Guten Morgen aus München,
A crazy year comes to an end, and it’s time to look back. While I don’t want to bore you with the ubiquitous noise around a certain CJEU ruling handed down this summer, I would rather like to draw your attention to some developments here in Germany that might be relevant for all of you.
First and foremost, 2020 was the year of GDPR enforcement in Germany. Not only have we seen a number of record fines imposed by German regulators, but we also witnessed the first court rulings dealing with legal challenges against such fines. Gone are the days when fines were grudgingly accepted and paid in all quietness — not least to avoid the case becoming public. Nowadays, German regulators sometimes seem to be particularly vocal in public on fines and other sanctions. And so are the companies affected by such fines.
This year, privacy pros closely watched one case that played out at the District Court of Bonn. The German Federal DPA (which has national competence for telecom providers in Germany) levied a fine against a telco company for failing to implement an appropriate authentication procedure at its call center. For authentication, callers only had to state their name and birthdate to request access to their data. Following a complaint regarding misuse of such process, the DPA considered this to be a violation of Article 32 of the GDPR and imposed a hefty fine of 9.5 million euros.
Interestingly, and in line with an unofficial fining guideline used by German regulators to calculate GDPR fines, the federal DPA measured the fine using the company’s turnover at a group level as the calculation basis. The fine was subsequently challenged for being excessive. The court followed the company’s arguments and reduced the fine by 90%. Although the court in principle sided with the DPA and ruled that the authentication process was in fact insufficient and thus contrary to Article 32 of the GDPR, it considered the fine to be disproportionate. Most strikingly, the court held that the violation was minor in nature and insufficient factors were considered in calculating the fine.
In my view, we will see more of these cases down the road as fines continue to be tested before the courts. And often, courts seem to take a more nuanced approach than some regulators — which is also illustrated by other court rulings striking down fines — as it was the case most recently in Austria. This is not just an interesting development to watch for privacy pros. It will also add to much-needed clarification around some of the GDPR’s most basic requirements.
Speaking of legal certainty, another major development in Germany this year was the German Supreme Court ruling on cookies. As you might know, the German legal requirements around advertising cookies have been particularly obscure, and the absence of the anticipated ePrivacy Regulation has resulted in significant uncertainties. This even led to an odd situation when the German DPAs declared an existing German law (which allows the use of pseudonymous user profiles for marketing purposes on an opt-out basis) no longer applicable. Following the CJEU’s Planet 49 ruling, the German Supreme Court held that the respective law remains applicable, but that — contrary to its rather clear wording that opt-out is sufficient — it needs to be interpreted to require an opt-in for advertising cookies.
On top of that, the German government — in a sign that it has sort of given up on the ePrivacy Regulation coming to town any time soon — seems to be working on a new law dealing with cookie compliance. Stay tuned for the next chapter of this never-ending saga.
Finally, we did see quite an uptick in GDPR damage claims across Germany over the last months. Immaterial damage claims following a data breach, a regulator fine, or any other potential GDPR infringement are increasingly en vogue. So far, German courts have been rather strict as regards the burden of proof – and repeatedly held that not every breach of the GDPR justifies a claim for immaterial damages. But we are already seeing the next level of this development, with legal tech firms trying to bundle such claims to a sort of class action.
I am sure 2021 will be no less exciting from a privacy perspective. Enjoy the holidays, and forget about that one CJEU ruling for a few days at least.
Frohe Weihnachten!