With the entry into force of the new Unterlassungsklagengesetz (UKlaG) [otherwise known as the “Gesetz zur Verbesserung der zivilrechtlichen Durchsetzung von verbraucherschützenden Vorschriften des Datenschutzrecht”/”Act to improve the private enforcement of consumer protection rules of data protection law”] on February 24, 2016 consumer protection and other qualified associations are allowed to send warning letters or to sue companies that breach data protection law. This particularly applies to data processing for advertising, personality profiles, address and data trade, market and opinion research. It also applies when companies illegally collect and store a lot of data or do not delete the data after use.
So far, such associations only had a very limited right of action and could only be active when companies have violated the Terms and Conditions (Allgemeine Geschäftsbedingungen). So this creates a new German enforcement risk in addition to action by German DPAs.
The detail
From now on, all data protection regulations that apply to companies when collecting, processing or using personal information of consumers are considered as being applicable under the Consumer Protection Act (Verbaucherschutzgesetz) by inserting a new § 2 para. 2 number 11 UKlaG. The aim is to protect consumers better.
Potential associations need to register
Before an association can bring an action, it must meet a number of conditions and needs to be registered at the Federal Office of Justice (§ 3 para. 1 sentence 1 number 1, § 4 UklaG).
Reactions and possible consequences
German consumer protection associations were greeting the new legal instrument as an important improvement of data protection in Germany. The new legal regime is likely to trigger a new wave of warning letters to business. Under German law, the recipient of a warning letter has to react to the letter. If he fails to do so or the reaction is unsatisfactory from the point of view of the sender, interim injunctions and further litigation may be the result.
Further changes
The new law also leads to a significant simplification of rules for the termination of online contracts. These may be terminated in the same form as they have been concluded, thus by a web form or an e-mail. A more formal approach, the so-called written form, may no longer be required in the Terms and Conditions.
So?
German enforcement of DP laws just become higher risk! Beware the new risk from the German consumer associations.
