Major changes to consumer and competition rules, a new digital regime and more power to the CMA

The DMCC sees major reform to the consumer protection regime, in particular to the enforcement regime.

The Government has described consumer law enforcement as a key weakness in the consumer protection regime and the amendments brought in by the DMCC are designed to put the public enforcement regime broadly on a par with the Competition regime, including by introducing the concept of turnover-based fines for non-compliance with consumer protection, for the first time.  This mirrors the approach taken in the EU with the EU consumer protection measures introduced as part of the EU’s New Deal for Consumers, although the potential ceiling for fines will be higher in the UK.      

New public enforcement powers for the CMA

Under the DMCC, the CMA will, for the first time, have the power to enforce consumer protection laws directly through administrative proceedings (rather than enforcing consumer rights in a court process).  The CMA’s powers will include:

1. the power to issue infringement notices to traders engaged in unfair commercial practices and issue fines of up to £300,000 or 10% of global turnover (whichever is higher); and
2. the power to fine a trader up to £150,000 or 5% of annual global turnover (whichever is higher) for failure to comply with an undertaking or enforcement directions. In these circumstances, the CMA may also impose fines of up to £15,000 or 5% of daily turnover (whichever is higher) during the period of non-compliance.

The CMA’s new powers are additional to the existing, court-based enforcement regime which is to be strengthened by the DMCC. 

The DMCC enables courts to impose civil monetary penalties meaning that certain public enforcers including the CMA, Ofcom and the Local Authority Trading Standards will be able to apply to the courts to impose financial penalties when dealing with breaches of consumer law.  Designated enforcers will have the power to apply to the courts for a range of consumer protection orders (including the new online interface order) as part of which, designated enforcers may ask the courts to impose fines on traders engaging in unfair commercial practices of an equivalent level to those that can be imposed directly by the CMA.

As under the previous consumer protection regime (the Consumer Protection from Unfair Trading Regulations 2008 (“CPUT”)), the DMCC identifies categories of commercial practices which will always be unfair (see Schedule 20) as well as providing for criminal liability for breaches of consumer protection law.  There are also new offences (including an offence of failing to provide information about cooling off rights in the context of a subscription contract, and an offence of omitting material information from an invitation to purchase – relevant to the presentation of pricing information and drip pricing).  

Importantly, these new consumer protection powers will apply to all consumer-facing businesses, and not just the major digital players designated as having “strategic market status” (“SMS”), to which part 1 of the DMCC will apply – see below.  

The CMA has indicated in its Annual Plan for 2024/25 that, in the context of the cost of living crisis, it intends to focus its efforts on protecting consumers, including when buying goods and services online.  A number of recent CMA reviews and investigations have focused on price transparency and online choice architecture (so-called ‘dark patterns’ where the design of online platforms could lead consumers to take certain decisions which are not in their best interests, e.g. misleading discount claims, use of countdown timers to create a false sense of urgency).  We can therefore expect the CMA to be quick off the mark to use these new powers, given current CMA enforcement activity examining online choice architecture and the CMA’s 2023 joint position paper with the Information Commissioner’s Office on harmful design in digital markets.  

What consumer protection laws can be enforced?

The CMA will be able to use its new powers to enforce existing consumer protection laws, which are broadly restated in the DMCC, to ensure they are subject to the new enforcement powers.  Schedule 20 of the DMCC comprises a list of  commercial practices which are considered unfair in all circumstances, substantially replicating the list of banned practices in CPUT (which is to be repealed) as well as making some important additions – see below.

