GERMANY—Data protection law breaches as unfair commercial practice

Recently, there have been two contradictory judgments by German courts in relation to whether companies can issue warning letters under the Act Against Unfair Competition (AAUC) because of data protection breaches by a competitor. According to statutory law, this would only be possible if one considers the data protection rules as statutory provisions that are also intended to regulate market behaviour in the interest of market participants. While the Higher Regional Court of Karlsruhe is in favour of such interpretation, the Higher Regional Court of Munich denies this, although the facts of these two cases were almost identical: in both cases, a utility company sent out postal advertising letters to former customers which were not in line with data protection rules, in particular because the recipients had not consented and the processing of the customer’s data; i.e., the information on the former customer relationship and the termination of the utility contract, were not necessary for the fulfilment of the terminated  contract any longer.

In the earlier judgement from 12 January, the Higher Regional Court of Munich stated (29 U 3926/11) that the provisions of the Federal Data Protection Act (FDPA) could not be classified as market conduct rules. The judges argue that the FDPA does not aim at the protection of market participants, but rather the protection of data subjects.

In contrast to this, the Higher Regional Court of Karlsruhe has now stated in its judgment dated 9 May (6 U 38/11) that Sec. 4, Para. 1, and Sec. 28 FDPA would need to be considered market conduct rules in terms of Sec. 4 No. 11 AAUC because and insofar as both provisions govern the collection, processing and use of personal data for marketing purposes—and marketing activities being “market conduct” in a pure sense. On this basis, the judges considered the unlawful processing of data in relation to the advertising letters as an unfair commercial practice.

Irrespective of the Munich judgement, businesses in Germany must therefore take into account that unlawful data processing can constitute an unfair commercial practice so that competitors may be entitled to assert a cessation and desistance claim and issue a respective warning letter. This is in particular relevant for data processing activities for marketing purposes.