Germany to expand consumer associations’ right to sue companies for breach of data protection laws

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.jdsupra.com/legalnews/germany-to-expand-consumer-associations-76839/


On 17 December 2015, the German Parliament (Deutscher Bundestag) passed a
bill on the improvement of enforcement of data protection provisions
protecting consumers (Entwurf eines Gesetzes zur Verbesserung der
zivilrechtlichen Durchsetzung von verbraucherschützenden Vorschriften des
Datenschutzrechts). Under the new law, registered consumer associations
will have the right to sue companies for violations of data protection laws
(“class actions”). To this aim, certain amendments will be made to the
German Injunction Act (Unterlassungsklagengesetz). The bill is subject to
signing by the Federal President and announcement in the Federal Law
Gazette (Bundesgesetzblatt). The new law will enter into force one day
after announcement in the Federal Law Gazette.

Class actions to be expanded to data protection laws

Under the new law, collection, processing and utilization of personal data
of consumers for the purposes of advertising, market research, operation of
credit agencies, profiling, address trading, other data trading and similar
purposes, will be subject to supervision by registered consumer
associations, which will have their own right to sue companies that are in
breach of the relevant statutory data protection provisions. This will
inter alia cover privacy issues related to contracts and terms and
conditions. An exemption will apply to the extent that collection,
processing and utilization of personal data will be necessary for
establishment, performance or termination business transactions with
consumers.

Consumer associations are obliged to submit annual reports about issued
warning letters and initiated class actions based on data protection
breaches with the Federal Office of Justice (Bundesamt für Justiz) for
monitoring purposes. Further, courts shall hear the competent data
protection authority before making a judgment, unless an injunction for
emergency has been requested by the relevant consumer association.

During a grace period until 30 September 2016, consumer associations may
not initiate class actions in relation to data transfers to the United
States which have been based on the European Commission’s Safe Harbour
Decision prior to its invalidation by the Court of Justice of the European
Union on 6 October 2015.

In addition: restrictive contractual form requirements to be prohibited in
consumer contracts

The bill contains also a substantial change in consumer protection under
the German Civil Code (Bürgerliches Gesetzbuch – BGB). Under the new law, a
clause in a consumer contract by which notices or declarations that are to
be made by the consumer to the company or a third party are tied to a more
stringent form than “text form”, will be prohibited. Under the existing
law, a consumer may be required to observe the more stringent “written
form”. Under the new law, written form may still be required in contracts
which are subject to a statutory requirement for notarization.

Companies are called on to review and amend their terms and conditions for
consumer contracts accordingly within a grace period until 30 September
2016. After expiration of this grace period, consumer associations will
have the right to take companies to court for use of prohibited and,
therefore, invalid terms and conditions. According to the legislative
materials, the Federal Statistical Office estimates that in Germany, around
750,000 consumer contracts require consumers to observe written form. The
economic burden for companies to amend their terms and conditions is
estimated at around EUR 70 million.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!