German bill to bring fundamental change to data protection law, says expert

Consumer rights organisations are already able to take action on behalf of individuals in relation to breaches of consumer protection and unfair competition laws, and the new law would extend that right to disputes about data protection breaches.

Federal minister of justice and consumer protection, Heiko Maas, said in a statement (in German) that it is difficult for individual consumers to even identify where a company has failed to comply with data protection legislation.

Many consumers are afraid of the cost and effort of pursuing such data protection law violations, Maas said, and do not dare to start litigation against large companies. In these situations consumers need a strong advocate for their interests, he said.

Consumer organisations will also now be able to issue cease-and-desist letters. This has been achieved by an amendment to the German law covering injunctions.

Data protection expert Stephan Appt of Pinsent Masons, the law firm behind Out-Law.com, said that the new law will fundamentally change how data protection laws are enforced in Germany.

To date, consumer associations in Germany have had difficulty in challenging data protection shortcomings by companies, Appt said. The law previously required them to prove that a provision in a privacy policy is designed either to regulate market behaviour or to protect consumers, and civil courts have not generally qualified these provisions under either category.

Pressure on businesses will grow, he said, as consumer protection organisations, trade associations and others will be able to send cease-and-desist letters, and file interim injunctions when companies violate data protection provisions.

"Some of these consumer protection organisations are well funded, and have been very active in pursuing businesses for breaches of consumer protection legislation and unfair competition laws in the past. Now they can not only challenge the use of illegal contractual clauses, but also the underlying illegal data handling practices relating to advertising, marketing, the creation of personality and use profiles, and the sale of addresses," Appt said.

Appt said that, according to the draft bill, data protection authorities will have a right to be heard in court.

"It will be interesting to see how conflicting findings will be dealt with, if the data protection authority disagrees with the court's view, and initiates its own enforcement measures," Appt said.