Following the adoption of the draft Regulation of European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), the German legislator approved on 17th December 2015 the right of Consumer Protection and Competition Associations to take legal actions for violations of consumer-protection regulations with regard to data protection.
On 29th January 2016, the Act took the last hurdle by passing the Bundesrat (German Federal Council). Amendments of the German Act on Injunctive Relief (Unterlassungsklagengesetz – UKlaG) are due to come into force on signature by the President of the Federal Republic of Germany and following their publication in the Federal Law Gazette (Bundesgesetzblatt).
The decision will have far-reaching implications for dealing with privacy provisions in future. Compliance with certain data protection regulations will no longer be controlled by data protection authorities only but also by private institutions. Furthermore, it is most likely that companies might take the new consumer-protecting regulations of UKlaG as an occasion to enforce data protection provisions under unfair trade practices law against their competitors. As a result, this will most likely lead to an increase in litigation.
At the start of the formal legislative procedure, the coalition committee of German Christian and Social Democrats agreed on a resolution for the amendment in legislation by the end of November (Printed Paper 18/6916) which will enable private institutions such as Consumer Protection Associations to take legal actions for infringement of any provision of the consumer-protecting regulations. Primary reason for this short-term decision were consultations between the EU Council, the European Commission and the European Parliament (the so-called trilogue consultations) on the General Data Protection Regulation with regard to an exemption clause enabling national legislators to grant private associations the right to take legal actions against data protection violations by enterprises.
The proposed amendments in detail
This change in legislation shall strengthen the possibility for law enforcement measures regarding the data protection rights of consumers. These rights are considered as potentially endangered due to increasing use of personal data by companies for commercial purposes. Up to now, only the affected individuals themselves and data protection authorities were able to take legal actions against breaches of data protection provisions. In order to now grant this right also to certain associations, provision which regulate use of consumer data now have been adopted into consumer protection law.
- Extension of the catalogue of consumer protection laws, Sec. 2 (2) No. 11 UKlaG-E
- Consumer protection law shall be considered all regulations in connection with the collection, processing and use of consumer’s personal data by a company with regard to advertising, market research, opinion surveys, operation of credit bureaus, creating personal and user profiles, address broking as well as any other data broking activities for similar commercial purposes.
- In contrast, the collection, processing and use of personal data by companies for purposes of the establishment, execution or termination of the contractual or similar relationship is not considered to be performed for commercial purposes.
- The right for elimination (Sec. 2 (1) UKlaG-E)
- In addition to claims for injunctive relief, associations may in future also claim for th elimination (e.g. the deletion of data in cases of improper data storage). This provision is in parallel to Sec. 8 (1) of the Unfair Trade Practises Act (UWG) and is applicable to all legal issues in connection with UKlaG.
- Data protection authorities consultation rights, Sec. 12a UKlaG-E
- Data protection authorities shall generally be consulted in order to ensure that they are duly informed at all times and that their expertise is used in the best possible way and to the largest extent possible. This does not apply to cases of interim relief where an application for an injunctive relief may be judged without a hearing.
- Transitional provision with regard to “Safe-Harbor”, Sec. 17 UKlaG-E
- In order to address uncertainties resulting from the ECJ judgment of 1st October 2015 (Case no. C-230/14 – “Schrems”), the UKlaG amendment regarding violations in connection with international data transfers in accordance with Sec. 4b of the German Federal Act on Data Privacy (Bundesdatenschutzgesetz – BDSG) shall only from 30. September 2016. In the meantime, this judgment does not provide a legal basis for legal actions initiated by associations.
- Reporting duties for authorized associations, Sec. 4 (2a) UKlaG-E
- In order to ensure proper performance of duties, the authorized associations are obliged to provide report to the German Federal Ministry of Justice on annual basis about the quantity and results of legal warnings and claims.
Finally, as a part of the reform, there will also be changes in the German Civil Code (Bürgerliches Gesetzbuch – BGB) regarding consumer protection. In accordance with Sec. 309 No. 13 BGB-E, general terms and conditions may only require text form rather than written form for declarations and announcements, which the consumer has to make to the user of the terms and conditions or to a third party. Termination via email shall be considered as sufficient. Only for contracts where notarized form is required, the written form may still be mandatory in general terms and conditions. In accordance with Sec. 675a BGB, legal obligations to supply information in connection with standard business workflows, i.e. certain banking services, must be fulfilled in writing.
Impacts for future dealing with data protection issues
- The amendments shall apply to all enterprises which collect, store and use consumer and customer data for advertising and distribution activities.
- It is most probable that there will be a range of claims brought by consumer protection institutions and represented with a publicity effect (especially German Consumer Associations) as these institutions have repeatedly demanded for statutory amendments.
- In addition, courts might consider the new consumer-protecting provisions of UKlaG as market conduct rules as laid down in the Unfair Trade Practises Act (UWG). This is likely to result in additional competition law proceedings.