Further, as trailed in the Government’s 2022 consultation on consumer protection reforms and the Department for Business & Trade’s (“DBT”) 2023 consultation on improving price transparency and product information for consumers, the DMCC introduces a number of new consumer protection laws.  These new laws largely focus on key areas of concern for consumer protection in the digital economy, including: 

1. Subscription contracts: the DMCC sets out a stand-alone regime which applies to subscription contracts and is billed as targeting consumer harm caused by hidden fees, automatic renewal and obstacles to cancellation.  Under the new regime, businesses are required to provide customers with clear information about terms and conditions at the pre-contract stage, issue reminder notices about  renewal payments at specified intervals and ensure that customers are able to exit a subscription agreement by making a clear statement of their intention to bring a contract to an end.   
2. Fake reviews: notable new additions to the list of commercial practices that were banned under CPUT include provisions prohibiting the submission and commissioning of fake reviews.  Importantly, businesses publishing reviews must also take reasonable and proportionate steps to prevent the publication of fake or misleading reviews.  This will likely entail enhanced compliance processes to verify the legitimacy of reviews used to promote a business.
3. Drip pricing: insofar as it can be calculated in advance, the total price of a product must be displayed in the invitation to purchase. This provision was added at a relatively late stage of the Bill’s passage (after the publication of our earlier overview of the consumer aspects of the Bill) and is consistent with the Government’s conclusions in DBT’s January 2024 response to its consumer price transparency review.   Omission of material information from the invitation to purchase will be a criminal offence.  Importantly, there is no longer a requirement for the enforcement body to show that a failure to present the total price and the existence of any variable fees will cause, or be likely to cause, the average consumer to take a different transactional decision.  Businesses will therefore need to ensure the ‘total’ price displayed including all mandatory fees that consumers have to pay when the headline price is displayed to consumers.  Note that variable mandatory fees (such as delivery fees) are also compulsory charges, but unlike fixed fees, cannot be reasonably calculated in advance.  Businesses who use variable mandatory fees will therefore need to make clear, alongside the headline price, that additional variable fees will be added to the headline price. This should also include how such variable fees will be calculated.  At this stage, there are no sector specific rules affecting the presentation of optional fees/charges , but the Government is considering how it might regulate such fees on a sector basis, through sector specific guidance, legislation, or both. 
4. Consumer savings schemes: operators of consumer savings schemes must make and maintain insurance or trust arrangements to protect against the trader’s insolvency (following the high profile collapse of a number of Christmas savings clubs in the last few years). 
5. Secondary ticketing: the Act bolsters enforcement provisions in existing legislation (CRA 2015) in relation to secondary ticketing by permitting the CMA to act as an enforcement authority in relation to existing enforcement powers. Proposals made by the House of Lords to introduce new, specific requirements in relation to secondary ticketing were rejected, with the Government instead committing to review the primary and secondary ticketing markets (although whether this review will in fact take place will depend on the legislative agenda of any new government).   

What about private enforcement?

A major difference between the consumer protection enforcement regime and the competition law enforcement regime is that the DMCC does not afford any specific right to make use of the CAT’s collective actions regime.   The potential for widening the CAT’s collective action regime to encompass consumer law claims was debated during the Bill’s passage through Parliament but the proposed amendment was ultimately rejected.  However, the line between competition law and consumer law claims against big firms has become increasingly blurred with the certification of claims in the CAT having a strong consumer flavour (and claimants seeking to shape consumer concerns as competition law infringements).  It remains to be seen to what extent the new consumer protection regime will influence the kind of collective actions being brought in the CAT.

Key takeaways

The CMA’s new enforcement powers to sanction consumer law breaches means now is a good time for businesses to review their compliance with existing consumer protection rules and verify if existing business models will need to be adapted to take into account likely changes in consumer behaviour once the new rules are in force (e.g. impact on revenue streams from changes to presentation of pricing information).  Given the particular focus on consumer online interactions, each element of the trader/consumer interaction will need to be reviewed sooner rather than later, as it may take time to adapt processes and systems to ensure compliance with the new rules on subscription contracts, fake reviews and drip pricing.

As we have written about previously, the DMCC makes several fundamental changes to the UK competition law regime – including in relation to merger control, the territorial reach of UK competition law and public enforcement.  The DMCC as enacted is broadly in line with the original Bill. 

