§5.4 Consequences of the withdrawal concerning the data

Article 13 of the CRD sets out the obligations of the trader in the event of withdrawal. Directive (EU) 2019/2161 amended that Article by introducing provisions on consequences of the right of withdrawal regarding the handling of data. Article 13 4. In respect of personal data of the consumer, the trader shall comply with the obligations applicable under Regulation (EU) 2016/679. 5. The trader shall refrain from using any content, other than personal data, which was provided or created by the consumer when using the digital content or digital service supplied by the trader, except where such content: (a) has no utility outside the context of the digital content or digital service supplied by the trader; (b) only relates to the consumer’s activity when using the digital content or digital service supplied by the trader; (c) has been aggregated with other data by the trader and cannot be disaggregated or only with disproportionate efforts; or (d) has been generated jointly by the consumer and others, and other consumers are able to continue to make use of the content. 6. Except in the situations referred to in point (a), (b) or (c) of paragraph 5, the trader shall, at the request of the consumer, make available to the consumer any content, other than personal data, which was provided or created by the consumer when using the digital content or digital service supplied by the trader. 7. The consumer shall be entitled to retrieve that digital content free of charge, without hindrance from the trader, within a reasonable time and in a commonly used and machine-readable format.[…] These provisions are identical to Article 16(2)–(4) of the Digital Content Directive (‘DCD’). They both address consequences of the contract termination – the CRD addresses the termination of the contract under the right of withdrawal whilst the DCD addresses the termination of the contract due to the lack of conformity. The General Data Protection Regulation (GDPR) regulates the consequences of the termination of the contract as regards personal data. The new provisions of Article 13 of the CRD (and Article 16 of the DCD) address the data that the consumer uploaded or generated through the use of the digital service and which are not personal data. In particular, according to Article 13(6) of the CRD, in response to the consumer’s request, the trader has an obligation to provide the data in machine-readable format that is commonly used at the time the contract is terminated following the exercise of the right of withdrawal. If consumers exercise their right of withdrawal under the CRD (or the contract termination remedy under the DCD), it is a matter of the GDPR to assess whether the withdrawal from the contract also constitutes the withdrawal of legal basis for the processing of personal data. In many situations, it is very likely that the declaration of the consumer to exercise the right of withdrawal and to terminate the contract can be interpreted as including a withdrawal of the legal basis, including withdrawal of consent to other processing of personal data that was not necessary for the performance of the contract in the meaning of the GDPR. In this situation, the trader/controller has to assess if there is still a valid legal basis for such other processing of those personal data such as, for example, compliance with a legal obligation. In the absence of a valid legal basis, the processing should be discontinued. In addition, Directive (EU) 2019/2161 added to the CRD specific rules on the trader’s rights and consumer’s obligations in the case of withdrawal. These provisions in Articles 13(8) and 14(2a) are identical to Articles 16(5) and 17(1) of the DCD. Article 13 8. In the event of withdrawal from the contract, the trader may prevent any further use of the digital content or digital service by the consumer, in particular by making the digital content or digital service inaccessible to the consumer or disabling the user account of the consumer, without prejudice to paragraph 6. Article 14 2a. In the event of withdrawal from the contract, the consumer shall refrain from using the digital content or digital service and from making it available to third parties.

← 5.3 · All articles · 5.5 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-07