Consumer advocacy groups gain right to file collective action in data privacy matters

On February 24, 2016, the Law to Improve the Enforcement of Rules for the Protection of Consumer Data Privacy went into effect. The new law allows consumer-protection and competition associations to issue warning notices or file action against companies that violate certain data-privacy laws.

Contents of the new law

The German Act on Injunctive Relief allows that a party that is in violation of certain consumer-protection laws may be sued by consumer-protection and competition associations for injunctive relief of the violation. The catalogue of the relevant consumer-protection laws has now been extended to certain data protection provisions by the new Section 2 para. 2 no. 11 of the Act on Injunctive Relief. In future, companies which collect, process or use consumers' personal data in an illegal manner may be sued by consumer protection or competition associations. This will only apply however if the data is collected, processed or used for purposes of advertising, market and opinion research, for use by credit/reporting agencies, for creating profiles on consumer's personality and unsafe profiles, for trading of addresses and other data trading or for other similar commercial purposes. Violation explicitly does not include cases in which the consumer's data is processed for purposes of establishing, performing or terminating a contract/transaction, thus in particular where personal data is processed for the purposes of an existing contract between a company and the consumer.

The right of the consumer-protection and competition associations to take action supplements the power of the data protection authorities to issue orders and to impose administrative fines. Although, in the event of a suit the data protection authorities must be given the opportunity to be heard by the court before the court's decision, this rule does not apply if the court is deciding on a temporary injunction without a hearing being held. Since this is often the case in practice, it should be expected that the right of the data-protection authorities to be heard will not play a major role.

The new law has come into force on February 24, 2016. Up until September 30, 2016 the law will not apply to personal data that was transmitted to the U.S. under "Safe Harbor" arrangements prior to October 6, 2015. For any personal data being currently transmitted to the U.S., however, the new provisions already apply.

Forecast

Consumers may welcome this new law. For companies, however, the new law will lead to the danger of further sanctions. Furthermore – as is feared by some – the new law may result in more legal uncertainty due to the now existing different recourses to the court. All companies which collect, process and use personal data for the purposes described above are affected. Since almost every company uses personal data for advertising, the new law affects almost everyone. In future, companies that violate data-privacy laws run the additional risk to be sued not only by consumer protection and competition associations. Claims under consumer-protection laws are usually also violations under the Act against Unfair Competition, meaning they may also be pursued by competitors, which further increases the danger of being sued. In any event, companies are highly advised to examine their data-processing to ensure that it meets the requirements of data-protection laws.