Strengthening data privacy law: draft provides for civil-law right of association to bring collective action for data privacy violations
> May 2015
Some time ago, the Federal Government recognised that that best data-privacy-law provisions are of little use if they cannot be enforced. To reduce the execution deficits in data privacy law, the Federal Government submitted a draft to the Bundestag that extends the right to warn and raise actions of consumer protection associations according to Injunctive Relief Act (Unterlassungsklagengesetz; UKlaG) to provisions under data privacy law. The change to the law is expected to enter into effect this year.
According to the current legal situation, the data privacy authorities may terminate data privacy violations with supervisory-law measures and impose files, but are overburdened for reasons of capacity. According to the opinion of the Federal Government in the reasons for the draft of the law from 15 April 2015, comprehensive control was not possible due to the number of companies and the continually rising scope of their data collection, data processing and use. The planned change to the law was therefore to give consumer protection associations the option of issuing warnings in case of data privacy violations committed by companies towards consumers, and to enforce injunctive relief and removal claims in court. This not revolutionary, since the present legislation already includes data-privacy rules in general terms and conditions (Allgemeine Geschäftsbedingungen; AGB) in the right of associations to raise actions according to the UKlaG. The Verbraucherzentrale Bundesverband e.V. is conducting court procedures against, e.g., Google and Facebook, with public effect, to have possible violations of data privacy law by their terms and conditions reviewed. Contrary to the statements of the Federal Government, several higher regional courts (Oberlandesgerichte) also have already considered violations of data privacy laws to be unfair business acts in the sense of § 4 no. 11 of the Law against Unfair Competition (Gesetz gegen unlauteren Wettbewerb; UWG). This would open up the path for actions raised by associations. A judgement of the Federal Court of Justice on this is not available yet, and the consumer protection associations are therefore not taking steps against data protection violations of medium-sized enterprises.
It can be expected that the change to the law will enter into effect this year and that data privacy law will then increasingly be the object of court disputes. Specifically, medium-sized enterprises will also be affected by the change, since consumers will then not only be able to contact the (currently over-stressed) supervisory, but may involve a consumer association.
The draft law is in part strongly criticized and the least hearing before the committee for law and consumer protection was controversial as well, as can be taken from the report of the Bundestag from 06 May 2015. The draft law can, however, be taken as a reason to review the processes of the own company in which personal data are collected, processed and used, or to have them reviewed.
The draft law of the Federal government from 15 April 2015 (printed matter 18/4631) can be found here.
