EU Data protection laws can be enforced by competitors under German Unfair Competition Law

The Würzburg Regional Court recently issued a preliminary injunction regarding infringements of the General Data Protection Regulation (EU) 2016/679 (GDPR), under the German Act against Unfair Competition.

Legal Background

Besides cases of unfair competition such as misleading or comparative advertisement, which has been harmonized across EU Member States through directives of the EU (such as Directive 2005/29/EC, the Unfair Commercial Practices Directive), German Unfair Competition law has specific national provisions, one of which prohibits certain breaches of law as unfair competitive practice. This is based on the current section 3a of the German Act against Unfair Competition, which reads:

“Unfairness shall have occurred where a person violates a statutory provision which is also intended to regulate market conduct in the interest of market participants and the breach of law is suited to appreciably harming the interests of consumers, other market participants and competitors.”

In general terms this provision aims to create a level playing field for market participants to ensure that they all play by the same rules, and individual market players do not have an unfair advantage by evading statutory provisions. Such statutory provisions comprise of a variety of legal obligations including regulations on how to carry out certain activities in relation to regulated businesses, such as pharmacies or law firms, as well as provisions which govern certain aspects of the product itself, for example the labelling requirements following Regulation (EC) 1223/2009 on cosmetic products and Regulation (EU) 2017/2011 on the fibre composition of textile products.

Traditionally German law relies on private enforcement of the rules against unfair competition by giving competitors and certain associations, such as consumer protection associations, a right to enforce the provisions of the German Act against Unfair Competition.

One of the key claims that can be brought under the German Act against Unfair Competition is a claim to cease and desist from further infringing activities; ie acts which the statute regards as illegal. It is important to note that this claim requires “only” an infringement or an imminent infringement of the provisions of the German Act against Unfair Competition. The claim does not require any form of intent, negligence or culpability on the side of the defendant, nor damage on the side of the claimant.

The German Act against Unfair Competition contains further claims that can be brought such as damage claims or a claim to confiscate profits, but these are not as practically important as the claim to cease and desist.

Procedurally a claimant will in most cases send a warning letter with a short answer period and demand a cease and desist declaration with a contractual penalty. If there is no answer, or it is unsatisfactory, claimants will usually apply for a preliminary injunction which German courts are willing to readily grant without hearings, within a matter of days. Often unfair competition law cases are settled after preliminary proceedings, so proceedings on the merits are not conducted for most cases.

Background of the decision

The parties of the proceeding in the Würzburg Regional Court are both lawyers in private practice. The claimant challenged the defendant’s website and claimed that the website did not comply with the provisions of the GDPR, specifically missing information required by section 13, such as the identity and the contact details of the controller, information on the purpose and means of data processing and on cookies and analytical tools.

The Decision

The court in Würzburg issued a preliminary injunction against the defendant based on an infringement of the provisions of the GDPR, in connection with the German Act against Unfair Competition.

Irrespective of the interpretation of the provisions of the GDPR, the court followed earlier decisions from the appeal courts in Hamburg and Cologne which found that the national data protection laws in force at the time were statutory provisions also regulating market conduct. The court now applied this consideration to the EU rules laid down in the GDPR, as well as supplementary national laws. The court in Würzburg implicitly rejected the approach taken by leading legal writers in Germany who argued that the GDPR itself conclusively regulates the legal consequences of infringing it, meaning that there is no scope for applying the German Act against Unfair Competition.

Outlook

The conclusion to treat the GPDR as statutory law which also regulates market behaviour, does not appear to be too farfetched when looking at decisions handed down in Germany relating to national data protection law in the past. Additionally, this finding would be in line with other areas of law. For example, the Bundeskartellamt, Germany’s antitrust authority, are looking into the conduct of Facebook in relation to data protection law under German antitrust law, implying that terms and conditions, and the level of data protection offered by companies, can be a competitive factor.

Even though this is only a first instance decision and it remains to be seen if other courts follow this approach, particularly in light of the interpretation of the GDPR in German legal commentaries, the important point to take away is that companies may not only be under scrutiny by data protection agencies but also by their competitors. As a preliminary injunction means effort on side of the defendant - in the case decided by the Würzburg Regional Court the defendant was prohibited from operating her website without a proper data protection declaration - a market participant may be inclined to partially disrupt their competitor’s business by relying on the tools offered by the German Act against Unfair Competition. This is a factor which often surprises companies that operate, or are managed, abroad as the concept of enforcement of public laws by competitors, as applied in Germany, is not common to all jurisdictions.

This document (and any information accessed through links in this document) is provided for information purposes only and does not constitute legal advice. Professional legal advice should be obtained before taking or refraining from any action as a result of the contents of this document.