General Data Protection Regulation – Can competitors issue warning letters for infringements for which the costs have to be paid?

The General Data Protection Regulation (GDPR) has already cost large companies in particular, a great deal of time and personnel. After the implementation deadline of 25 May 2018 has expired, it will increasingly come into focus for smaller companies, associations and the self-employed. In particular, since almost every company, every association and every self-employed person now presents themselves on their own websites or in social media on the Internet, all these companies and associations have to deal with the question of the extent to which they process personal data on their web presence and, accordingly, to what extent they have to provide information about this processing and the associated rights of the persons concerned.

In addition to this general obligation, there is also a more specific concern about receiving warning letters, for which costs must be paid, in the event that the instruction is ultimately incorrect or incomplete. In addition to the financial losses, such a warning is above all time-consuming and nerve-wracking for the person concerned.

The question therefore arises:

Is it possible for competitors to issue warning letters for breaching the GDPR’s duty to inform and instruct.

Unfortunately, there is currently no concrete answer to this question, as diverging court decisions have been made and a decision by the highest court is still missing.

The Bochum Regional Court (I-12 O 85/18) denied the competitor the possibility to issue a warning for infringement of Art. 13 GDPR on the grounds that Articles 77 to 84 GDPR contain their own final provisions, which cannot be extended by provisions of the Unfair Competition Act (§ 3a UWG – German Unfair Competition Act). Articles 77 to 84 GDPR stipulate that claims under the GDPR may be asserted by the persons concerned themselves or alternatively by non-profit institutions, organisations or associations whose statutory purpose is in the public interest and which are active in the field of protecting the rights and freedoms of the persons concerned with regard to the protection of their personal data.

The Unfair Competition Act provides for a similar limitation of the circle of those who have the right to take legal action; there qualified institutions are also entitled to assert consumer rights under certain conditions. However, the German Unfair Competition Act also gives competitors the right to issue warnings against infringements and to assert them in court.

Articles 77 to 84 GDPR contain no references to competitors. The Bochum Regional Court is of the opinion that with the restriction of the group of persons who can enforce the rights under Art. 13 GDPR, an extension to competitors should be deliberately excluded.

The Würzburg Regional Court (11 O 1741/18 UWG), on the other hand, was of a different opinion and granted the competitor a right to an injunction, whereby the decision of the Würzburg Regional Court was rendered  without an oral hearing, i.e. without hearing the opposing party. Whether the decision has become final is not known. Unfortunately, the court does not address the issue of whether Art. 77 to 84 GDPR conclusively regulates the group of claimants. The court also does not argue with the (earlier) decision of the Bochum Regional Court.

On 25 October 2018, the Hamburg Higher Regional Court became the first higher court to address this issue and adopted a mediating view (3 U 66/17 – not yet published). Contrary to the decision of the Bochum Regional Court, the Hamburg Higher Regional Court does not assume Art. 77 to 84 GDPR final regarding the circle of beneficiaries. This can be seen from the fact that Art. 82 GDPR also awards a claim for damages to „any person“ who has suffered damages due to an infringement of GDPR. In addition, Art. 84 GDPR contains an opening clause for more far-reaching provisions of the individual member states, so that GDPR can only be regarded as a minimum standard, but more far-reaching rights can exist.

However, for the Hamburg Higher Regional Court this does not mean that any infringement of GDPR or the German Federal Data Protection Act (BDSG) also grants the competitor a right to injunctive relief and damages. This is because the provision that has been infringed must also have a so-called market conduct regulating character. This was not the case in the Hamburg Higher Regional Court’s case.

It will certainly be some time before the above question is finally clarified, whether by Bundesgerichtshof (German Federal Court of Justice) or the European Court of Justice. However, it is important for companies, associations and self-employed persons that it can be worthwhile to take action against warnings in connection with GDPR, since even if an infringement should exist, this might not give everybody a right to bring this to court.

Contact person: Vanessa Lichter, German Attorney-at-Law