The Austrian courts asked whether the contactless functionality on NFC-enabled payment cards is a separate payment instrument, and if so whether it is to be considered as anonymous use of the payment instrument for the purposes of Article 63(1)(b) of PSD2, allowing providers to impose liability for misuse on users. They also queried whether the scope for making changes to the terms of framework contracts under Articles 52(6)(a) and 54(1) is unrestricted. The two questions were connected as DenizBank had varied its terms so as to shift liability for unauthorised transactions using the contactless functionality onto the payment service user (PSU).
Advocate General’s opinion
The Advocate General's opinion took the view that NFC contactless functionality is a “payment instrument” in its own right, and suggested that a consumer's 'explicit consent' to vary the T&Cs of payment services contracts should be required for all but 'non-essential changes'. The AG thought that adding contactless functionality was an 'essential' change and so outside of the scope of Articles 52(6)(a) and 54(1).
CJEU judgment
Is the scope for making tacit changes to framework contracts unrestricted?
PSD2 does not restrict the type of terms that can be changed by tacit consent…
Contrary to the AG’s opinion, the Court found that Article 52(6)(a), when read with Article 54(1), does not contain any restriction on variation relating to the status of the PSU or the type of contractual terms that may be subject to acceptance by the PSU through tacit consent; it simply provides for the possibility of changes by tacit consent and for the requirement of full transparency in relation to the changes.
…but where the PSU is a consumer, the UCTD applies…
However, the Court reasoned that it is clear from the provisions of PSD2 that other EU consumer protection legislation remains applicable. Therefore where the PSU is a consumer, unilateral variation clauses are subject to a potential finding of unfairness under the UCTD. The Court referred to existing EU case law on standard unilateral variation clauses, which emphasises that such terms must meet the requirements of good faith, balance and transparency laid down in the UCTD.
…but there is a limit to the changes which can be made
The Court also stated that the presumption of tacit consent by the PSU, as agreed with the PSP, relates only to "changes to the conditions of the framework contract", being changes that do not affect the conditions of the framework contract to such an extent that the proposal from the PSP would in reality constitute a new contract. The scope of this limitation will be for the national courts to decide. This is an area where the range of changes which can be made may differ according to the laws of individual member states and it is often challenging to know where to draw the line.
Is contactless functionality a separate payment instrument?
The CJEU confirmed the AG’s position that contactless functionality on a payment card is a separate payment instrument in its own right (rather than a means of consenting to use of the card).
The Court referred both to existing case law supporting a purposive interpretation of the PSD2 definition of 'payment instrument' and to the paragraphs in the AG’s opinion in which he argued that multifunctional bank cards such as that issued by DenizBank have a 'twofold nature or functionality', meaning that they are both:
The Court described the contactless functionality as ‘legally separable’ from the other functions of the card, which require the use of personal security data, in particular in order to pay an amount above the threshold set for use of the contactless functionality. It is therefore capable, in the Court’s view, of being regarded as a separate, anonymous, payment instrument when used for a contactless payment.
As a result, DenizBank could rely on the derogation on Article 63(1)(b) to impose liability on the PSU for unauthorised low value payments under their T&Cs.
Next steps
The CJEU’s decision on unilateral variation clauses, including the acknowledgement of the interplay between PSD2 and the UCTD, is a sensible one which will come as a relief to banks and other payment service providers, who can now continue to rely on such clauses in agreements to vary T&Cs to introduce improvements to their payments products and services quickly and easily.
By contrast, the finding on contactless functionality as a separate payment instrument does potentially create issues going forward. Payment service providers will need to consider carefully what steps they need to take when introducing contactless functionality although the approach adopted may well be influenced by whether the provider seeks to rely on the derogation relating to unauthorised contactless transactions in the same way as DenizBank.
If you would like to discuss any of the issues raised above, please contact any of us.
Authored by James Black, Julie Patient and Virginia Montgomery.
