Retail insolvencies have recently hit a five-year high, partly due to the increasing popularity of internet shopping, and more bricks and mortar retail businesses are moving into online selling. Many startups that might once have chosen to launch their business with a physical retail premises may now start with an online presence.
As well as the usual commercial issues around usability, pricing, design and so on, there are a number of legal issues which should be considered when selling goods or services over the internet. In particular, SMEs should be aware of the regulation surrounding consumer rights and data protection.
Consumer law and consumer rights
Any e-commerce retailer operating in the EU and selling to consumers will be subject to regulations relating to distance selling, including online selling. On 13 June the laws surrounding consumer rights became more detailed and prescriptive.
Under the new rules, certain specified information must be made available to the customer before they complete their purchase, including information about the consumer's right to cancel the order within 14 days. In addition, much of the same information now needs to be sent to the customer again after the contract is concluded by email or hard copy.
The information that must be presented to a customer immediately before they pay has also changed (for example, the retailer would need to show the consumer an order form showing a description of the goods, the identity of the seller and the price including all delivery fees).
There is even a requirement that the button that the consumer presses in order to complete their order must include an acknowledgement that they will have to pay for the goods or services. SMEs should ensure they supply this information as failure to do so may be considered a criminal offence.
Many SMEs may choose to use existing e-commerce platforms for their online offering. However, businesses should exercise caution when doing so as US-based platforms may not be compliant with EU regulations. For instance, they might give a consumer 12 months to cancel their order rather than 14 days.
Data protection and credit card data
Any data collected by an online retailer will be subject to the Data Protection Act and similar legislation in other EU countries. Retailers should ensure that they have a privacy policy explaining how they propose to use customer data. It is generally acceptable for a retailer to use personal data in order to fulfil an order but disclosure to third parties will require explicit consent.
If a retailer proposes to collect and process credit card payments directly, they would need to comply with the Payment Card Industry Data Security Standard (PCI-DSS) which includes security and encryption requirements for any business that stores, processes or transmits payment cardholder data. Compliance with these rules, which are generally imposed by global payment brands and participating organisations, will be difficult for most SMEs.
It may be easier for SMEs to use or licence a payment gateway from a third party, such as PayPal, who will collect the data and process the payment on behalf of the retailer. Retailers should ensure they use reputable payment gateways which are compliant with local data protection standards as the implications of non-compliance can be very serious.
Guy Wilmot is a partner in the corporate and commercial team at Russell-Cooke LLP.
Read more...
Avoiding mobile fraud: What small businesses need to know
From eBay to Etsy and beyond: what to consider when selling goods online
Sign up to become a member of the Guardian Small Business Network here for more advice, insight and best practice direct to your inbox.
Comments (…)
Sign in or create your Guardian account to join the discussion