As contemplated in the Newsflash in March 2014, the German Federal Ministry of Justice in June 2014 finally presented the new draft bill that allows consumer protection associations as well as trade associations to take businesses to court for data protection law breaches.
Associations are allowed to take direct and own actions
Consumer protection associations and trade associations shall be granted an own right to issue warnings (abmahnen) and to bring actions for injunctions (Unterlassung) and removal (Beseitigung) for the unlawful use of a consumer's personal data. At present, only the individual concerned by a data breach would be entitled to take respective actions, while associations would only be entitled to take actions if the breach has been caused by clauses in general terms and conditions. Under the draft bill, however, all kinds of breaches of the statutory provisions on the collection, processing or use of personal data of a consumer by a business would lead to respective rights of such associations.
German Act on Injunctive Relief as instrument for respective rights and claims
Under the German Act on Injunctive Relief (Unterlassungsklagengesetz) certain laws are considered as consumer protecting, consequently giving consumer protection associations under certain conditions the right to issue warnings to businesses breaching consumers' rights under those laws. Further, they are entitled to take such businesses to court with an action for injunction and removal. Claims for damages are not awarded under the German Act on Injunctive Relief. The new rights of the associations would now be integrated by way of an amendment of the consumer protection law list in the German Act on Injunctive Relief, rather than an amendment of the German Federal Data Protection Act (Bundesdatenschutzgesetz) where the provisions could potentially also sit from a content perspective.
The key changes coming with the draft bill are the following:
- Data protection laws shall be regarded as consumer protection laws within the meaning of the German Act on Injunctive Relief in the case of businesses collecting, processing or using consumer data, thus breaches leading to respective remedies under that Act.
- Such remedies could be exercised by consumer protection associations that are included as such in a qualifying list, certain qualified trade associations (Wirtschaftsverbände) if the breach does affect the interests of their members, as well as chambers of industry, commerce and trade (Industrie- und Handelskammern, Handwerkskammern).
- The requirements for consumer protection associations to register in the list of qualified institutions shall be specified to be clearer and more understandable.
- Associations shall additionally have a claim for removal, not limited to data protection cases.
- The provisions to counter abusive use of claims shall be expanded and contain a claim for compensation of legal costs in case of misuse.
Businesses should follow the proposed legislative changes closely. The draft bill shows that consequences of non-compliance with data protection laws will become even more far-reaching. Businesses are well advised to treat data protection law compliance as a key topic, and to keep track of the latest changes and requirements in the data protection laws both on the national and EU levels in order to stay on the safe side.