New German Draft Bill Aims at Strengthening Data Protection Rights of Consumers

The German Federal Cabinet has adopted draft legislation that, if approved, will allow civil claims to enforce violations of data protection provisions protecting consumer rights (Entwurf eines Gesetzes zur Verbesserung der zivilrechtlichen Durchsetzung von verbraucherschützenden Vorschriften des Datenschutzrechts—source document in German). The most important change is a new right of consumer associations and other defined associations to bring collective action (akin to the class action trend in the United States) for certain data protection violations that are especially relevant for consumers. 

Background

Consumer associations are currently entitled to initiate proceedings against inadmissible data protection provisions in general terms and conditions, e.g., failure to satisfy the requirements for valid consumer consent.  Consumer associations cannot bring action, however, for certain other data protection violations. This will change if the draft legislation is adopted. Germany's Federal Justice Minister Heiko Maas (Social Democrats) viewed the proposed new right of consumer associations to bring collective action as necessary, arguing that many consumers alone would not bring action against big companies. Minister Maas maintained that consumers need a strong advocate of their interests, namely the consumer associations, to strengthen the enforcement of consumers' rights, for example, with regard to powerful internet companies.

Changes

The draft legislation would, among other things, change the German Act on Injunctive Relief (Unterlassungsklagengesetz—source document in German). It would implement a new collective right of action against companies that collect, process, and use personal data of consumers without authorization. For purposes of the proposed legislation, certain data protection statutory provisions will be deemed consumer protection laws if they apply to companies collecting, processing, or using data for the purposes of advertising, market or opinion research, operation of credit inquiry agencies, creation of personality and usage profiles, address trading, other trade in data, and similar commercial purposes. In the case of violation of these provisions, the eligible associations will be entitled to institute collective legal action against the infringing company to enjoin the practice and (newly inserted) remove the infringement. 

Eligible Associations

The right of action will be granted to consumer associations registered with the German Ministry of Justice or the European Commission. In addition, trade associations fulfilling certain relevance criteria will be eligible, as will the Chambers of Industry and Commerce (Industrie- und Handelskammern) and the Chambers of Crafts (Handwerkskammern).

Consultation of the Data Protection Authorities

As many civil courts do not have practical experience with the application of data protection laws, the draft bill would also implement "a right to be heard" by the competent Data Protection Authority. This right will not be applicable in preliminary injunction proceedings without an oral hearing.

Criticism

Some trade associations have criticized the proposed legislation. The Federal Association for Information Technology, Telecommunications, and New Media ("BITKOM"), for example, has expressed concerns that the proposed legislation will increase legal uncertainty for companies because it creates two different legal proceedings available for data protection violations (i.e., civil court proceedings and proceedings before the competent data protection authority). BITKOM is also worried that such proceedings will severely damage the reputation of companies if a consumer association publicly brings action, even if the claims are judged to be unfounded.

Outlook

The draft legislation could open a new door for litigation in Germany concerning data protection violations. Individual data subjects rarely bring data protection violation claims, even where their data has been misused, and the possibility for associations and competitors to bring claims for data protection violations under the German Unfair Competition Act is restricted to cases of violations of market conduct rules. Consumer associations would likely exercise their right to file legal action for data protection violations to a greater extent. These claims could seek a preliminary injunction in a rather quick process. In light of the criticism the draft bill has received, in particular from trade associations, it remains to be seen if—and to what extent—the draft bill will undergo further changes in the legislative procedure.