UK consumer protection law: new Bill will give regulator serious clout

The Digital Markets, Competition and Consumer Bill has finally been put before the UK Parliament and is likely to become law in 2024.

It will give the Competition and Markets Authority (CMA) very significant new powers to enforce UK consumer protection law, including the ability to impose fines of up to 10% of global annual turnover (which is higher than many jurisdictions, including the EU) and to sanction enhanced consumer measures, such as redress schemes. The Bill also promises to tighten up the law on subscriptions and fake reviews - but in our view, the real game changer for B2C businesses is the new enforcement regime.

Now Reading

What are the new enforcement powers?

The CMA will be able to decide for itself whether consumer law has been infringed, without the need to go to court (as at present). Where it concludes that there has been a breach, it will be able to impose fines of up to 10% of global annual turnover on businesses; in the sphere of competition law (where an equivalent regime has been in place for some time), this has resulted in the imposition of fines by the CMA as high as £260 million. Examples of the type of conduct which could be penalised in this way might include:

Deliberately misleading consumers about products or services; had the powers been available at the time of the diesel emissions scandal, it's quite possible that fines could have been imposed on vehicle manufacturers for breach of consumer legislation prohibiting unfair commercial practices (indeed, greenwashing is known to be high on the CMA's agenda).
Reliance on unfair terms, such as terms requiring consumers to pay excessive amounts to cancel subscription contracts; the CMA's predecessor, the Office of Fair Trading, successfully took a gym operator to court over this issue but at the time, the only available remedy was a declaration that the terms were unenforceable and an order preventing their use in future.

Additional fining powers for the CMA

As well as fining businesses for breach of consumer protection law, the CMA will also be able to penalise businesses directly (again, without having to go to court) for:

in the context of a CMA investigation, failure to comply with information requests, provision of false or misleading information and/or concealment, falsification or destruction of evidence; and
breach of an undertaking given to the CMA (historically, voluntary undertakings have often been used to terminate CMA consumer investigations, but there has not been any meaningful sanction for failure to comply).

The fines in these cases will normally consist of a fixed monetary penalty together with a daily penalty while non-compliance continues. The CMA has similar powers in relation to competition law and merger control, where fines of this type can be substantial – for example, in 2018, a leasing business was fined £100,000 for failure to comply with interim orders issued by the CMA and in 2021, Meta (formerly Facebook) was fined £50.5 million. The CMA has previously expressed concern about businesses failing to comply with information requests in consumer protection investigations – as shown by its decision to take court action against Norton Antivirus (later dropped).

Enhanced consumer measures

As well as fines, the Bill will allow the CMA to impose "enhanced consumer measures" in response to breaches of consumer protection law. These could involve requirements for businesses to compensate consumers for harm suffered as a result of infringements or to allow consumers to terminate contracts early. In some cases, such measures could have a financial impact that is as great, if not greater, than fines. By way of analogy, in the financial services sector, redress schemes designed to compensate consumers for payment protection insurance policies which were mis-sold had, by April 2021, resulted in pay-outs totalling over £38 billion (whereas, by comparison, the total fines imposed by the Financial Conduct Authority against firms in breach, though significant, were well below this level).

What about regulated sectors such as financial services or utilities?

Sectoral regulators such as the Financial Conduct Authority (financial services), OFGEM (energy) Ofcom (communications) and OFWAT (water) will not get the same enhanced powers as the CMA to enforce consumer protection law. However, in practice, many of these regulators tend to use their extensive existing sector-specific powers (rather than general consumer protection law) to protect consumers (for example, the FCA has, for a number of years, supervised firms against a set of "treating customers fairly" rules and standards and, as from this summer, a new consumer duty will be introduced which will enhance the protections afforded to retail consumers and provide the regulator with additional grounds for supervision and enforcement). As a result, it is not expected that the CMA's new powers will have a major impact on these sectors.

Will the new consumer enforcement regime catch non-UK businesses?

The Bill makes clear that the CMA can act against businesses whose activities are "directed to consumers in the United Kingdom" – which is likely to include businesses based outside the UK. However, whilst there would be nothing to stop the CMA taking an infringement decision against such a business, enforcing it in practice might well prove more difficult. In recognition of the difficulties of this, particularly in the online sphere, the Bill enables the CMA to issue "online interface notices"; for example, it might decide to issue such a notice to a UK web platform on which the relevant non-UK business was a seller, requiring the platform to take action to prevent infringing activity.

What else does the Bill do?

