Legal development

DMCC Act: CMA consultation on direct consumer enforcement guidance

08 November 2024

Following the Royal Assent of the Digital Markets, Competition and Consumers Act (DMCC Act) on 24 May 2024, the CMA has published draft guidance on the new direct consumer protection enforcement regime set out in the DMCC Act (Draft CMA200). The Draft CMA200 guidance sets out the CMA's general approach to the exercise of its direct enforcement powers under the DMCC Act and contains statements of policy as to how it will exercise its powers to impose monetary penalties. The CMA consultation ran from 31 July 2024 to 18 September 2024.

Final guidance is expected to be published in early 2025, before the new enforcement regime enters into force in April 2025.

The Draft CMA200 guidance does not cover the CMA's approach to exercising its other (court-based or criminal) consumer protection enforcement powers, which is covered by separate guidance (CMA58) on which the CMA has confirmed it will launch a separate consultation.

Key takeaways

The CMA has published draft guidance on its approach to the new direct consumer enforcement regime, including the investigation and enforcement process, remedies, and penalties. The consultation closed on 18 September 2024, and the final version is expected to be published in Q1 2025.
The proposed investigative and enforcement processes draw heavily on the CMA's approach to conducting investigations under the Competition Act 1998.
The guidance also outlines the CMA's approach to penalties in direct enforcement cases. The CMA proposes to use a stepped approach to assess the appropriate amount of any penalty, including administrative penalties. This is a departure from its approach to administrative penalties under other CMA functions, such as the Competition Act or the mergers and markets regime (see our July 2024 update).
The new enforcement regime is expected to commence in April 2025.

The CMA's consumer investigation process

The DMCC Act introduces extensive reforms to the consumer protection enforcement regime in the UK, in particular providing the CMA with new powers to directly enforce consumer law and impose fines of up to 10% of a company's global turnover. See our July 2024 update for details of the substantive changes to consumer law and enforcement introduced by the DMCC Act.

The Draft CMA200 guidance outlines the following process for consumer enforcement investigations:

Pre-launch: the CMA will take preliminary investigative steps (including gathering information) to determine whether to open a formal investigation and, if so, which enforcement powers to use – in particular, whether to use its direct enforcement powers under the DMCC Act or its other consumer protection enforcement powers.
Investigation: the CMA will conduct a formal investigation to assess whether the company has breached consumer law and whether to issue a Provisional Information Notice (PIN) to the parties. During the investigation, the CMA will have broad investigative powers, including to request information from parties under investigation and third parties, enter premises (both with and without a warrant), make test purchases and observe the conduct of a business. The guidance reiterates that information can be requested from persons or companies outside the UK where they have a UK connection.
Issuing a PIN: a PIN will be issued if the CMA reasonably believes that a party has breached, is or is likely to breach, consumer law (or is an accessory to such conduct). The decision to issue a PIN will be taken by the Senior Responsible Officer (SRO) appointed for the investigation. In addition to explaining the basis for the alleged infringement, the PIN will set out any proposed directions or penalty that the CMA is considering imposing.
Access to file: parties will be granted access to the CMA's case file. In most cases, the parties will only automatically receive access to documents referred to in the PIN, with the remainder being disclosed by a schedule. Parties would then need to request access to any documents listed on the schedule which they want to review. This reflects the 'streamlined' file access procedure often adopted in competition law investigations. Given the short timetable proposed for responding to a PIN (see the next bullet), this is likely to create a tension with parties' rights of defence as parties are unlikely to have sufficient time to identify, request, review and consider relevant documents in the short timetable proposed for responding to PINs. It would therefore be helpful for the CMA to consider any requests for access to further documents when assessing a party's request for additional time to respond to a PIN. Documents that identify individual consumers will generally be withheld or anonymised, however, in some circumstances it may be necessary to disclose complaints received, including the identity of the individuals. More guidance on when certain types of documents will be withheld from inspection would also be helpful to ensure that parties' rights of defence are not undermined.
Representations to the CMA: parties will have the opportunity to submit written representations on a PIN and to attend an oral hearing. The CMA anticipates that parties will generally have 20 to 30 working days to provide written representations on the PIN. This is significantly shorter than the equivalent timeframe of up to 12 weeks provided for in the CMA's competition law enforcement guidance (CMA8). Aligning the consumer investigation timetable with the timetable for competition law investigations would help to preserve parties' ability to exercise their rights of defence, particularly in larger or more complex investigations.

