Privacy & Information Security Law Blog

On February 11, 2014, Germany’s Federal Minister of Justice and Consumer Protection announced that consumer rights organizations will soon be able to sue businesses directly for breaches of German data protection law. Such additional powers had already been contemplated by the German governing coalition’s agreement and the Minister now expects to present a draft law in April of this year to implement them.

If passed, the new law would bring about a fundamental change in how German data protection law is enforced. Currently, only the affected individuals as well as Germany’s criminal prosecutors and data protection authorities have legal standing to sue businesses for breaches of data protection law. Such proceedings are still relatively infrequent, in part due to the complexities and costs involved.

Consumer rights organizations, however, are sophisticated and well-funded. In the past, they have been very active in pursuing businesses for breaches of consumer protection legislation and unfair competition laws. Alleged data protection breaches often are featured in these proceedings, but consumer rights organizations had to rely on particular legal fact patterns to successfully argue their cases. The new law would likely change this and legal proceedings against businesses for data protection breaches would become more common in Germany.

Therefore, businesses subject to German data protection laws should take note of this development and consider whether their data processing practices meet the required standards.