The Bavarian Data Protection Authority (BDPA) has issued a press release which states that it has imposed a significant fine of upwards of five figures, on both the seller and the purchaser in an asset deal for unlawfully transferring customer personal data as part of the deal.
The BDPA stated that customer data often has significant economic value to businesses, particularly with respect to delivering personalised advertising. Upon termination of its business, a company may sell its valuable economic assets to another company as part of an asset deal – this includes customer data.
The BDPA said that businesses that acquire customer email address and phone numbers and plan to use the information for advertising purposes need the "express consent" of consumers to do so. Failure to obtain this consent is a breach of both German data protection laws and laws against unfair competition, it said.
Thomas Kranig, President of the BDPA stated that 'Companies and liquidators must be aware that personal customer data may not be sold like any commodity'. Indeed, the BDPA has stated that it will act similarly in future cases and will not hesitate to fine companies that sell customer data in a non-compliant manner during asset deals.