Cristina Badea – The new kid on the legislative block – The Control Procedure of the National Consumer Protection Authority
For many years, the National Consumer Protection Authority (the NCPA or the Authority) has conducted controls on economic operators based on the Control Procedure, available on its website in two versions (2024 downloadable, 2023 as an online PDF). While procedural rules for public authority controls are typically normative acts requiring reasoning, public consultation, and publication in the Official Gazette, the NCPA never treated its Control Procedure as such. Despite companies’ longstanding arguments that the Procedure should be formally adopted and published, courts had not supported this view—until recently.
On 10 October 2024, the Timișoara Court of Appeal upheld the Timiș Tribunal’s decision to annul the Control Procedure, ruling it a normative act requiring publication in the Official Gazette. Following this, the NCPA posted the draft Order and the Control Procedure for public consultation on its website, following the transparency procedure prior to the publication of a normative act in the Official Gazette.
This article briefly deals with some questions regarding Control Procedure proposal, as well as the ongoing proceedings against the NCPA, which were raised by the recent ruling, as well as the future adoption of the Control Procedure as a normative act.
Primer on the Control Procedure
The Control Procedure establishes the rules to be followed by the NCPA commissioners before, during and after conducting controls regarding companies’ compliance with consumer protection laws. It mainly provides for rights and obligations on the part of NCPA agents and their conduct during controls. However, it also contains provisions that directly impact economic operators. One example is that the NCPA frequently uses invitations in its control activity. The invitations act like requests for information or summons, that for other authorities are, for the most part, regulated procedural documents. The invitation is an essential procedural act within the control, exclusively regulated by the Control Procedure, and its non-compliance may lead to the sanctioning of the economic operator for obstructing the control. The NCPA frequently indicates this in their invitations.
Therefore, many provisions of the Control Procedure contain, directly or indirectly, rights and obligations of the controlled entities. Nevertheless, the limits of the controlled entities’ rights and obligations, determined under the Control Procedure, were never clear, sometimes with publicized consequences and interventions by other authorities.[1]
In court files against sanctioning minutes or other administrative deeds issued by the NCPA or its structures, the Authority sometimes submitted, particularly if it was mandated to, the Control Procedure, together with the NCPA President Order that adopted it. There were several NCPA President Orders that were submitted, over the years, by the Authority, which shows that the Control Procedure was regularly modified. The NCPA President Orders were never published in the Official Gazette. Moreover, the changes in the Procedure are not (publicly) comparable over time, since the Control Procedure and its adopting Orders were never officially published and are not publicly archived on the NCPA website.
What companies argued regarding the Control Procedure
Over the years, many sanctioned companies, in their attempts to annul sanctioning deeds, raised arguments regarding the Control Procedure.
One line of argument refers to the unlawfulness of the control activity conducted by the NCPA and the violation of procedural guarantees that the controlled entities enjoy, because the Control Procedure is a normative act, not published in the Official Gazette and therefore inexistent, unlawful or not invocable (in RO – inopozabil) against the sanctioned entity. Several consequences were inferred from this issue, such as the unlawfulness of the requests for information or summons via the invitations or of other actions of the NCPA agents that were allowed under the Control Procedure. Courts have frequently rejected this argument, confirming the NCPA defense that the Control Procedure is only an internal and/or individual administrative act destined for its control staff, with no implications for the controlled companies.
Another line of argument pertains to the violation, by the control agents, of the Control Procedure. As such, as also held by legal literature, even if the Control Procedure was not published in the Official Gazette, it is mandatory for the Authority that adopted it. Under this logic, violation of the procedural rules was argued to lead to the quashing of the sanctioning deed. This argument fared differently before courts. While some considered that such violation leads to the absolute nullity of the sanctioning minute,[2] others considered that such nullity would only be justified if the company proved injury because of the violation.
What did the Timis Tribunal find?
The proceedings before the Timis Tribunal[3] were initiated by NCPA commissioners. They argued that the Control Procedure is a normative act that was unlawfully omitted from publication in the Official Gazette, was not reasoned and its existence violates the security of legal relations and the principle of legality. The court validated this argument, holding that:
- The Control Procedure is applicable to an undetermined number of people, specifically to any and all NCPA commissioners;
- The lack of publication in the Official Gazette leads to the relative nullity of the Procedure, and not to its inexistence;
- The commissioners are affected by the Procedure, because its infringement may lead to disciplinary sanctions against them.