Merger control

The UK has a voluntary merger control regime, meaning that there is no obligation to notify a transaction to the CMA (nor to await clearance before completing a transaction).  However, the CMA may review (‘call in’) a transaction when one of the jurisdictional thresholds in the Enterprise Act 2002 are met even if it has not been notified. 

The DMCC makes significant amendments to these jurisdictional thresholds.

Amendments to turnover and share of supply thresholds

Currently, the CMA has jurisdiction if either:

• The target’s UK turnover in its most recently completed financial year exceeded £70 million; or
• The parties have a combined share of supply of 25% or more in relation to any overlapping product or service in the UK or a substantial part of the UK.

The DMCC increases the first threshold from £70 million to £100 million and amends the second threshold by introducing a turnover-based de minimis safe harbour such that even if the 25% share of supply test is met, the CMA will not have jurisdiction if no party to the transaction has more than £10 million of UK turnover.  The UK Government estimates that each of these amendments will lead to a reduction of two or three cases reaching a ‘Phase 1’ investigation per year.

Additional basis for jurisdiction

Further changes include the introduction of a new threshold which will permit the CMA to review transactions where one party has both (i) at least a 33% share of any goods or services supplied in the UK (or a substantial part of the UK) and (ii) a UK turnover exceeding £350 million.  In practice, given the separate target-turnover threshold, this new threshold will only bite if the acquirer meets the requirements.   The new threshold may be met notwithstanding that the target may have no UK sales nor any overlapping activities with the buyer. As with the 25% share of supply test, the CMA will have broad discretion to determine “any reasonable description” of a set of goods or services against which to judge whether the 33% threshold has been met.

Complementing the mandatory notification obligations upon  major tech firms designated as having strategic market status (see below), this new “large acquirer” threshold is intended to capture so-called ‘killer acquisitions’, such that the CMA may review large firms, in any sector of the economy, acquiring a smaller and typically innovative firm (perhaps a startup) and where they consider that there is a risk that the threat of future competition from the target may be eliminated.  The Government estimates that this new threshold will lead to the review of an additional two to five cases at Phase 1 per year. 

Territorial scope

The Chapter I prohibition

The DMCC amends the Competition Act 1998 to broaden the scope of the Chapter I prohibition for anti-competitive agreements and concerted practices by removing the requirement that these have to be implemented in the UK.  This remains subject to the requirement that the agreement affects trade within the UK.  This amendment will be welcomed by the CMA, who have recently stressed how its “cases increasingly involve cross-border, multi-national businesses”.

Investigatory powers

The DMCC also provides that the CMA has jurisdiction to exercise its investigatory powers outside the UK, including its powers to require documents or information to be provided to the CMA.  The territorial scope of the CMA’s existing powers are the subject of ongoing litigation, however the amendment (once it comes into force) will bring clarity on this contentious point going forward. 

Evidence gathering

The DMCC also strengthens the CMA’s investigatory powers for gathering evidence during Competition Act investigations.  Its toolkit now includes powers to:

• seize evidence during an investigation at domestic premises and search it at a later date (bringing the CMA’s powers in line with its powers when searching business premises);
• require the production of information that is “accessible” from the premises despite not being physically on-site (e.g. data that can be accessed from cloud-hosted or remote storage); and
• compel individuals to undergo an interview regardless of whether or not they are linked to a business under investigation.

Individuals and companies are now also subject to an extended duty to preserve documents relevant to investigations where they know or suspect an investigation by the CMA is being or is likely to be carried out.  This duty may place a positive obligation on firms to suspend customary deletion of relevant custodian’s data where there is the possibility of a competition investigation.

New civil penalties

The DMCC also raises the stakes for procedural non-compliance in relation to CMA Competition Act investigations. 

For businesses

In most case, fines for non-compliance by businesses are currently subject to a fixed amount not exceeding £30,000 (or a daily fine of £15,000).  With the modifications brought by the DMCC, such breaches, for example failing to comply with an information request, can attract a fixed civil penalty of up to 1% of global turnover.  Daily penalties of up to 5% of daily worldwide turnover can also be imposed. 

