Legal & Risk: What Businesses Need to Watch
Date: 2026‑08‑24
Every headline carries a hidden compliance tail‑end that most managers overlook. This week’s stories show how seemingly routine events – from price corrections on an e‑shop to a mega banking merger – trigger concrete legal obligations in South Africa, the EU and beyond.
---
1. Online Retailer Price Corrections Under the CPA
As reported by MyBroadband in “Laws for online retailers cancelling orders due to incorrect prices in South Africa”, a Makro marketplace order was cancelled after an “incorrect price” of R1 299 was discovered. While the Consumer Protection Act (CPA) already governs in‑person sales, it extends to e‑commerce with strict provisions:
- Right to cancel – Consumers may rescind a purchase if the price is materially incorrect before delivery. The seller must honour the cancellation and refund any payment received.
- Unfair practice – Delaying a refund or refusing to comply can be deemed an unfair commercial practice under section 6(1) of the CPA, exposing the retailer to statutory penalties and potential claims for damages.
- Contractual clarity – The e‑commerce platform must have explicit terms that explain how pricing errors are handled, including time frames for cancellation requests and refund procedures.
- Companies Act No. 71 of 2008 compliance – All order records must be maintained in a reliable manner. If a spreadsheet is used to track orders, it constitutes an official record; failing to preserve such documents can attract director liability.
- POPIA implications – Personal data (e.g., the customer’s name, address, payment details) that is processed for price‑validation purposes must meet POPIA’s lawful basis, purpose limitation and data minimisation clauses.
Compliance Actions
- Implement automated price‑verification checks at the point of sale to flag potential errors before checkout completes.
- Draft clear “Price‑error” clauses in the terms & conditions that outline the cancellation and refund process, ensuring they are displayed prominently during purchase.
- Audit all order‑recording tools (spreadsheets, CMS modules) for statutory record‑keeping compliance under the Companies Act and POPIA.
---
2. Cross‑Border Bank Merger Raises EU Regulatory Concerns
In a headline that made headlines in Europe, Euronews reported on the Monte dei Paschi bid to merge Banco BPM with Banca Generali, creating an €80 bn Italian bank. While the deal promises scale, it sits squarely under multiple regulatory frameworks:
- EU Banking Supervision – The Capital Requirements Regulation (CRR) and Capital Requirements Directive (CRD) require that the combined entity meets leverage and liquidity ratios. Any shortfall triggers supervisory intervention or remedial action plans.
- Basel III compliance – Tier‑1 capital adequacy, stress‑testing and the Net Stable Funding Ratio must be calculated on a merged basis; inconsistencies can lead to sanctions.
- Competition law – The European Commission’s Merger Regulation mandates that any cross‑border bank that would reduce market competition above 15 % is subject to approval or requires a remedy package.
- GDPR data‑merging implications – Customer account information will be consolidated, triggering the need for a Data Protection Impact Assessment (DPIA) and strict consent management if personal data are combined without prior lawful basis.
Compliance Actions
- Engage early with ECB/ESMA to secure supervisory approvals on capital adequacy and liquidity projections before the closing date.
- Commission a comprehensive antitrust review by EU competition lawyers to anticipate required remedies or conditions that may be imposed by the Commission.
- Conduct a GDPR DPIA focused on data consolidation, mapping customer consent flows, and establishing robust data‑sharing agreements between the legacy systems.
---
3. EDF Nuclear Expansion: Environmental & Safety Compliance
Euronews also reported that EDF is preparing the Gravelines site for two new nuclear reactors. While the headline highlights a capacity boost, the legal backdrop is thick with safety, environmental and community obligations:
- French Energy Act – Requires extensive safety licensing under the Code de l’Énergie; any new reactor must undergo rigorous technical assessments before permits are issued.
- EURATOM directives – The French regulator must align with European Atomic Energy Community safety standards, which include comprehensive risk analyses and public consultation stages.
- EU Environmental Impact Assessment Directive – A full EIA report is mandatory for projects that could significantly affect the environment; failure to complete it can halt construction and lead to fines under Article 9 of the directive.
Compliance Actions
- Secure all French nuclear safety licenses by completing the required technical dossier, ensuring compliance with the Code de l’Énergie’s latest revisions.
- Prepare an exhaustive EIA that satisfies both national and EU thresholds, incorporating community feedback loops to mitigate opposition risk.
- Establish a cross‑border legal team (France + EU) to navigate dual regulatory frameworks and monitor any changes in the EURATOM safety directives that may affect the project timeline.
---
Review Note
The interpretations above rely on the headlines as provided; deeper contractual nuances or sector‑specific exceptions (e.g., special e‑commerce exemptions, banking sector transitional provisions) could alter risk profiles. A qualified South African corporate lawyer should confirm POPIA application to automated pricing checks, while an EU banking specialist must validate that Monte dei Paschi’s proposed capital ratios meet current CRR/CRD thresholds.
---
Sources