UPDATE: Germany to Tighten Data Protection Laws: Consumer Protection Associations and Trade Associations shall be Granted Right to take Businesses to Court

more+
less-
more+
less-

As contemplated in the Newsflash in March 2014[1], the German Federal Ministry of Justice in June 2014 finally presented the new draft bill that allows consumer protection associations as well as trade associations to take businesses to court for data protection law breaches.[2]

Associations are allowed to take direct and own actions
Consumer protection associations and trade associations shall be granted an own right to issue warnings (abmahnen) and to bring actions for injunctions (Unterlassung) and removal (Beseitigung) for the unlawful use of a consumer's personal data. At present, only the individual concerned by a data breach would be entitled to take respective actions, while associations would only be entitled to take actions if the breach has been caused by clauses in general terms and conditions.[3] Under the draft bill, however, all kinds of breaches of the statutory provisions on the collection, processing or use of personal data of a consumer by a business would lead to respective rights of such associations.

German Act on Injunctive Relief as instrument for respective rights and claims
Under the German Act on Injunctive Relief (Unterlassungsklagengesetz) certain laws are considered as consumer protecting[4], consequently giving consumer protection associations under certain conditions the right to issue warnings to businesses breaching consumers' rights under those laws. Further, they are entitled to take such businesses to court with an action for injunction and removal. Claims for damages are not awarded under the German Act on Injunctive Relief. The new rights of the associations would now be integrated by way of an amendment of the consumer protection law list in the German Act on Injunctive Relief, rather than an amendment of the German Federal Data Protection Act (Bundesdatenschutzgesetz) where the provisions could potentially also sit from a content perspective.

Key Changes
The key changes coming with the draft bill are the following:

  • Data protection laws shall be regarded as consumer protection laws within the meaning of the German Act on Injunctive Relief[5] in the case of businesses collecting, processing or using consumer data, thus breaches leading to respective remedies under that Act.
  • Such remedies could be exercised by consumer protection associations that are included as such in a qualifying list, certain qualified trade associations (Wirtschaftsverbände) if the breach does affect the interests of their members, as well as chambers of industry, commerce and trade (Industrie- und Handelskammern, Handwerkskammern).
  • The requirements for consumer protection associations to register in the list of qualified institutions shall be specified to be clearer and more understandable.[6]
  • Associations shall additionally have a claim for removal[7], not limited to data protection cases.
  • The provisions to counter abusive use of claims[8] shall be expanded and contain a claim for compensation of legal costs in case of misuse.
      

Conclusion
Businesses should follow the proposed legislative changes closely. The draft bill shows that consequences of non-compliance with data protection laws will become even more far-reaching. Businesses are well advised to treat data protection law compliance as a key topic, and to keep track of the latest changes and requirements in the data protection laws both on the national and EU levels in order to stay on the safe side.


[1] - See http://www.whitecase.com/Publications/Detail.aspx?publication=4509 (last accessed August 04, 2014).
[2] - See http://www.delegedata.de/wp-content/uploads/2014/06/RefEntwurf-Durchsetzung-Datenschutzrecht-f%C3%BCr-Verbraucher.pdf (last accessed August 04, 2014).
[3] - See Sec. 1 and 3 German Act on Injunctive Relief.
[4] - See Sec. 2 (2) German Act on Injunctive Relief.
[5] - See Sec. 2 (2) No. 11 German Act on Injunctive Relief.
[6] - Cf. the new Sec. 4 German Act on Injunctive Relief.
[7] - See the new version of Sec. 2 (1) German Act on Injunctive Relief, corresponding to Sec. 8 (1) German Act Against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb).
[8] - See Sec. 2b German Act on Injunctive Relief, corresponding to Sec. 8 (4) German Act Against Unfair Competition.

Topics:  Data Protection, EU, EU Data Protection Laws

Published In: Civil Remedies Updates, General Business Updates, Consumer Protection Updates, Privacy Updates, Science, Computers & Technology Updates

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© White & Case LLP | Attorney Advertising

Don't miss a thing! Build a custom news brief:

Read fresh new writing on compliance, cybersecurity, Dodd-Frank, whistleblowers, social media, hiring & firing, patent reform, the NLRB, Obamacare, the SEC…

…or whatever matters the most to you. Follow authors, firms, and topics on JD Supra.

Create your news brief now - it's free and easy »