New German Data Protection Law Enables a German Version of “Class Actions”

Mar 7, 2016

Reading Time : 3 min

By: Davina Garrod, Stephen S. Kho, Natasha G. Kohne, Jo-Ellyn Sakowitz Klein, David S. Turetsky, Visiting Professor, College of Emergency Preparedness, Homeland Security, and Cybersecurity at the University of Albany

What the Act does

The newly adopted Act to Improve the Civil Enforcement of Consumer Protection Provisions of Data Protection Law (the “Act”) amends the German Act on Injunctive Relief. In general, the Act extends the power of business associations and consumer groups to enforce provisions of certain consumer laws in the context of data protection, including in the context of processing or collecting such data for the purposes of advertising, marketing, opinion research, certain profiling, and trading of addresses or other data. The Act includes a catchall provision referring to data processed and collected for any other similar commercial purposes. It is yet unclear in what circumstances this provision can be invoked, but it appears to provide an opportunity for wide application of the Act.

The consumer associations have been empowered to issue cease-and-desist letters against businesses and seek injunctive relief for alleged data privacy violations (for example, using consumers’ data without a valid consent or having a noncompliant privacy notice). Cease-and-desist letters usually identify breaches by their addressees and request that any offending behavior be ceased. The letters may involve the imposition of contractual penalties or fines, and could also lead to court proceedings for injunctive relief if the behavior is not ceased. Proceedings may be brought on the associations’ own initiative or at the request of consumers, competitors or employers. Under the Act, the consumer associations are able to ask for the offending behavior to cease in general (as opposed to against a certain consumer in particular), and, therefore, the associations’ actions would likely have an impact on the general public. Further, the German data protection authorities may also play a role in this type of “class action,” since they may be allowed to present their views and analysis of the alleged data protection law violations in court.

The Act curtails the associations’ powers to bring claims for violations of international data transfer rules against companies relying on the invalidated Safe Harbor agreement. However, such powers are limited only until September 30, 2016, and to the extent that the transfer of data was based on the Safe Harbor Framework until October 6, 2015.

What the impact on businesses is likely to be

The Act poses several risks for businesses in relation to potential data privacy violations.

First, the clarification through the Act that consumer associations can issue cease-and-desist letters in the context of data privacy brings a significant change expanding the powers of these associations. There is an increased risk of proceedings being brought by associations in reliance on the Act. In general, these associations are considerably active, since their main aim is pursuing the protection of consumers’ rights. In the past, the German data protection authorities often lacked the resources to enforce data protection laws against a large number of companies. With the new Act, the consumer associations have such powers and may take an active role in data protection enforcement in the context of consumer protection. Furthermore, since the associations’ powers to instigate proceedings are derived from statute, it is unlikely that businesses would be able to limit the German Court’s jurisdiction in that respect by relying on contractual dispute resolution clauses.

Second, businesses that are established in Germany or process data in Germany would benefit from reviewing their privacy policies to confirm that they are compliant with the country’s data protection laws. A reassessment of the risk of violating such laws might be necessary in light of the new Act. If such laws are infringed, the risk of imposing fines is likely to increase in the future, particularly since the actions taken by the consumer associations may alert the data protection authorities, which may impose considerably higher fines when the General Data Protection Regulation comes into force. Further, with reliance on Safe Harbor no longer possible, and the new EU-U.S. Privacy Shield not yet in force, businesses would be well advised to review their policies, particularly in relation to international data transfers, in order to reduce the risk of becoming subject to proceedings by active consumer associations.


1 http://www.badische-zeitung.de/wirtschaft-3/mehr-recht-fuer-verbraucher--99981946.html

Share This Insight

Previous Entries

Deal Diary

June 27, 2024

On June 24, 2024, the U.S. Securities and Exchange Commission (SEC) published five new Form 8-K Compliance and Disclosure Interpretations (C&DIs) expanding the agency’s interpretations of cybersecurity incident disclosures pursuant to Item 1.05 of Form 8-K. In July 2023, the SEC adopted final rules with respect to cybersecurity incidents that generally require public companies to disclose (i) material cybersecurity incidents within four business days after determining the incident was material and (ii) material information regarding their cybersecurity risk management, strategy and governance on an annual basis. We wrote about the final cybersecurity disclosure rules here.

...

Read More

Deal Diary

February 12, 2024

The Securities and Exchange Commission (SEC) recently adopted final rules (available here; also see the fact sheet and press release) representing significant changes to  special purpose acquisition companies (SPACs), shell companies and the disclosure of projections. These rules aim to enhance disclosures, protect investors and align the regulatory framework for SPACs with traditional IPOs. The following summarizes the key aspects of these rules.

...