For these reasons, the Timis Tribunal annulled the Control Procedure. The Timisoara Court of Appeal[4] ruling is not yet publicly available but confirms the reasoning of the first court.
It may be argued that these rulings are generally mandatory for the future, under art. 23 of the Administrative Litigation Law, and may therefore be relied upon in all ongoing proceedings against the NCPA[5]. It is likely that relying on this ruling will not automatically lead to the illegality of the sanctioning deeds, but it must be tied to the facts of each case and the background of the controls.
How does the Control Procedure look in the transparency procedure, before its final adoption?
The next day after the Timisoara Court of Appeal’s ruling, the Control Procedure was published for public consultation, between 11.10.2024 and 21.10.2024. You can see the draft Control Procedure and adopting Order on the NCPA’s website. The proposed text of the draft seems identical to the one which existed before.
The current draft proposal has several issues that make it fail the test of legal drafting. It contains many definitions and provisions that double existent, higher law, including EU law (legal parallelism – e.g., rules for legally serving a sanctioning minute), or that contradict such higher laws (violation of the hierarchy of legal acts – e.g., the definition of a ‘safe product’). There are also no transitory norms to clarify when the new Procedure becomes applicable and what happens with ongoing control proceedings. Furthermore, there are no rules regarding controls regarding illegal content online and the communication between NCPA agents and online intermediaries, specifically on how the NCPA agents should deal with such entities that have express limited liability, under the DSA, regarding illegal content made available by their users. Rules on how the commissioners should deal with intermediaries are imperative, especially because Romanian authorities, as well as the NCPA, have a history of disregarding the limited intermediary liability regime under the E-commerce Directive or the DSA.
It will be interesting to see the final form of the Control Procedure, published in the Romanian Official Gazette, and how companies will react to it (or against it) when sanctioned. While we may finally enjoy some legal clarity and transparency with the Control Procedure published and existing as a proper law, its content does not live up to the standard of clear, procedural guarantees for controlled companies.
[1] See the Romanian Data Protection Authority sanctioning the NCPA for using body cams, in breach of art. 5(1)a) and 6(1) of the GDPR – https://www.dataprotection.ro/?page=Comunicat_Presa_05_07_2023&lang=ro, publicized, for example, on https://economedia.ro/anpc-nu-mai-are-voie-sa-utilizeze-dispozitive-tip-body-cam-a-decis-autoritatea-pentru-date-personale-in-timpul-controalelor-anpc-erau-filmate-multe-persoane-fara-acordul-acestora.html (Accessed on 31.10.2024).
[2] Constanța District Court, Civil Division, Judgment no. 567/25.01.2021, rendered final by Civil Decision no. 950 of 15.10.2021, issued by Constanța Tribunal, Administrative and Tax Litigation Division.
[3] Timiș Tribunal, Decision no. 388 dated 23.04.2024, rendered in court file no. 4451/30/2023.
[4] Timișoara Court of Appeal, Decision no. 928 dated 10.10.2024.
[5] Article 23 of Law no. 554/2004 stipulates that “Final and binding court decisions annulling in whole or in part an administrative act of a normative nature are generally binding and effective only for the future. They must be published, after reasoning, at the request of the courts, in the Official Gazette of Romania, Part I, or, as the case may be, in the official monitors of the counties or of the municipality of Bucharest, and are exempt from the payment of publication fees.”
Legal scholars mention that against the authority that issued the normative act parties may also invoke the annulment judgment, before its publication in the Official Gazette, given that it was a party to the proceedings for annulment of the normative act (see Gabriela Bogasiu, “Legea contenciosului administrativ comentată și adnotată”, 4th ed. Universul Juridic, București, 2018, commentary on art. 23 of Law 554/2004, citing the Supreme Court Decision no. 3973 of November 7, 2008). Moreover, according to the Supreme Court Decision no. 10 of May 11, 2015, rendered in a preliminary ruling, the judgment annulling the normative administrative act “also has effects with regard to the individual administrative acts issued on the basis thereof, which, at the date of publication of the judgment of annulment, are challenged in cases pending before the courts”.