The oral hearing will be attended by the three person Final Decision Group (FDG) appointed to be the final decision-makers in the case. The members of the FDG will not have been involved in the investigation prior to their appointment (with the exception that the SRO may be appointed to the FDG).
Supplementary PIN or letter of facts: where the CMA seeks to rely on (i) additional allegations or (ii) new evidence in support of its existing allegations, after the parties have submitted their representations, it will issue a supplementary PIN or letter of facts, and provide an opportunity for further representations to be made. The Draft CMA200 does not expressly provide for the right to a further oral hearing if the CMA issues a supplementary PIN, which is an important safeguard, given that a supplementary PIN will contain new allegations.
Final decision: if the CMA considers that a party has engaged, is engaging or is likely to engage in a commercial practice that breaches consumer law, or is an accessory to such practice, the CMA will issue a Final Infringement Notice (FIN), which will set out the relevant facts, the CMA's reasoning, and any penalties. The CMA will publish a press release and a non-confidential version of the FIN.
Undertakings: during the investigation, the CMA may accept undertakings (i.e. a voluntary commitment to change conduct without admitting liability for an infringement) if it has not yet issued a FIN. Further guidance on the factors the CMA will take into account in deciding whether to accept undertakings would be helpful. The Draft CMA200 indicates that the CMA will not accept undertakings where failing to complete its investigation and issue a decision would undermine deterrence in light of the novelty of the new regime.
Settlement: as is the case under the Competition Act 1998, settlement will require a party to admit the facts and conduct in question and that it has broken consumer protection law. The party will also need to agree to stop or mitigate the infringement, comply with any other requirements set out in the FIN, accept a streamlined administrative procedure, and agree not to appeal. Settlement discussions can be commenced in advance of the issue of a PIN (when a maximum discount of 40% is available) or after the PIN has been issued (when the maximum discount falls to 25%). If the settlement discussions are successful, the CMA will issue a FIN reflecting the admissions.

The Draft CMA200 indicates that requests to access documents, other than those referred to in the PIN, may adversely affect the CMA's analysis of the procedural efficiencies and resource savings achieved from settlement. However, it is important that parties can make reasonable and proportionate requests for documents that may be relevant to their decision as to whether to engage in the settlement process and they should not be deterred from doing so due to concerns that it will have a negative impact on the CMA's assessment of whether to settle the case.
Administrative enforcement: the CMA will have the power to impose fines for breaches of undertakings and directions, and for a failure to comply with information requests. For the CMA to take enforcement action in respect of the provision of false information or a breach of directions, it must believe that the failure is without reasonable excuse. Additional guidance on what the CMA will consider to be a reasonable excuse would be helpful.

The CMA can impose directions in relation to breaches of undertakings or a failure to comply with a formal notice but it can only impose a financial penalty if it is satisfied that the breach was without reasonable excuse.

The CMA will issue a provisional notice setting out the grounds for the notice (i.e. the alleged acts or omissions), the proposed actions or directions that are required to secure compliance, and the amount of any proposed financial penalty. Parties will typically be given no more than 10 working days to make representations on the notice, following which the CMA may issue a final notice.

It would be helpful if the final guidance provided an indication of the anticipated timetable for the entirety of a consumer law investigation, with indicative timeframes for each step.

The CMA's approach to penalties

A key feature of the new direct enforcement regime is the CMA's ability to impose financial penalties for infringements of consumer law. The Draft CMA200 guidance sets out the CMA's approach to the calculation of the appropriate penalty for infringements of consumer law (Substantive Penalties) and breaches of remedies or investigatory requirements (such as breaches of undertakings and directions, the provision of false or misleading information, and non-compliance with information notices) (Administrative Penalties).

