Legal briefing | 26 Mar 2021 |

Consumer law: CMA takes software provider to court

Updated June 2021

The UK Competition and Markets Authority (CMA) is taking anti-virus software provider Norton to court over the latter's alleged failure to provide information to assist with an investigation. This is the first time the CMA has taken such action in connection with a consumer protection inquiry – but as we explain below, it is part of a wider pattern of the regulator requiring more information from business and taking a tougher line over conduct during investigations that it regards as inappropriate.

What is the investigation about?

The CMA has been investigating the anti-virus software sector since late 2018 over concerns that the practice of automatically renewing subscriptions is unfair and in breach of UK consumer law. Norton is one of the leading providers of such software. The investigation remains ongoing.

WHY HAS THE CMA TAKEN NORTON TO COURT?

Under the Consumer Rights Act 2015, the CMA has power to require the provision of information for a variety of purposes, including ascertaining whether there has been a breach of consumer legislation. It appears that Norton has refused to provide certain information requested by the CMA for the purposes of its current investigation into anti-virus software. This included "research… on how customers responded to website information on auto-renewal and pricing". The CMA will be asking the court to order Norton to disclose the information. If the court does so and Norton fails to comply, it could potentially be fined (although only if the CMA brings further proceedings for contempt of court).

Why is the information important?

There are a number of reasons why the CMA may want to see the information it has requested from Norton. Firstly, it is known to be concerned that auto-renewal leads to consumers signing up for a year, but then being effectively tied into a contract for a much longer period because it rolls over automatically into the following year (and at the same time, consumers may potentially have to accept price increases without the opportunity to shop around for cheaper products elsewhere). The research may provide evidence indicating that, depending how it is presented, consumers are less likely to respond to certain types of renewal notification than others. Secondly, the research could be important in establishing how far Norton itself was aware of consumers' likely reaction i.e. it could inform the CMA's view as to whether any alleged breaches of consumer protection law were intentional (which may in turn affect its view of the seriousness of any such breaches and its decision as to appropriate remedies/recommendations).

IS IT NORMAL FOR THE CMA TO REQUEST THIS TYPE OF INFORMATION?

In our experience, businesses are sometimes surprised at the nature and extent of information that the CMA requests in connection with its investigations. For example, in relation to merger control investigations, it is common practice for it to request internal documents such as studies, reports and presentations. Indeed, in recent years, the CMA has made it clear that it expects merging parties to carry out quite extensive electronic searches to ensure that all documents within the scope of its information request have been provided – and it has imposed fines on businesses which failed to do so (as in the case of the £20,000 fine imposed on Hungryhouse Holdings Ltd in 2017). In relation to consumer protection inquiries, information requests have often been somewhat less onerous, although this varies depending on the nature of the investigation. Given its approach to merger control, it would not be surprising if the CMA is now using its powers to require provision of more information than has typically been the case in the past.

Key points for business

Businesses should be aware that the CMA has extensive information-gathering powers and is increasingly prepared to use them – including in relation to investigations under consumer protection law.
The CMA has also been taking an increasingly tough line in relation to businesses which it perceives as having acted inappropriately in the course of its investigations. This is evident not only in its decision to take Norton to court and the £20,000 fine on Hungryhouse noted above, but also the £100,000 fine that it imposed on Electro Rent in 2018 (over failure to comply with the requirements of an interim enforcement order in the course of a merger control investigation) and a number of cases since then.
Finally, the CMA has asked the Government to legislate to give it stronger enforcement powers in relation to consumer protection law (and the Government has indicated that it is broadly sympathetic, although it has yet to table any proposals for reform). For example, in relation to merger control, the CMA itself can impose penalties for failure to provide information - whereas in relation to consumer law it has no powers at all to impose fines (its only option in relation to a refusal to provide information in a consumer law investigation is to go to court, as it has done here).

UPDATE: In June 2021, the CMA announced that it had withdrawn its legal action against Norton following the latter's decision to change its approach to auto-renewal. Whilst this reflects the CMA's long-held preference for negotiated outcomes in consumer law cases, the fact that the CMA threatened court action in this case indicates that it is increasingly prepared to use the statutory powers at its disposal to bring pressure to bear on business.