According to a recent draft law now adopted by the German Federal Government, consumer protection bodies shall be allowed to enforce data protection law rules – a right that they did not have so far. Will this change the game? The answer is: It might.

Background and Current Legal Situation

Currently, only data subjects themselves whose personal data have been affected by a breach of the data protection law are entitled to take legal steps and to seek an injunction, or, what is more frequent in practice, to ask the competent data protection regulator to take action. The rights of consumer protection bodies, which play a key role in the enforcement of “ordinary” consumer protection laws in Germany, are currently very limited. So far, they can only become active in cases where provisions of a company's general terms and conditions infringe data protection laws.

The New Bill

The draft law amends the German Act on Injunctive Relief (“Unterlassungsklagengesetz”). According to the bill, consumer protection bodies shall be assigned the right to enforce data protection laws by taking legal steps against the unlawful use of consumers' personal data in a form of "collective action" ("Verbandsklage"). As a result, consumer protection bodies would then be able to issue warning notices as well as cease-and-desist letters or to apply for injunctive relief in front of a court if they see a breach of the German Data Protection Act or other applicable laws protecting personal data.

The bill stems from concerns that German data protection authorities have rather limited resources to enforce the law and thus the German legislator feels that a sort of “class-action” is necessary in order to strengthen the enforcement of German data protection laws. This is especially important against the background that due to the increasing digitalisation and use of information technology in everyday transactions, personal data of consumers are collected, processed and used to an increasing extent by companies for marketing and commercial purposes. In case of (suspected) infringements, consumers often shy away from taking legal steps and pursuing data protection law violations due to the cost and effort involved.

However, the draft does not only provide for injunctive relief, but also for claims for removal (“Beseitigungsanspruch”). In this regard, legal uncertainty exists for companies and consumers as it is currently not clear how a data processing operation that, e.g., was based on an invalid consent by the consumer should be reversed or “removed” with retroactive effect.

Finally, according to the draft law, data protection regulators will have a right to be heard in court. By this means, the competent data protection authority will also be informed about possible violations of data protection laws and, according to the reasoning of the bill, the authorities could probably also start their own investigations in the respective case. Moreover, courts may benefit from the authority’s valuable expertise.

What would this mean in Practice?

Should this draft law actually enter into force, it will have a huge impact in practice. Experience shows that consumer protection bodies have been a main driver behind the enforcement of consumer protection laws in Germany over the last decade. The proposed new law with its envisioned legal remedies will further strengthen their position. It is to be expected that consumer protection bodies will make avid use of their new right to enforce data protection law compliance. So far, in case of non-compliance the risk in practice was somewhat limited due to the also limited resources of the German data protection regulators. Often, only high-profile cases are currently investigated by the authorities.

In the future and under the new proposed law, the rules of the game might change: Consumer protection bodies have a rich tradition of vigorously following up consumer complaints in even small scale cases. Thus, pressure on businesses could grow significantly and the actual risk in connection with non-compliance with data protection laws might dramatically increase in Germany should the proposed new law become reality.

What’s Happening Next?

The bill is not final yet. In the further legislative procedure, the draft law still needs to pass the German Bundestag, the federal legislative body in Germany, and the German Bundesrat, the legislative body representing the German federal states.

In general, it is not uncommon that the draft will be revised in the course of this legislative procedure. Therefore, further amendments to the draft cannot be excluded, especially considering the bill is currently discussed very controversially in Germany. One of the main criticisms is that the draft law is not really in sync with the General Data Protection Regulation of the European Union. The latest draft of the regulation also provides that organisations aiming to protect data subjects' rights shall have the right to take legal steps under certain circumstances. However, the German bill goes much further than this and thus conflicts with the envisaged “full harmonization” under the forthcoming regulation.

Thus, businesses should definitely watch the next legislative steps carefully. And whatever happens, one thing is for sure: Data protection law compliance will become more important than ever.