Read More

Deal Diary

October 4, 2023

On September 20, 2023, the U.S. Securities and Exchange Commission (SEC) issued a final rule amending the so-called “Names Rule” (found here) that is “designed to modernize and enhance” protections under Rule 35d-1 of the Investment Company Act of 1940. The final rule is part of the SEC’s holistic efforts to regulate environmental, social and governance (ESG) matters, and is the SEC’s latest attempt to curb greenwashing in U.S. capital markets. The amendments require registered investment funds that include ESG factors in their names to place 80% of their assets in investments corresponding to those factors, thereby extending to ESG funds the SEC’s long-standing approach of regulating the names of registered funds to ensure they are marketed to investors truthfully. Fund complexes with more than $1 billion in assets will have two years from the final rule’s effective date (60 days after publication in the Federal Register) to comply, while fund complexes with less than $1 billion in assets will be given a compliance period of 30 months.

Chair Gary Gensler said “[t]he Names Rule reflects a basic idea: A fund’s investment portfolio should match a fund’s advertised investment focus. In essence, if a fund’s name suggests an investment focus, the fund in turn needs to invest shareholders’ dollars in a manner consistent with that investment focus. Otherwise, a fund’s portfolio might be inconsistent with what fund investors desired when selecting a fund based upon its name.” The sole dissenting vote against the rule modification, Commissioner Mark Uyeda, said “[w]ith these amendments, the Commission overemphasizes the importance of a fund’s name, as if to suggest that investors and their financial professionals need not look at the prospectus disclosures.” Commissioner Uyeda also expressed concern that fund investors will bear the increased compliance costs associated with the rule change.

...

Read More

Deal Diary

May 31, 2023

As discussed in our prior publication (found here), the Securities and Exchange Commission (SEC) adopted amendments on December 14, 2022, regarding Rule 10b5-1 insider trading plans and related disclosures. On May 25, 2023, the SEC issued three new compliance and disclosure interpretations (C&DIs) relating to the Rule 10b5-1 amendments.

...

Read More

Deal Diary

May 24, 2023

On May 15, 2023, the Eastern District of California ruled that California Assembly Bill No. 979 (“AB 979”) violates the Equal Protection Clause of the U.S. Constitution’s Fourteenth Amendment and 42 U.S.C. § 1981. As enacted, California’s Board Diversity Statute, required public companies with headquarters in the state to include a minimum number of directors from “underrepresented communities” or be subject to fines for violating the statute. AB 979 defines a “director from an underrepresented community” as “an individual who self-identifies as Black, African American, Hispanic, Latino, Asian, Pacific Islander, Native American, Native Hawaiian, or Alaska Native, or who self-identifies as gay, lesbian, bisexual, or transgender.”

...

Read More

Deal Diary

May 9, 2023

Update: On October 31, 2023, the Fifth Circuit granted the US Chamber of Commerce's petition for review of the SEC's share repurchase disclosure rules, holding that the SEC acted arbitrarily and capriciously in violation of the Administrative Procedure Act. The court directed the SEC to correct the defects within 30 days of the opinion. On December 1, 2023, the SEC informed the Fifth Circuit that it was unable to correct the rule's defects within 30 days of the opinion. On December 19, 2023, the Fifth Circuit vacated the SEC’s share repurchase disclosure rules.

...

Read More

Deal Diary

April 12, 2023

We have released our 2023 ESG Survey which includes a collection of reports reflecting on significant ESG themes and trends from 2022, as well as what we believe to be key developments for 2023.

...

Read More

Deal Diary

February 6, 2023

As companies begin preparing for the 2023 proxy season, we note that Institutional Shareholder Services Inc. (ISS) and Glass Lewis, the leading providers of corporate governance solutions and proxy advisory services, issued updated benchmark policies (proxy voting guidelines), which can be found here and here, respectively. The updated proxy voting guidelines generally focus on board accountability and oversight considerations and address topics such as climate accountability, board diversity, shareholder rights, corporate governance standards, executive compensation and social issues. What follows is a summary of the proxy voting guidelines published by ISS and Glass Lewis for the 2023 proxy season.

...

Read More

© 2024 Akin Gump Strauss Hauer & Feld LLP. All rights reserved. Attorney advertising. This document is distributed for informational use only; it does not constitute legal advice and should not be used as such. Prior results do not guarantee a similar outcome. Akin is the practicing name of Akin Gump LLP, a New York limited liability partnership authorized and regulated by the Solicitors Regulation Authority under number 267321. A list of the partners is available for inspection at Eighth Floor, Ten Bishops Square, London E1 6EG. For more information about Akin Gump LLP, Akin Gump Strauss Hauer & Feld LLP and other associated entities under which the Akin Gump network operates worldwide, please see our Legal Notices page.