Data protection enforcement trends in Germany

By Julia Garbaciok and Katharina A. Weimer of Fieldfisher.

In Germany there have been interesting recent decisions and trends across the country. In this article we discuss the latest news on e-marketing consent rules, and give an overview on recent developments in German employee data protection law, as well as a few highlights relating to data subjects’ access rights requests.

E-marketing consent – a longstanding favourite

Businesses need to pay special attention to the strict consent rules around e-marketing: It is not a particularly new development that German authorities and courts impose strict requirements for obtaining consent in an e-marketing context on both B2C and B2B levels: In summary, according to Section 7 of the Unfair Competition Act (UWG), sending marketing messages without the prior express consent of the addressees is not permitted. In order to constitute a valid legal basis, consent must meet the requirements of Articles 6 (1) (a) and 7 GDPR, thus, consent must be freely given and declared in a manner that is clearly distinguishable from other matters, in an intelligible and easily accessible form. To verify the intention of the data subject, the double-opt in procedure should be used, meaning a first opt-in should be verified via email confirmation or similar mechanism. If the requirements are not observed, there is a high practical risk of complaints, cease-and-desist letters, or court proceedings. In addition, this also constitutes a violation of data protection law when processing data without the proper legal basis (i.e. consent).

Continue Reading

International Report subscribers, please login to access the full article


If you wish to subscribe, please see our subscription information.