Who: German Federal Ministry of Justice and Consumer Protection
When: 11 February 2014
Where: Germany
What happened:
In a recent press release, the German Ministry of Justice and Consumer Protection (“Bundesministerium der Justiz und für Verbraucherschutz”) announced that consumer protection bodies shall be allowed to enforce data protection law rules – a right that they did not have so far.
According to the government’s plans, consumer protection bodies shall be assigned the right to enforce data protection laws by taking legal steps against the unlawful use of consumers’ personal data in a form of “collective action” (“Verbandsklage”). As a result, consumer protection bodies would then be able to issue warning notices or to apply for injunctive relief in front of a court if they see a breach of the German Data Protection Act or other applicable laws protecting personal data.
The draft bill that amends the German Act on Injunctive Relief (“Unterlassungsklagengesetz”) is expected to enter parliamentary hearings in April 2014 and may enter into force even before year end.
The proposed amendment anticipates a major innovation currently discussed rather controversially in connection with the proposed EU Data Protection Regulation (the latest draft of which also provides that organisations aiming to protect data subjects’ rights shall have the right to take legal steps under certain circumstances).
Why this matters:
This new development will have a huge impact in practice once implemented into German law.
By way of background, currently only data subjects themselves whose personal data have been affected by a data protection law breach are entitled to take legal steps and to seek an injunction (or to ask the competent data protection regulator to take action).
The rights of consumer protection bodies in this context are currently very limited. They can only be exercised in cases where provisions of a company’s general terms and conditions infringe data protection laws.
Experience shows that consumer protection bodies have been a main driver behind the enforcement of consumer protection laws in Germany over the last decade. This proposed new law will further strengthen their position.
It is to be expected that consumer protection bodies will make avid use of their new right to enforce data protection law compliance. So far, in case of non-compliance the risk in practice was somewhat limited due to the also limited resources of the German data protection regulators. Usually, only high-profile cases are currently investigated by the authorities.
In the future and under the new proposed law, the rules of the game might change: Consumer protection bodies have a rich tradition of vigorously following up consumer complaints in even small scale cases. Thus, the actual risk in connection with non-compliance with data protection laws will dramatically increase in Germany should the proposed new law become reality.
The press release of the German Ministry of Justice and Consumer Protection is available in German language here.