As for failure to comply with CMA orders, directions, undertakings or commitments, the CMA may impose penalties of up to 5% of annual global turnover, as well as daily penalty of up to 5% of daily global turnover. 

For individuals

The DMCC also empowers the CMA to impose fixed penalties on individuals such as company directors for procedural non-compliance.  Fixed penalties of up to £30,000 and daily penalties of up £15,000 can be imposed in such cases. 

Market studies and market investigations

The DMCC makes several amendments to the procedures that apply when the CMA conducts market studies and market investigation.  These amendments include giving the CMA more flexibility when conducting investigations, including greater power for defining the scope of such investigations. The CMA will also no longer be subject to an obligation to consult on whether to make a market investigation reference within the first six months of a market study (removing the procedural constraint which threatened to derail the CMA’s live investigation into mobile browsers and cloud gaming).

The CMA has also been awarded the power to conduct “trials” (effectively “real world” experiments) for the purpose of assessing the likely effectiveness of final undertakings and orders under consideration. 

Further, the CMA’s duty to monitor the effectiveness of its undertakings and orders is supplemented with the power to vary the remedies it imposes upon parties whose activities it finds to have an adverse effect on competition, where it determines that the remedies imposed have proven ineffective.  This power may be exercised in relation to any such finding made within the previous 10 years but is subject to a two-year “cooling off” period during which the CMA will be unable to reassess remedies. 

Key takeaways

• The changes to the UK merger regime see the CMA potentially refocusing resource on larger transactions and so-called “killer acquisitions" whilst reducing the regulatory burden for transactions between smaller parties. The new thresholds should be borne in mind for any currently contemplated transactions.
• The ability of the CMA to reopen remedies for up to a decade following the conclusion of a Market Investigation means that industries and parties subject to such investigations may remain under perennial scrutiny. As for market studies and market investigations, businesses should expect the CMA to adopt a pro-active approach, consistent with the trend of heightened activity by the regulator in this space in recent years.
• With respect to investigative powers, the CMA has been calling for greater powers for some time, and now it has been given them, businesses should expect the CMA to make full use of them in ongoing and future investigations.  It would be prudent for businesses to review their dawn raid-preparedness and document retention procedures to take account of the new powers. A consequence of extra-territorial scope for the Chapter I prohibition may be that the CMA is launching new investigations into conduct that was previously out of reach.

The DMCC creates an entirely new digital markets regime in the UK and will add to the growing body of regulation that major tech companies are facing around the world.

Under the DMCC, companies which are designated as having strategic market status (SMS), will be required to comply with bespoke codes of conduct designed by the CMA.

Who is caught?

The CMA can designate companies as having SMS if they have: (i) substantial and entrenched market power (on a forward looking basis) and a position of strategic significance (judged by reference to factors such as scale, number of users and influence); (ii) in respect of a digital activity that is linked to the UK; and (iii) the company’s annual UK turnover exceeds £1 billion or its global turnover exceeds £25 billion. 

This is a broad test and the turnover thresholds within it are considerably lower than, for example, the turnover/market cap thresholds which apply to “gatekeepers” under the European Union’s Digital Market Act (€7.5bn EEA turnover or a market cap of €75bn). However, the CMA has indicated that in practice it “expects the number of firms designated as having SMS to be very limited” and that, in the first year after commencement, it would expect to initiate just 3-4 SMS investigations. 

What do potential SMS firms need to do now?

Whereas under the EU Digital Market Act (DMA), firms meeting key quantitative criteria are required to notify the European Commission that they potentially qualify for “gatekeeper” status (equivalent in very broad terms to SMS), companies meeting the thresholds under the DMCC are not required to take action unless and until specifically approached by the CMA. We have previously written about some of the key differences between the DMA and the DMCC.

How are SMS firms designated and what happens next?

Before designating a company as having SMS, the CMA must carry out an investigation and undertake a public consultation process.  It has nine months from starting its investigation to publish its SMS decision.  It is likely that these first companies to be investigated will be some of the largest tech platforms and eco-systems, which are already facing significant specific regulation elsewhere, including in the EU. 

