Which law governs a cross-border tort in the EU?

Short answer

Regulation (EC) No 864/2007, known as Rome II, generally selects the law governing a cross-border non-contractual obligation in civil and commercial matters. Its starting rule is the law of the country where the direct damage occurs—not necessarily where the defendant acted, uploaded content, manufactured a product or holds a bank account.

That starting point changes with the claim:

• product liability uses a cascade based on the injured person's habitual residence, acquisition and place of damage, combined with where the product was marketed;
• environmental damage lets the claimant choose between the law of the place of damage and the law of the place of the event causing it;
• unfair competition follows the market or collective consumer interests affected, while restrictions of competition follow the affected market;
• defamation and other violations of privacy and personality rights are excluded from Rome II, leaving the forum's national conflict-of-laws rules to select the applicable law; and
• a claim under directly applicable EU legislation, such as the General Data Protection Regulation (GDPR), must first be distinguished from a supplementary national privacy or economic tort.

Jurisdiction and applicable law are separate. A court may have jurisdiction under Brussels I bis yet be required by Rome II to apply another country's substantive law.

The general rule: law of the place of direct damage

Rome II applies to conflicts of laws concerning non-contractual obligations in civil and commercial matters. It does not cover revenue, customs or administrative matters, or State liability for sovereign acts. It has universal application: a participating Member State's court must apply the law selected even if it is the law of a non-EU country. Denmark is not bound by Rome II.

Article 4(1) states the default:

“the law applicable to a non-contractual obligation arising out of a tort/delict shall be the law of the country in which the damage occurs”. — Rome II Regulation, Article 4(1)

The place of the event causing damage and countries suffering only indirect consequences do not control that rule. If both parties habitually resided in the same country when the damage occurred, Article 4(2) instead applies that common law. Article 4(3) supplies a narrow escape where the tort is manifestly more closely connected with another country, potentially because of a closely connected pre-existing contract.

Physical injury ordinarily occurs where sustained; property damage where the property is damaged. Pure economic loss and online conduct require identification of the protected interest and first legally relevant injury. In Wunner, C-77/24, the Court located an online player's gambling loss in the Member State where the player habitually resided and participated; losses on the player account or personal bank account were indirect. That claim-specific result does not make habitual residence the rule for every internet tort. Article 4(3)'s manifestly-closer-connection exception remains available only exceptionally.

“the damage sustained by a player must be deemed to have occurred in the Member State in which that player is habitually resident”. — Court of Justice, Wunner, C-77/24, paragraph 56

Online publication and data misuse require classification first

Rome II contains no general “law of the internet”. An online publication claim must be classified by the obligation asserted.

Article 1(2)(g) excludes non-contractual obligations arising from violations of privacy and personality rights, including defamation. A participating court must therefore use its own national conflict rules for a defamation, reputation, image or personality-right tort. Those national rules are not uniform across the EU. Rome II's place-of-damage rule should not be imported into the excluded category by assumption.

“Data misuse” is not a single conflicts category. The GDPR's own territorial scope determines whether it applies; Rome II does not turn it on or off. Parallel national privacy, confidentiality, consumer or economic torts require separate classification. Personality/privacy may be excluded, while competition or collective-consumer conduct may fall within Article 6.

In Verein für Konsumenteninformation, C-191/15, the Court of Justice separated the law governing a consumer body's non-contractual injunction from the law governing the contract terms themselves. For the Article 6(1) limb, it explained:

“the country of residence of the consumers to whom the undertaking directs its activities”. — Court of Justice, Verein für Konsumenteninformation, C-191/15, paragraph 43

That judgment concerned a collective consumer injunction and does not make consumer residence the rule for every online tort. It shows why each obligation needs separate classification.

Product harm follows a marketing-based cascade

Article 5 governs damage caused by a product, subject first to Article 4(2) where both parties share a habitual residence. Otherwise, it applies:

1. the law of the injured person's habitual residence when the damage occurred, if the product was marketed there;
2. failing that, the law of the country of acquisition, if it was marketed there; or
3. failing that, the law of the country where damage occurred, if it was marketed there.

