would be normally used. This would be the case, for example, if the trader of data encryption software fails to implement appropriate measures as required by Regulation (EU) 2016/679 to ensure that by design personal data are not disclosed to unauthorised recipients, thus rendering the encryption software unfit for its intended purpose which is the secure transferring of data by the consumer to their intended recipient. Finally, there could be cases where the trader's non-compliance with its obligations under Regulation (EU) 2016/679 can also constitute a lack of conformity of the digital content or digital service with the objective requirement for conformity which requires the digital content or digital service to possess the features which are normal for digital content or digital services of the same type and which the consumer can reasonably expect. For instance, if the trader of an online shopping application fails to take the measures provided for in Regulation (EU) 2016/679 for the security of processing of the consumer's personal data and as a result the consumer's credit card information is exposed to malware or spyware, that failure could also constitute a lack of conformity of the digital content or digital service within the meaning of this Directive, as the consumer would reasonably expect that an application of this type would normally possess features preventing the disclosure of payment details. Where the facts leading to non-compliance with requirements under Regulation (EU) 2016/679 also constitute a lack of conformity of the digital content or digital service with subjective or objective requirements for conformity as provided for in this Directive, the consumer should be entitled to the remedies for the lack of conformity provided for by this Directive, unless the contract is already void or voidable under national law.

← rec_47 · All articles · rec_49 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-25 · Text as adopted (Official Journal); later amendments are not incorporated in this text.