Companies designated as having SMS will be subject to the following key requirements:

1. Conduct requirements (effectively a form of bespoke, ex-ante regulation): The CMA can impose conduct requirements (CRs) on SMS firms to meet objectives of fair dealing, open choices and trust and transparency. The DMCC specifies the types of conduct requirements that can be imposed (many of which, such as, for example, “self-preferencing” and leveraging power across markets are informed by existing competition law.  Others include, a positive obligation to trade on fair and reasonable terms,  a positive obligation to effectively handle complaints and disputes and a prohibition against using data unfairly).  However, the CMA has a wide discretion to specify the scope of the conduct requirements with which each company having SMS will be required to comply.  This has resulted in significant uncertainty for companies likely to face designation, somewhat mitigated by: (i) a requirement that any conduct requirement imposed must be proportionate; and (ii) the promise of detailed guidance from the CMA on its intended approach to digital regulation.  The CMA’s guidance was published in draft form on 24 May 2024 and the CMA is seeking views on it until 12 July 2024 through a formal consultation process. 
2. Pro-Competition Interventions (PCI): this tool will allow the CMA to impose behavioural requirements on an SMS firm (e.g. by requiring restructuring) or recommend action to another body exercising a public function where it considers this necessary to resolve an anti-competitive effect arising from a digital activity. This can be done via a “PCO” (pro-competition order). Significantly as regards day to day interactions between SMS firms and their counterparties, the CMA also has the power to arbitrate disputes over payment terms between SMS firms and third parties.  No actual or suspected anti-competitive agreement or abuse of dominance, which would be required for the CMA to intervene under its prevailing Competition Act powers, will be required for the CMA to make a PCI.
3. Suspensory merger notifications: A designated SMS firm (including a member of its group) will also have a duty to report M&A transactions to the CMA, prior to completion where:
   1. Mergers: the SMS acquires shareholder rights in a UK connected company (broadly a company that is active in the UK or supplies goods and services in the UK) crossing thresholds of 15%, 25% or 50%, and the total value of all consideration provided is at least £25m.
   2. JVs: the JV is expected/intended to be a UK connected company, and the SMS firm will hold at least 15% of the share percentage or voting rights in the JV and the consideration provided by the SMS firm is worth at least £25 million.

Enforcement

The consequences of non-compliance with the above requirements are significant:

1. Public Enforcement: amongst other measures, the CMA will have the power to impose fines of up to 10% of worldwide turnover for failures to comply with conduct requirements, merger notification requirements, pro-competitions orders or commitments offered following PCIs. 
2. Private Enforcement: As well as having the right to bring complaints to the CMA, any person (corporate or individual) affected by a breach of a conduct requirements, pro competition order or commitment may bring a private action, either on a follow on basis where the CMA has already found a breach or on a stand-alone basis.  The DMCC does not provide for collective proceedings to be brought under the collective actions regime of the UK Competition Appeal Tribunal (CAT), though other forms of group action (including representative actions and Group Litigation Orders) may be available.  In practice, it is also likely that would be Claimants will seek to rely on evidence of breaches of the DMCC to bring Competition Act claims against SMS firms and make use of the CAT’s collective actions regime through that route. 

Key takeaways

The DMCC will bring in a further layer of regulation, in due course, to designated major tech companies, increasingly facing ex ante digital regulation across the globe.  The regime will effectively introduce mandatory merger control notifications for acquisition by designated firms, including for deals of relatively modest value and with a limited UK nexus.

The DMCC will also provide material new rights and associated opportunities for non-designated counterparties and stakeholders in their interactions with SMS firms.

As the DMCC is not expected to enter into force until the Autumn and the process of SMS designation by the CMA is likely to take some time, in practice the hard obligations in the DMCC are unlikely to bite until 2025.  However, firms potentially facing SMS designation, and third party counterparties and stakeholders, may want to look to the requirements under the DMCC as best practice at this stage to prepare for the new rules to come.