Transmission of customer data in relation to asset deal: Data protection supervision imposes high penalties
> August 2015

The Bavarian Office for Data Protection Supervision (BayLDA) has announced in a press release that it has imposed five digit penalties on the sellers and buyers of a company (asset deal) because of infringement of the data protection rules governing the handling of customer data (now incontestable). In the sale of an online shop connected with an asset deal, the e-mail addresses of customers were passed on to the buyer. No authorisation was obtained from the customers to disclose the e-mail addresses and no advance notice was given of the planned disclosure nor a right of objection. Not only the seller but also the buyer as “responsible parties” in the meaning of the Federal Data Protection Act (BDSG) bear responsibility for the protection of the transferred data. The seller transfers the data and the buyer collects the data. Both actions – if they are not permitted under data protection law – incur monetary penalties.

The BayLDA also named the transfer of telephone numbers, account and/or credit card details and “sales histories”, i.e. information about purchases previously made by the customers, as other practical examples. The data protection regulations should therefore be complied with in every asset deal in which the disclosure of customer data of private individuals is considered.

Click here for the press statement by the BayLDA of 30 July 2015 (German).