Substantive Penalties

Under the DMCC Act, the CMA will be able to impose Substantive Penalties of up to £300,000 or 10% of a party's global turnover (whichever is higher). The Draft CMA200 states that for Substantive Penalties and breaches of undertakings and directives "the CMA will generally determine a starting point of up to 30% of the party's UK turnover". This suggests that the starting point will be the party's UK turnover: in contrast, the starting point for competition law infringements is the affected product(s) and relevant geographic market(s) which more accurately reflects the scale of the infringement.

Administrative Penalties

In relation to Administrative Penalties, penalties may include:

for breaches of undertakings and directions: (i) a fixed amount of up to £150,000 or 5% of turnover (whichever is higher) and/or (ii) a daily penalty of up to £15,000 for each day or 5% of the party's daily turnover (whichever is higher).
for non-compliance with an information notice: (i) a fixed amount of up to £30,000 or 1% of turnover (whichever is higher) and/or (ii) a daily penalty of up to £15,000 for each day or 5% of the party's daily turnover (whichever is higher).
for the provision of false or misleading information: a fixed penalty of up to £30,000 or 1% of the party's turnover (whichever is higher).

It would be helpful if the final guidance set out details of the circumstances in which the CMA will consider a fixed penalty to be more appropriate than a daily penalty (and vice-versa), as well as when both may be appropriate.

Stepped approach

The Draft CMA200 guidance sets out the steps the CMA will take when determining the amount of the financial penalty. The CMA proposes to apply a "stepped" approach to the calculation of both Substantive and Administrative Penalties. This is notably different from the CMA's proposed approach to administrative penalties under its competition law or markets and mergers functions (see our July 2024 update). A "stepped" approach means that the CMA will follow a series of steps (set out below) to calculate the appropriate amount of the penalty.

Substantive penalties

Step 1 – calculation of the starting point having regard to the seriousness of the infringement and the relevant turnover

The draft guidance explains that the CMA will:

categorise an infringement (from 1 – 4) based on an assessment of the level of harm and the existence of applicable "escalating factors" (such as if the infringement has a particular impact on vulnerable consumers). For example, Category 1 harm (the most serious) will apply to infringements that have caused major economic or non-economic harm to consumers; and
assign a level of culpability (from high to low). Relevant factors may include regular infringements, the infringement being part of a deliberate strategy and the failure to provide adequate training.

The combination of the seriousness category and the culpability assessment will then determine a starting point code (A, B, C, D) which will be used to set the percentage (as a percentage of the party's UK turnover) that will determine the penalty at Step 1. For example, starting point A will equate to a starting percentage of 22.5% to 30%, applied to the party's UK turnover. The lowest starting point, D, will equate to a starting point of up to 7.5% of the party's UK turnover.

Step 2 – adjustment for deterrence and to take account of the size of the party

The CMA will assess whether an increase from Step 1 is required to deter future infringements by the party (and others), including by reference to the size and financial position of the party. This will typically be assessed on the basis of its worldwide turnover. The draft guidance also notes that an increase may be appropriate where the party has made, or is likely to achieve, an economic or financial benefit from the infringement that exceeds the level of the penalty at step 1.

Step 3 – adjustment for aggravating or mitigating factors

Aggravating factors include (i) continuing the infringement after being warned it may be unlawful or the CMA has commenced its investigation, (ii) breach of an undertaking or direction, (iii) previous infringements of consumer law or regulatory codes, (iv) the involvement of senior management (including by failure to prevent the breach in certain circumstances), and (v) any attempt to conceal the breach from the CMA.

Mitigating factors include (i) if the party is acting in compliance with advice from a Primary Authority or approved Consumer Code prior to launch of the CMA's investigation, (ii) redress having been paid to affected customers prior to launch of the CMA's investigation or before issuance of a PIN, (iii) cooperation with the CMA to allow effective/speedy conclusion of the investigation, and (iv) bringing the breach to the CMA's attention.