From a consumer protection perspective, the Bill also contains the following measures which the UK Government views as being important in a modern digital economy:

Subscription contracts: businesses will be required to provide more information to consumers before entering into the contract, to send reminders before a contract "rolls over" into a new term (auto-renewal) and to allow "cooling off" periods.
Fake reviews: the Bill contains powers allowing the Government to expand the list of banned practices which are regarded as automatically unfair (see Section 3 of this briefing for more detail). This would allow it to ban activities such as paying for fake reviews. However, it appears that further consultation will be needed (in particular, the suggestion that web platform providers should be obliged to take reasonable steps to check that reviews are genuine may prove controversial).

Consumer savings schemes

The Bill will also require businesses offering consumer savings schemes (such as Christmas Savings Clubs) to take measures to ensure that consumers' deposits are protected in the event of the trader's insolvency. This follows the Government's commitment to implement some of the recommendations of a 2016 Law Commission report.

Replacement of unfair commercial practices legislation

The two most wide-ranging pieces of UK consumer protection legislation are the Consumer Rights Act 2015, which sets out the law on unfair contract terms, and the Consumer Protection from Unfair Trading Regulations 2008 (CPRs), which set out the law on unfair commercial practices (such as misleading promotions). Whilst the Bill leaves the 2015 Act in place, it will revoke and replace the CPRs. However, whilst there are some changes of substance, this is unlikely to amount to a major reworking of the law in this area.

Other measures: "Big Tech", competition law and merger control

Looking beyond consumer protection, the Bill also contains measures designed to allow the CMA to intervene in the tech sector with a view to promoting competition, along with a raft of changes designed to streamline and improve the effectiveness of the existing competition law and merger control regimes. For more detail, see this briefing.

It will be interesting to see how far the CMA looks to use its greatly enhanced powers to enforce consumer protection law in conjunction with other measures set out in the Bill, notably its new powers to intervene in digital markets and its strengthened powers to carry out competition investigations and market inquiries.

Why is the change to the enforcement regime so significant?

As explained in this briefing, the existing framework for enforcement of consumer protection law has sometimes left the CMA in a relatively weak position, mainly because it has to go to court in order to compel a business to do anything and the remedies are primarily forward-looking (the scope to penalise businesses for past breaches is extremely limited). Although in practice, many businesses responded to CMA investigations by giving voluntary undertakings to change their behaviour in future, these currently are not directly enforceable by fines or other regulatory sanctions – so if a business fails to comply with those undertakings in future, the CMA's only option is to go to court.

Giving the CMA power to make infringement decisions directly and impose fines significantly raises the stakes for B2C businesses which find themselves under investigation for alleged breaches of consumer law. Previously, CMA consumer investigations have tended to be perceived as reputationally damaging but with few other risks attached, in large part because the CMA had no ability to sanction past behaviour. Once the Bill is in force, however, B2C businesses will need to factor in the risks of being penalised for engaging in conduct which the CMA regards as a breach of consumer law and in some cases being ordered to take additional redress measures, such as compensating consumers. The Bill will also tackle the weakness of the current voluntary undertakings regime by making future undertakings directly enforceable by the CMA.

What protections are there against the CMA abusing its new powers?

The Bill contains a variety of safeguards against the CMA "going too far"; for example, enhanced consumer measures are required to be "proportionate", which is likely to require the CMA to undertake an assessment of their likely cost. The CMA will also have to follow a fair procedure in the run-up to issuing any infringement decision, giving the relevant business an opportunity to respond to the case against it (this is likely to be set out in secondary legislation). Once it has taken an infringement decision, businesses will be able to appeal (to the High Court in England and Wales or Northern Ireland or the Court of Session in Scotland). A recent case involving alleged breaches of consumer law by a care homes provider suggests that the High Court is likely to hold the CMA to a high standard in relation to any appeals. Our experience of competition law appeals in the Competition Appeal Tribunal also supports this view.

Voluntary undertakings: will there be more in future?

The CMA's new powers are likely to create stronger incentives for businesses to bring consumer protection investigations to an end by agreeing to voluntary undertakings. On the other hand, businesses may find that they need to offer the CMA more in order to persuade it to conclude an investigation in this way. In particular, given the CMA's new powers to impose enhanced consumer measures, businesses may need to consider offering redress to consumers more proactively than they have in the past. This may sometimes mean that the CMA will proceed to an infringement decision because it has not been possible to reach agreement on voluntary undertakings. In some cases, the CMA may also take the view that it is preferable to issue an infringement decision in order to establish a clear precedent to deter similar behaviour in future.

What's the timing?

The Bill is not expected to become law until sometime in 2024. However, before the new consumer enforcement regime can be implemented, a number of other steps would probably need to take place, including:

passing of secondary legislation setting out the CMA's rules of procedure; and
CMA consultation on draft guidance on its new powers, including how it will approach calculation of fines.

As a result, even if the Bill receives Royal Assent in early 2024, additional time is likely to be needed before the new regime is fully up and running. There may, however, be different "starting dates" for other aspects of the Bill.

Read Jonathan Rush Profile