60

Today the new Terms of Service of Stack Exchange have been released, sparking a lot of unrest about its arbitration clause; see the comments and answers on the linked meta above, and also this question.

Does the GDPR prevent Stack Exchange from using the arbitration clause against EU citizens?

In the sense that when there's a massive data leak and a large class-action suit will be filed, can EU citizens do that collectively, as opposed to going through arbitration for each separate user?


The below is no longer applicable, since on the 10th of May electronic opt-out was made available.

Related to this it states that the opt-out currently is a physical letter send to Stack Exchange (how they'd tie that letter to my SO account is a bit vague for me, as I can type any odd user page on my letter, not only my own), but this comment suggests that under GDPR there should be a digital opt-out for digital services. Does that mean that the entire clause is invalid (or however that goes in law), when there is no digital opt-out currently available?

  • 4
    Are you asking only about arbitration in relation to GDPR, or arbitration in general? Unrealistic example: SE employees conspiring to harass users. Is your question meant to cover that too, or should I ask that as a new question? (I think your question doesn't currently cover it, but I'm not sure if that's intentional.) – hvd May 3 '18 at 14:02
  • 4
    @hvd I'm not sure what you mean. I'm no lawyer, hence I barely understand the arbitration clause, but it reads to me that if SE does anything which is bad for its users, the users cannot collectively complain in court. It is suggested in answers and comments on the meta announcing the new ToS that arbitration clauses are in conflict with the GDPR, hence I'm asking about whether I, as an EU citizen, should be concerned about trying to opt-out (which I want), or that the EU law already covers me in that sense. – Adriaan May 3 '18 at 14:05
  • 1
    Sorry for not being clear enough. I thought that what was suggested on Meta was that SE's GDPR's requirements apply even if the arbitration clause would suggest otherwise. In my example, harassment is covered by completely different laws, unrelated to the GDPR, so the answer could be different. – hvd May 3 '18 at 14:08
  • 1
    Thanks for the clarification. I'll hold off on posting my own answer on that because most likely, you'll already get a much better answer from someone far more knowledgeable than myself, but if it takes too long I'll make an effort to put what I've pieced together so far into an answer. – hvd May 3 '18 at 14:24
  • 3
    There are a few more problems with the ToS vis-a-vis Dutch law. I don't think you can waive the right to a Dutch class-action lawsuit - the USA isn't the only country that has them. – MSalters May 3 '18 at 14:39
47
+100

Not going to hold up. Dutch Supreme Court confirmed 2012-09-21 in LJN BW6135 that arbitration is still covered by the the right to an independent judge, as established in Golder v UK, ECHR 1975-02-21, nr. 4451/70. Stack Exchange can't decide the rules themselves.

(The Dutch case confirms that sector-wide arbitration is in fact legal, with regard to a standard arbitration clause commonly used in the Dutch building sector. The arbiter was found to be independent in that case precisely because they weren't picked by the builder involved.)

The GDPR is only indirectly relevant, but the fact that it's mentioned does mean that there is an indisputable intent to provide services to EU consumers. (See section 23 of the GDPR, or its national equivalents). As such, you can't hide behind a US business address. If you intend to do business in the EU, it's under EU laws - all of them. You can't say that only the GDPR applies, and not other rules.

I'm having a bit of a problem finding a source, but I'm fairly confident that consumers have the right to sue at their own, local court, overruling the default of suing in the court where the counterparty is located.

Finally, I have the right under national law (Dutch: BW 6:236 start and sub-n) to strike the arbitration clause up to 30 days after the conflict arises, and demand a court decision. That's not 30 days after I accept the "Public Network Terms", that's 30 days after the arbitration is invoked. Dutch law explicitly allows arbitration abroad, and arbiters may apply foreign law, but as written the arbitration clause has no legal basis in the Netherlands, and any arbitration resolution would therefore not be considered valid.

You may wonder if it matters to Stack Exchange that the arbitration decision would not hold in the EU. Well, consider a clause like Indemnification, which demands the user indemnifies Stack Exchange. That's a pretty empty demand if it's not enforceable.

  • 10
    @Adriaan International law is somewhat of a mess w.r.t. online companies. You could sue and win millions of $ in a judgement against SE in a foreign court, but a US bank won't give you a dime of SE's money until they see an American court order. – mbrig May 3 '18 at 14:54
  • 9
    @NickyMattsson: Nope, sorry. The root cause why it fails is the European Court of Human Rights verdict of 1975. The Dutch-specific bits are just icing on the cake. – MSalters May 3 '18 at 15:41
  • 2
    @mbrig: That's one of those vague areas. The US also has a notion of legal protection of privacy, so the GDPR itself will be recognized. And the idea of approving foreign judgments is to not try the case over again. But if there's a good reason to believe the case hinges on such subtle differences, then it will probably not be accepted by the US judge. – MSalters May 3 '18 at 15:45
  • 2
    @MSalters - "fairly standard procedures to basically copy a foreign judgement. Works best when laws are similar" - do you have any idea how this could work when the entire legal system is different - US (New York State specifically in SE case) is common law, Dutch is civil law? – artem May 3 '18 at 16:48
  • 3
    Re sources, «Under the Rome I Regulation, consumers have the right to enjoy the protection of their home state’s laws, and similarly, the Brussels I Regulation gives consumers the right to litigate on home-ground.» More: sfplegal.com/… kentlaw.edu/faculty/rwarner/classes/legalaspects_ukraine/… insidetechmedia.com/2015/06/04/… – Nemo May 4 '18 at 17:36
3

The French 'Cour de cassation', highest level of jurisdiction for civil cases has judged this week in a similar case that a clause forcing a customer to go through arbitration was not enforcable.

So even without GDPR, there is a strong case to say that this clause invalid in Europe (at least in the EU)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.