Step 4 – adjustment to ensure the penalty is proportionate and the maximum cap of 10% of worldwide turnover is not exceeded

At this step, the CMA will "take a step back" to consider whether the penalty is proportionate in the circumstances (which may result in an increase or decrease). If necessary, the CMA will also adjust the penalty to ensure it does not exceed the statutory limits.

Step 5 – application of a settlement discount where applicable

Administrative penalties

Step 1 – calculation of the starting point having regard to the seriousness of the infringement and the relevant turnover

As above, the CMA will assess the seriousness of the breach (applying a categorisation from 1 (the highest level of seriousness for infringements considered to cause 'major harm' to consumers) to 4) and the level of culpability (from high to low). The draft guidance outlines different factors that may be taken into account depending on whether the penalty relates to (i) breaches of undertakings or directions, or (ii) breaches of information notices. The combination of the seriousness categorisation and culpability assessment will then be used to determine a starting point code, which will determine the starting point percentage.

Unlike in respect of Substantive Penalties, the draft guidance does not provide for specific ranges to apply in relation to each starting point code, but notes that the CMA would generally expect level A breaches to be at the upper end of the range, with level D breaches likely to start at the lower end.

For breaches of undertakings and directions, the maximum starting point at Step 1 will be 30% of UK turnover (i.e. the same as for Substantive Penalties). However, for breaches of information notices, the guidance proposes that the maximum starting point will be the relevant statutory cap.

At this stage, the CMA will also decide whether to apply a fixed rate or daily penalty. A daily penalty can only be used where the breach is ongoing, but the guidance notes that there may be circumstances in which a combination of fixed and daily penalties may be required.

Step 2 – adjustment for deterrence and to take account of the size of the party

The draft guidance notes that the same factors will be considered as in relation to substantive penalties.

Step 3 – adjustment for aggravating or mitigating factors

Aggravating factors include (i) continuing the breach after being notified that the CMA is investigating, (ii) previous breaches of directions, undertakings or information notices (not limited to CMA investigations), (iii) previous infringements of consumer law or regulatory codes (for example, ASA adjudications), or associated administrative infringements, (iv) lack of cooperation or an attempt to conceal the breach, (v) in the case of information notice breaches, failing to request an extension "within a short time after initial receipt", (vi) the involvement of senior management (including by failure to prevent the breach in certain circumstances), and (vii) failure to discipline relevant staff members.

Mitigating factors include (i) proactive cooperation and engagement, (i) bringing the breach to the CMA's attention, (iii) remedying the breach before the CMA issues a provisional notice.

Step 4 – adjustment to ensure the penalty is proportionate and the statutory maxima are not exceeded

As in relation to substantive penalties, the CMA will adjust the proposed penalty to ensure it is proportionate and that it does not exceed the statutory limits.

The CMA does not envisage offering settlement for administrative breaches so this is the final step for calculating administrative penalties.

Whilst using a stepped approach in calculating penalties for consumer law infringements is helpful as it aids transaprency, the Draft CMA200 emphasises the role of penalties in ensuring meaningful deterrence. In competition law investigations, the CMA has applied increasing levels of uplift for deterrence which can make it difficult for parties to determine the range of potential penalties.

The Draft CMA200 indicates that the CMA may have regard to conduct that took place before the DMCC Act entered into force when setting monetary penalties, which is arguably a less welcome development. It is to be hoped that following the consultation process, the CMA will confirm that earlier conduct will not be taken into account when setting any penalties, or, at a minimum, will provide additional guidance on when such conduct would be relevant to the assessment of any penalty.

Remedies

In addition to the ability to impose financial penalties, there are a wide range of remedies or directions (including Enhanced Consumer Measures (ECMs)) which the CMA can choose to apply if it concludes there has been a breach of consumer law. A FIN may also include provision for the requirements imposed (including any penalties) to be binding on other members of the relevant party's group.

