White & Case Tech Newsflash
A series of recent rulings from the Court of Justice of the European Union ("CJEU") has reaffirmed the country of origin principle set forth in the e-Commerce Directive ("ECD")—which provides that, except in limited situations, an information society service provider (e.g. an online platform) should not be subject to regulations in the coordinated field that are stricter than those in the Member State in which that provider is established. Here, the CJEU has applied this general principle even to local requirements aimed at implementing an EU-wide regulation and has found these requirements did not meet the narrowly defined exceptions to this principle.
Key takeaways
The CJEU has embraced an interpretation of the country of origin principle which broadly defines the "coordinated field", and narrowly defines exceptions to the principle. In the context of contentious and high-profile policy debates around the activities of information society service providers—from content regulation on social media to the fairness of contractual and economic terms proposed by online marketplaces—many EU Member States have shown an increasing appetite for national-level regulation. After the CJEU's decisions, future efforts by Member States to impose regulations on the activities of information society service providers established outside their borders will have a high bar to clear. The decisions reaffirm the key principles of predictability, legal certainty, and freedom to provide services across the EU.
Background: Country of origin and the coordinated field
To avoid subjecting information society service providers to potentially conflicting local regulations across the EU's Member States, the ECD defines an area of policy known as the "coordinated field"—which includes regulatory requirements affecting (among other things) information society service providers' "behaviour" and "the quality or content of the service" they provide. Within that field: (i) a provider shall be subject to the national regulations of the Member State in which it is established; and (ii) other Member States cannot restrict the free movement of this provider by requiring compliance with obligations that exceed those in the provider's Member State of establishment. This default rule—known as the "country of origin" principle and found in Article 3 of the ECD—ensures that information society service providers can, subject to certain exceptions, conduct their activities under the regulatory regime of their Member State of establishment, regardless of where in the EU they do so.
As exceptions to the country of origin principle, Article 3(4) of the ECD provides that information society service providers can be required to comply with measures falling within the coordinated field that are imposed by Member States other than their Member State of establishment only where those measures are necessary for reasons of: (i) public policy, "in particular the prevention, investigation, detection and prosecution of criminal offences"; (ii) protection of public health; (iii) public security, "including the safeguarding of national security and defence"; or (iv) protection of consumers and investors. Any such measures must be proportionate, and must be taken against a specific information society service provider in response to a situation of "prejudice" or "a serious and grave risk of prejudice" to one of the four listed objectives. They must also comply with procedural requirements (Article 3(4)(b) of the ECD).
Airbnb, Google, Amazon, and Eg Vacation Rentals’ challenge to Italian regulations
The CJEU's recent rulings address the country-of-origin principle in the context of certain requirements imposed by AGCOM, the Italian communications regulator. In 2020 and 2021, following the adoption at EU level of the Platform-to-Business ("P2B") Regulation, the Italian legislature passed legislation requiring certain information society service providers—online search engines such as Google and providers of "online intermediation services" within the meaning of the P2B Regulation—to, among other things: (i) pay an annual contribution towards defraying AGCOM's operating costs; and (ii) submit to AGCOM detailed information about their internal organisation, capital structure, and financial condition, thereby enabling them to be registered with AGCOM. Failure to do so risked a large turnover fine for non-compliance.
Four information society service providers established in Member States outside of Italy—Google Ireland, Airbnb Ireland, and Eg Vacation Rentals Ireland, all established in Ireland, and Amazon Services Europe, established in Luxembourg—challenged the Italian legislation's registration requirement in two cases before the Regional Administrative Court of Lazio.1 The Regional Administrative Court then sought preliminary rulings from the CJEU on several questions regarding the compatibility of the registration requirement with various provisions of EU law, including the country of origin principle.
The CJEU’s decisions: A strong endorsement of the country of origin principle
On 30 May 2024, the CJEU ruled in both cases that the Italian legislation's registration requirement was inconsistent with Article 3 of the ECD. The court reiterated that "within the coordinated field defined in Article 2(h) of [the ECD], information society services are regulated solely in the Member State on whose territory the providers of those services are established".2 The registration requirement fell within the coordinated field of Article 2(h) because it "relat[ed] to the exercise of the activity" of the information society service providers at issue.3 Because it was an obligation imposed by Italy (the Member State "of destination") and not by Ireland or Luxembourg (the Member States of establishment of the respective information society service providers), it contravened the country of origin principle.
Importantly, the court also ruled that the registration requirement did not come within the scope of permissible exceptions to the country of origin principle laid out in Article 3(4) of the ECD. First, it was not a measure taken against any specific information society service provider, but instead was "general and abstract in scope".4 Second, it did not respond to any "prejudice" or risk of prejudice to the objectives of public policy, public health, public security, or protection of consumers. Even though the stated purpose of the registration requirement was to facilitate implementation of the P2B Regulation in Italy—with its goals of creating a "fair, predictable, sustainable and trusted online business environment" and providing business users of online services with "appropriate transparency" and "effective redress possibilities"—the court noted that there is "no direct link" between those objectives and the four listed objectives in Article 3(4) of the ECD.5 Both rulings emphasise that Article 3(4) "must be interpreted strictly" and "cannot be applied to measures which are likely, at most, to have only an indirect link with one of the objectives referred to in that provision".6
1 Amazon and Expedia also successfully challenged an additional requirement to provide a separate set of corporate information to AGCOM. Amazon's challenge was based partly on the country-of-origin principle but the challenge brought by Expedia, which is based outside the EU, was not.
2 Airbnb & Amazon para. 55, Google & EGVR para. 58.
3 Airbnb & Amazon para. 64, Google & EGVR para. 67.
4 Airbnb & Amazon para. 71, Google & EGVR para. 74.
5 Airbnb & Amazon para. 78, Google & EGVR para. 81.
6 Airbnb & Amazon para. 83, Google & EGVR para. 86.
