Germany: Consumer protection associations can bring class actions for data protection law infringements Amendments to the German Act on Injunctive Relief The German Parliament has passed an amendment of the German Act on Injunctive Relief in December 2015 giving eligible associations, such as consumer protection associations which are registered with the German Ministry of Justice or the EU Commission or, under certain circumstances, associations for the promotion of commercial or independent professional interests, or the Chambers of Industry and Commerce, the right to bring cease and desist actions against companies in case of violations of certain data protection law provisions, which serve the purpose of protecting consumers. Such provisions are, amongst others, provisions that govern the collection, processing and use of personal data for the purpose of advertising, market or opinion research, credit scoring, profiling, address and other data trading and similar commercial purposes. Once the amendment has been approved by the Federal Council, it will likely come into effect in March of 2016. Eligible associations are entitled to seek interim injunctions both in order to enjoin and suspend data protection law infringements. The data protection authorities have a right to be heard in the legal proceeding against the infringing companies. However, eligible associations cannot bring such class actions in case of infringements of international data transfer provisions until and including September 30, 2016 in so far as the transfer of data was performed on the basis of the Safe Harbor Principles prior to the Schrems decision of the European Court of Justice. Outlook In the future, eligible associations will be able to bring class actions to actively force companies to comply with German data protection laws aiming at the protection of consumers. In light of the recent Google Spain and Weltimmo decisions of the European Court of Justice the amendment of the German Act on Injunctive Relief may affect companies located outside of Germany as well, if they have an establishment or representative in Germany and are processing data of data subjects in Germany. The General Data Protection Regulation (GDPR) which is still pending will expand the application of European data protection law even more and will likely further increase the impact of this new right to bring class actions by eligible associations. For more information, please contact Julia Wendler or Tina Gausling.