Database

The General Data Protection Regulation (GDPR), entered into force in May 2018, stipulates that "consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement". These requirements are stricter than the previous regime in the sense that pre-ticked boxes or inactivity cannot be considered consent (Recital 32). Furthermore, "consent should cover all processing activities carried out for the same purpose or purposes", and therefore the user has to provide separate consent for separate purposes of processing. In addition, the consent must be withdrawable.

According to the Directive 2002/58/EC, traffic and location data generated by using electronic communications services must be erased or made anonymous when no longer needed for the purpose of the transmission of a communication, except for the data necessary for billing or interconnection payments.

The General Data Protection Regulation prohibits the retention of records containing personal data for a period longer than is necessary for achieving the purposes for which the personal data were collected or subsequently processed.

Under the Data Retention Directive, operators were required to retain certain categories of traffic and location data for a period between six months and two years. In addition, they were required to make the retained data available, on request, to law enforcement authorities for the purposes of investigating, detecting and prosecuting serious crime and terrorism. On 8 April 2014, the Court of Justice of the European Union declared the Directive invalid. However, not all national laws which implemented the Directive have been overturned.

The EU's General Data Protection Regulation (GDPR), entered into force in May 2018, expands considerably the scope of EU privacy rules. In addition to companies established in the EU, the Regulation applies extra-territorially to companies offering goods or services to data subjects in the EU and companies that monitor the behavior of EU citizens (Art. 3).

The Regulation mandates that data is freely allowed to flow outside the European Economic Area (EEA) only in certain circumstances listed in Chapter 5 of the Regulation. The main conditions for such a transfer are the following: the recipient jurisdiction has an adequate level of data protection; the controller adduces adequate safeguards (for instance, by using model contract clauses, binding corporate rules or other contractual arrangements); the data subject has given his/her consent explicitly; or, the transfer is necessary for the performance of a contract between the data subject and the controller.

The GDPR allows for data transfers to countries whose legal regime is deemed by the European Commission to provide for an “adequate” level of personal data protection. Currently, 12 jurisdictions have been deemed adequate: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Jersey, the Isle of Man, Israel, New Zealand, Switzerland and Uruguay. In addition, the EU/US Privacy Shield acts as a self-certification system open to certain US companies for data protection compliance.

There are no specific quotas at the European level for intra-corporate transferees (ICT), but Member States retain the right to set the volumes of admission of intra-corporate transferees who apply to be admitted to their territory.

In the European Union, there is no general principle for the use of copyright protected material comparable to the fair use/fair dealing principles. Directive 2001/29/EC defines an optional, but exhaustive set of limitations from the author´s exclusive rights under the control of the “three-step test”. This is a clause in the Berne Convention that establishes three cumulative conditions to the limitations and exceptions of a copyright holder’s rights. The Directive has been transposed by Member States with significant freedom.

There are several cases of competition policies and other remedies against the use of patents applied at the European level. A full list of measures taken by the European Commission can be found on the European Commission competition webpage.

Among the most relevant decisions and statement of objections (SO) relating to the ICT sectors, there are the following cases:
- In 2012: Decision that Microsoft's refusal to disclose secret interoperability information to its competitors constituted an abuse of a dominant position because the refusal created an unfair competitive advantage for Microsoft;

- In 2012: SO to Samsung for violating Article 102 TFEU by seeking injunctions against Apple in various Member States on the basis of its mobile phone Standard Essential Patents (SEPs);

- In 2013: SO to Motorola Mobility for an abuse of a dominant position by seeking and enforcing an injunction against Apple in Germany on the basis of its mobile-phone SEPs;

- In 2015: SO to Google for alleged abuse of dominant position in the markets for general internet search services in the European Economic Area by systematically favoring its own comparison shopping products in its general search results pages. At the same time, the Commission has formally opened a separate antitrust investigation into Google's conduct as regards the mobile operating system Android.

Patent protection in Europe has traditionally been obtained either through the national patent offices of the Member States or the European Patent Office (EPO) that grants a European patent. Once it is granted and published, however, the patent must first be validated in every State in which the patentee seeks protection.

Therefore, obtaining a European patent can be extremely costly. When protecting important local markets in Europe, the costs can easily exceed 30,000 € (approx. USD 33,000). In case of large patent families, the costs can even rise up to 100,000 € (approx. USD 110,000) and beyond.

