Why does the EU place the requirements with regard to goods on the retailer, not the manufacturer or importer? Short (skippable) intro: I was reading the question about software updates, started searching, and came across EU Directive 2019/771, in particular Article 7, Point 3. In the case of goods with digital elements, the seller shall ensure that the consumer is informed of and supplied with updates, including security updates, that are necessary to keep those goods in conformity, for the period of time: (a) that the consumer may reasonably expect given the type and purpose of the goods and the digital elements, and taking into account the circumstances and nature of the contract, where the sales contract provides for a single act of supply of the digital content or digital service; or (b) indicated in Article 10(2) or (5), as applicable, where the sales contract provides for a continuous supply of the digital content or digital service over a period of time. That seems to place the odium of providing software updates on the retailer. Warranty requirements are also placed on the seller. It seems that generally in EU consumer protection laws the responsibility always falls on the seller. Not on the importer or the manufacturer. Why is that? Is it just so that it's easier to enforce? Manufacturers (especially for electronic goods) are often foreign entities, which may not have local representation, so it seems reasonable. Importers? Is it because of the missing chain of custody? Because a given retailer may source the same item in multiple places? Is there anything more to it?
Because they are consumer protection laws The purpose of the laws is to protect the consumer and the consumer’s relationship is with the retailer. Therefore the laws make the retailer responsible for dealing with the consumer’s problem. The retailer profited from the deal so why shouldn’t they be held responsible for sourcing only from reputable manufacturers/importers?
Companies that operate worldwide have to comply with the law everywhere they operate. Some jurisdictions consider mandatory arbitration in standard-form consumer contracts to be unenforceable - providing the out may overcome this.
As always, it depends. However, it is by no means certain that any public facing hobby project, such as a web app, is exempt from having to comply with the GDPR. Since the GDPR is only a few days old, we have of course no case law based upon the GDPR itself yet. However, when considering this, one should take the following two facts into consideration. 1. The "personal use exeption" in the GDPR is not new. The personal use exemption is unchanged from the article 3(2) of Directive 95/46/EC. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.) 2. Case-law under the previous regulation restricts the scope of the exception The ECJ has ruled on the scope of the personal use exception in two cases: C-101/01 C-212/13 In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals. In C-101/01 it can be argued that the hobby project as a blogger was connected to the controllers professional activity (she was a catechist in a local church, and blogged about her work. including her colleagues). But in C-212/13, there no such connection to professional or commercial activity. Here, the controller operated a CCTV to protect his home, but set it up to also capture public space, and that was enough for the ECJ to decide that the personal use exception did not apply. Discussion Case-law based upon Directive 95/46/EC is in no way binding for a future court that need to rule based upon the GDPR. We need to wait for case-law decided under the GDPR to be able to have some degree of certainty about the scope of the "private use exception" under GDPR. However, given what we know about how the ECJ has ruled in these cases in the past, I think it is hazardous to think that just because what you are doing on the web is just a "hobby project" not connected to professional or commercial activity, you are exempt from complying with the GDPR. Conclusion IMHO, you may be exempt, or you may not be exempt. I think it really depends on your activity in your hobby project, and to what extent this project processes the personal data of other people than yourself.
However, if a website is based in the US and the terms of service say that the law governing the terms is US law, how can GDPR have any affect? It is unlikely that the EU will be able to enforce financial penalties against a company with no presence in the EU. But they could for example block your website in the EU, depriving you of your EU user base. The actual measures that they could or would take against such a company are still unclear, since the GDPR is quite new, and there has been no action under the GDPR against foreign companies. I'm not a lawyer, but I've signed many contracts in my life and nearly all of them have some form of "governing law" clause. The governing law clause in a contract identifies the law that will be used to interpret the contract and to resolve any disputes arising from the contract. The law identified in the clause does not become the sole law governing every aspect of the relationship between the parties, however. For example, a business in New Jersey could have a contract with a client in New York with a clause specifying New Jersey law as the governing law of the contract. But that does not mean that New York's consumer protection law doesn't apply to the transaction.
Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR? Only if they offer goods/services to or monitor behavior of people in the EU (Art. 3(2)). Note that: having a commerce-oriented website that is accessible to EU residents does not by itself constitute offering goods or services in the EU. Rather, a business must show intent to draw EU customers, for example, by using a local language or currency. If it is then how (and by whom) would compliance be audited and/or enforced? Supervisory Authorities will care of it.
For paper contracts there are even statutory &quot;prominence&quot; requirements, generally applicable to &quot;disclaimers&quot;: see this Q&amp;A (using local talent), based on UCC §2-316. In a given jurisdiction there will be various contexts where a disclaimer must be made prominently such as in Washington this one regulating life insurance contracts that there must be a &quot;prominent statement that the contract does not provide cash surrender values if such is the case&quot;. &quot;Onerous contract&quot; is taken to be an accounting term about costing too much to comply, and I assume (from recent context) that you don't mean that specialized usage. This article goes through US law in terms of website agreements, which are one kind of &quot;fine print&quot;: the points here apply to paper contracts as well. If the terms are not physically in &quot;the agreement&quot;, they they must be incorporated by reference, thus &quot;some reference must be in the contract that the customer actually sees it&quot;, see E.J. Rogers, Inc. v. UPS, 338 F. Supp. 2d 935. Various cases address the amount of notice required (Manasher v. NECC: must &quot;indicate a clear intent that the provisions would be considered part of the agreement&quot;). International Star Registry of Illinois v. Omnipoint Marketing clearly established that a signed paper contract can refer to online terms (url provided, a &quot;have read and agree...&quot; statement above the physical signature). For clickwrap contracts, see Hugger-Mugger, L.L.C. v. NetSuite – clicking agree means that you are held to have read and understood the terms, as long as the terms meet the standard for incorporation by reference. The central requirement of notice is that there has to be a clear indication that the external document is incorporated into the contract, and the party must be clearly told where that document is. While a seller / service-provider can change the terms of a contract, those changes do not automatically apply to an existing party to an earlier version – Douglas v. US District Court, 495 F.3d 1062 and references therein – unless the customer is actively notified of a change in terms. As far as I know, there is no case law establishing a computational specification of what it means to &quot;notify&quot; a customer of incorporated terms. There are plenty of terrible web pages where links go nowhere (can fine print be in invisible ink?). One might assume that a diligent customer would trace all of the relevant documents to see what they agreed to if they are told that they must agree to these non-existent terms. One might also assume that since there is nothing there, agreeing to a null document adds nothing to the contract, and the vendor bears the responsibility for making the terms actually findable, though they bear no responsibility for making sure the customer looked.
Under the GDPR, consent is not the only legal basis that allows processing of your personal data. Other legal bases such as legitimate interest exist as well. So the question is: does the company have a legitimate interest to send you these emails? The answer is that this case is more about direct marketing, less about personal data. The circumstances under which direct marketing emails can be sent are covered by the ePrivacy directive, which is implemented in the UK via PECR (Privacy and Electronic Communications (EC Directive) Regulations 2003). PECR and ePrivacy introduce a concept known as soft opt-in: where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message in case the customer has not initially refused such use. (ePrivacy Directive, Art 13(2)) In plain language, they are allowed to send unsolicited marketing emails to existing customers, under the following restrictions: this only applies to customer relationships the marketing must be for similar products or services you must be able to object to further messages, i.e. unsubscribe upon collection of contact details you were given the opportunity to opt out
It is not possible for someone to forfeit their rights because the GDPR is compulsory law. In the EU, laws can be regulatory or compulsory. In case of an agreement, regulatory laws can be set aside, if both parties agree on that. But compulsory laws cannot be set aside. Of course laws can also be partly compulsory. For example provisions which cannot be changed in disadvantage of a consumer. So there is freedom of contract, but it's freedom is reduced by law for the common good or for example to avoid misuse of bargaining power. In particular consumer related laws are often compulsory because it has little power against the other parties. Companies can have their negotiations done by lawyers, so they can make a well informed an well negotiated decision. As an extreme example, you cannot kill someone, even if that person has given you written permission. See also "Peremptory norm" on wikipedia for international law examples.