If the defendant could not reasonably foresee marketing the product, or the same type of product, in the country selected by that cascade, the defendant's habitual-residence law applies. A manifestly closer connection can also displace the result.

Manufacture, purchase, marketing and injury must each be mapped; manufacture is not decisive. EU product legislation may harmonise the selected law without replacing the Rome II exercise. A convention binding the forum may take priority under Article 28.

Environmental damage gives the claimant an option

Article 7 covers environmental damage and personal or property damage resulting from it:

“the law of the country in which the event giving rise to the damage occurred”. — Rome II Regulation, Article 7

Without that choice, Article 4(1) applies the law of the country where the environmental damage occurs. The option protects a claimant where pollution crosses a border and the law at the source is more favourable or better adapted to regulating the conduct. The claimant must make the choice according to the procedural law of the forum.

Competition claims follow the affected market

Article 6 distinguishes three situations:

• unfair competition affecting market relations or collective consumer interests is governed by the law of the country where those interests are, or are likely to be, affected;
• an act affecting only a specific competitor returns to Article 4; and
• a non-contractual obligation arising from a restriction of competition is governed by the law of the country whose market is, or is likely to be, affected.

For damage across several markets, a claimant suing at the defendant's domicile may elect the law of that court if its Member State market is among those directly and substantially affected. Additional conditions apply when several defendants are sued together. Parties cannot contract out of Article 6 through a Rome II choice-of-law agreement.

Affected-market evidence may both support the competition claim and identify the governing law. One cartel or abuse can therefore engage different laws in different national markets unless the forum-law election applies.

What the selected law governs

Under Article 15, the selected law governs the basis and extent of liability, liable persons, defences, limits and division of liability, damage and remedies, vicarious liability, transfer of claims and prescription or limitation. Forum procedure and evidence generally remain outside Rome II, although Article 22 gives the applicable law a role for legal presumptions and burden of proof.

The distinction matters for limitation periods. In Da Silva Martins, C-149/18, the Court held that the forum cannot lightly replace the selected law's period with its own:

“a detailed analysis of the wording, general scheme, objectives and the context in which that provision was adopted”. — Court of Justice, Da Silva Martins, C-149/18, operative point 1

Article 16's overriding-mandatory exception is interpreted strictly. Article 17 separately requires the court, as a factual matter, to take appropriate account of safety and conduct rules in force at the place and time of the harmful event. Article 26 allows refusal of foreign law only where its application is manifestly incompatible with forum public policy.

Can the parties choose the law?

Parties may generally choose the law after the harmful event; commercial parties may also negotiate a choice beforehand. It must be reasonably certain, preserve third-party rights and respect otherwise applicable non-derogable rules.

Articles 6 and 8 prohibit a choice for competition and intellectual-property claims. A choice also cannot override special EU conflict rules, overriding mandatory provisions or public policy.

A practical sequence

For each alleged wrong:

1. separate contractual obligations, governed by Rome I, from non-contractual obligations;
2. confirm that the matter is civil or commercial and within Rome II's temporal and territorial scope;
3. identify exclusions, especially privacy, personality and defamation;
4. test the specific rules for products, competition and environmental damage before Article 4;
5. locate direct damage, habitual residences, marketing countries, affected markets and the causal event;
6. check any valid party choice, special EU conflict rule or pre-existing international convention; and
7. distinguish substantive law, limitation, safety rules, evidence and forum procedure.

Under Homawoo, C-412/10, Rome II applies only to events giving rise to damage after 11 January 2009. The filing date and the date when the court determines applicable law do not change that temporal test.

Conclusion

The claimant's preferred court, a website location or the label “data case” does not select the law. Rome II starts with direct damage, applies special rules for products, environmental harm and competition, and leaves defamation and personality/privacy torts to national conflict law. Each obligation must be classified and its connecting facts mapped separately.

Sources

• Rome II Regulation, consolidated text of Regulation (EC) No 864/2007
• Court of Justice judgment in Verein für Konsumenteninformation, C-191/15
• Court of Justice judgment in Da Silva Martins, C-149/18
• Court of Justice judgment in Homawoo, C-412/10
• Court of Justice judgment in Wunner, C-77/24