Germany – Consumer associations to have right to sue companies for breach of Data Protection Laws
Published 3 March 2016
What does this cover?
The amendment to the Act on Injunctive Relief (Unterlassungsklagengesetz) (the Act) offers better protection to consumers in cases of breach of data protection provisions in Germany. The Act, which came into force on 24 February 2016, provides a right for consumer associations to sue companies when such breaches occur. The previous legal position on this point was not clear and the question of whether breaches of data protection provisions could be asserted under the Act had been analysed inconsistently by the German courts. The present amendment is intended to clarify the position. At the same time, the law concerning general terms and conditions (Allgemeine Geschäftsbedingungen) has also been changed in favour of consumers.
The Act now expressly sets out that data protection provisions fall within the scope of consumer protection law within the meaning of the Act. The immediate consequence is that the consumer does not have to become legally active him/herself as the Act provides the opportunity for eligible entities to become active on behalf of consumers, such as consumer associations entered in the list of so-called “qualified establishments” (qualifizierte Ein-richtungen). Apart from these consumer associations, other industry associations, chambers of industry and commerce and chambers of craft may be entitled to sue in certain situations.
Amendments to the Act require companies not only to refrain from further breaches but also to eliminate data. According to the explanatory memorandum, the content and scope of the elimination claim shall be based on the specific data protection provisions concerning the correction, erasure and blocking of data contained in the Federal Data Protection Act. In addition, provided such claims are enforced in court, the court is obliged to hear the responsible domestic Data Protection Authority before taking its decision. The Act takes into account that it still needs to be possible to use data in order to establish, perform or terminate a contractual or quasi-contractual obligation with the consumer, which is why a corresponding use of the data has been expressly excluded from the scope of the Act.
This Act also amends the law concerning general terms and conditions. No stricter form than text form may be agreed for statements and notifications to be made vis-à-vis the entity making use of the general terms and conditions. Consumers frequently understood the agreement of the written form in general terms and conditions to require a letter signed in their own hand in order to communicate with the company. The intention of the amendment is that termination of contracts will not be made unnecessarily complicated for consumers.
To view the text of the amended Act, please click here (German).
Article submitted by Clemens Wieder – Associate in the IP/IT law department – Luther Rechtsan-waltsgesellschaft – Frankfurt am Main, Germany
What action could be taken to manage risks that may arise from this development?
Due to this amendment, German, and the German entities of, organisations should ensure more than ever that data protection provisions are complied with.
An increase in legal proceedings concerning data protection issues is to be expected which might also significantly affect the reputation of the organisations concerned.
In addition, organisations will be required to update their general terms and conditions in order to take account of the new legal position and to prevent the invalidation of provisions concerning the agreed form for statements and notifications.