Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?

Question

ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on which it was first attempted and ostensibly due.

Suppose you don’t wish to renew for a full year, but only for a further month. Apparently this is tough nuggies

Then suppose six months pass and you don’t make the payment. Then you are still one year’s worth of fees in arrears, but you’ve not had access to the service for half of the year of which the payment is in respect.

Is it legal for them to do this? The potential issues that come up in my mind is that they may be barred from taking your data hostage under GDPR provisions, or that charging you so inflexibly for contract periods that you cannot even enjoy the service for may be an unfair consumer contract term.

Answer 1

To the degree that ProtonMail is subject to the UK GDPR, they cannot charge you for exercising your right to Access to your Personal Data, or for exercising your right to Data Portability. However, they need not provide access via their application, and the exercise of these rights would be hampered by their end-to-end encrypted nature. That is, exercising your rights may only be able to give you a copy of your account metadata and an encrypted blob.

I am not convinced that ProtonMail is subject to the UK GDPR in the first place. For GDPR to apply, either Art 3(1) must be fulfilled, or Art 3(2).

• Art 3(1) GDPR will probably not apply since ProtonMail is a Swiss company. Switzerland is not part of the EU or UK. The presence of EU and UK employees does complicate this, but it would need further analysis to show that personal data is processed in the “context” of those EU and UK establishments.
• Art 3(2) of the EU GDPR does apply since the ProtonMail website is clearly offering its services to people who are in the EU. For example, pricing in EUR is evidence of such an offer. However, the EU GDPR is irrelevant in your scenario since you're not from the EU.
• Art 3(2) of the UK GDPR might not apply – I can't see how ProtonMail would be marketing its services specifically to people who are in the UK.

(see Art 3 UK GDPR on legislation.gov.uk)

You are concerned that being blocked from using the ProtonMail applications while your account is in arrears would lead to a scenario where you have paid for services that you didn't receive. However, ProtonMail would have provided some services during this time, for example keeping your data around (rather than deleting it immediately), or continuing to receive emails on your behalf. There is an argument that withholding access to the applications could be an unfair practice, but this is not at all an obvious conclusion.

It would also be necessary to consider whether UK or Swiss consumer protection law is applicable here. The choice of law clause in the terms of service suggests that all disputes would be under Swiss law, though of course this can't override consumer protection laws if those laws actually apply.