Although patent filing costs have decreased in the EU, patent filing and maintenance fees in the EU and its Member States remain significantly higher than in other countries, including the United States. For patent renewal, annual fees have to be paid to national offices which sum up to 5,000-15,000 € each.

The recent creation of a unified system of patent's granting and enforcement in the EU, which has been approved in 2013, is an attempt to resolve the situation. The Unitary Patent (UP) provides a single pan-European patent as a third option for companies or investors seeking patent protection in Europe, ensuring uniform protection in 26 Member States (Croatia and Spain have opted out over language issues, while Italy became a participant in September 2015). The system also includes a litigation system within a Unified Patent Court (Bulgaria, Croatia, Italy, Poland and Spain have opted out).

In 2006, the European Court of Justice (ECJ) held that European patents are national rights that must be enforced nationally and that cross-border injunctions are not allowed. This implies that lawsuits have to be litigated in each relevant national court. As a result, an EU-wide preliminary injunction granted by the Landgericht court in Düsseldorf (Germany), in August 2011, was overturned to a lesser injunction that only applied to the German market. Such injunction barred Samsung from selling Galaxy Tab 10.1 devices on the grounds that it infringed two of Apple's interface patents. Nevertheless, in 2013, a cross-border injunction by a national court in the Netherlands was conditionally approved by the ECJ.

In September 2017, the European Commission issued a proposal to set up a European framework for screening foreign direct investment into the European Union. Such a screening would work on the grounds of security or public order, including transparency obligations, the rule of equal treatment among foreign investment of different origin, and the obligation to ensure adequate redress possibilities with regard to decisions adopted under these review mechanisms. The proposal also includes a framework for screening by the European Commission on the grounds of security or public order for cases in which foreign direct investment in Member States may affect projects or programmes of interest to the EU. This includes projects and programmes in the areas of research (Horizon 2020), space (Galileo), transport (Trans-European Networks for Transport, TEN-T), energy (TEN-E) and telecommunications.

Although the European Union is a signatory to the WTO Government Procurement Agreement (GPA), its coverage schedules do not include "telecommunications related services" (CPC 754), which is an important services sector for digital trade.

There are currently no explicit provisions in EU Directives which exclude the participation of suppliers from third countries in the EU procurement market. There are only two specific cases where the EU public procurement market can be closed to foreign bidders from third countries: the Defence Directive (not relevant for digital goods) and the Utilities Directive.

The Utilities Directive (2004/17/EC) contains provisions allowing contracting public entities to reject from its tender procedures foreign goods not covered by any EU international commitments. Additionally, in cases of equivalent offers, the provisions provide for a preference for European tenders and tenders covered by EU's international obligations.

In those cases, a tender submitted for the award of a supply contract may be rejected where the proportion of the products originating in third countries exceeds 50% of the total value of the products constituting the tender. In practice, this possibility has rarely been used.

In March 2018, a "digital services tax" (DST) was proposed, which would see a 3% rate be applied to digital services companies firms operating in the EU with annual global revenues of €750 million or more, as well as total taxable revenues of 50 million Euros generated across the bloc. The threshold is set to capture some 150 companies, half of which are based in the United States, while a third could be EU firms.

This framework could result in double-taxation of these companies as usually corporate taxes are only paid where the company is incorporated.

The European Regulation No. 1042/2013 amending the Council Implementing Regulation No. 282/2011, declares that from January 2015, all supplies of telecommunications, broadcasting and electronic services will be taxable at the place where the customer belongs. These include, inter alia:
- images or text, such as photos, screensavers, e-books and other digitised documents e.g. PDF files;
- music, films and games, including games of chance and gambling games, and of programmes on demand;
- online magazines website supply or web hosting services distance maintenance of programmes and equipment;
- supplies of software and software updates advertising space on a website.

Both EU and non-EU suppliers have to register for VAT purposes and comply with the relevant obligations of the Member State where the customer is established, has his/her permanent address or usually resides. This may be burdensome as there are 81 VAT rates across the 28 EU countries and the rates may vary between 3% (Luxembourg) to 27% (Hungary) across member states. Furthermore, member states impose varying thresholds at which companies must begin paying VAT, ranging from EUR 0 to EUR 60,000.

As an alternative to obtaining multiple VAT registrations in each Member State where a supplier has a customer, affected suppliers may be able to opt to account for VAT across the EU via a a web-portal in the Member State in which they are identified. Hence, the system, known as the Mini One-Stop Shop (MOSS) scheme, allows taxable persons to avoid registering in each Member State of consumption.