ECMs were initially introduced under the Enterprise Act 2002, but to date the CMA has only been able to accept ECMs as part of undertakings agreed with parties or imposed by a Court order. Under the DMCC Act, ECMs can be imposed by the CMA as part of a FIN where the CMA considers it to be just, reasonable and proportionate to do so. There are three different types of ECM:

Redress measures: compensation or other redress offered to affected consumers. This includes consumers that suffered a direct loss as a result of the party's practice, as well as those who are otherwise affected (for example by non-financial loss or instances of distress or inconvenience). Redress can also include contract termination, compensation or collective interest redress (where individual consumers are not identifiable).
Compliance measures: measures that prevent or reduce the risk of the infringing conduct occurring in the future, such as the appointment of a compliance officer, improved training and guidance for staff, or auditing internal processes.
Choice measures: providing consumers with information to assist them in choosing more effectively between suppliers of goods, services or digital content. For example, a company could be required to advertise the infringement and note the steps taken to remedy the situation, or disclose where a component of its product is available for free elsewhere.

Additional guidance on when ECMs may be imposed and the instances in which imposition of the different types of ECMs will be considered reasonable would be welcome given the range of measures that are available to the CMA as ECMs.

Affected consumers will not be obliged to accept the redress made available pursuant to a FIN. However, if they choose to accept the redress, the CMA notes that they may be required to waive their right to take legal action in respect of the conduct that is the subject of the FIN.

Directions may also include Online Interface Notices (OINs), which are essentially requirements to take specified steps in relation to online interfaces, namely software (including websites, applications and other digital content) operated for giving access to or promoting goods, services or digital content. Directions could include requirements to (i) remove / modify online content, (ii) disable or restrict access to an online interface, (iii) display a warning to consumers, or (iv) delete a domain name and facilitate registration of the domain name by the CMA.

Comment

The Draft CMA200 guidance sets out, for the first time, how the CMA proposes to apply its new direct enforcement powers in consumer law and, in particular, its approach to assessing the appropriate amount of the penalty. As anticipated, the processes and procedures will largely mirror the CMA's existing procedures in competition law investigations.

There are a number of clear themes from in Draft CMA200 guidance which indicate how direct enforcement investigations will likely play out in practice:

Timing: Timings are likely to be tight. The draft guidance refers repeatedly to the CMA's duty of expedition, and the proposed timelines that will apply to key procedural steps (such as written representations on the PIN or in response to a provisional administrative enforcement notice) will clearly be short and may prove challenging in more complex cases. It will be important that the CMA carefully balances the duty of expedition with parties' rights of defence, particularly in light of the penalties that may be imposed for consumer law infringements. However, parties should be aware that the deadlines for responding to investigative steps are always likely to be tight.
Risk of significant penalties: there is significant scope for large penalties to be imposed. For example, under the CMA's proposed categorisation, infringing practices which (i) are a regular part of the business' operations, and (ii) cause major or significant harm to consumers would be potentially liable for a penalty assessed from a starting point of between 22.5% and 30% of the party's entire UK turnover. In other words, the draft guidance does not propose that the starting point will be based on turnover in relevant markets (as is the position under the equivalent competition law guidance). The CMA also notes that penalties will seek to provide a "meaningful deterrent".
CMA discretion: the CMA will have broad discretion over when to apply ECMs, such as compensation or other redress mechanisms. Compensation schemes will also not necessarily be limited to consumers who have suffered direct loss as a result of the infringing practice.
Strict approach to compliance: consistent with recent experience in competition law enforcement, the CMA is likely to take a strict approach to compliance with investigative steps (in particular where these may have an impact on the timetable), making use of its new enforcement powers under the DMCC Act.
Expectations of senior management: senior management will generally be expected to understand and comply with the consumer rights regime, as demonstrated by the express inclusion of this as an aggravating factor when determining the level of financial penalty in respect of both Substantive Penalties and Administrative Penalties.

The consultation closed on 18 September 2024. Final guidance is expected to be published in early 2025, before the new enforcement regime commences in April 2025.

With thanks to Olivia Spong for her contribution.

The information provided is not intended to be a comprehensive review of all developments in the law and practice, or to cover all aspects of those referred to.
Readers should take legal advice before applying it to specific issues or transactions.