German bill allows consumers to sue over data protection

Consumer rights organisations are already able to take action on behalf of individuals in relation to breaches of consumer protection and unfair competition laws, and the new law would extend that right to disputes about data protection breaches.

Consumer organisations will also now be able to issue cease-and-desist letters. This has been achieved by an amendment to the German law covering injunctions.

To date, consumer associations in Germany have had difficulty in challenging data protection shortcomings by companies. The law previously required them to prove that a provision in a privacy policy is designed either to regulate market behaviour or to protect consumers, and civil courts have not generally qualified these provisions under either category.

Pressure on businesses will grow as consumer protection organisations, trade associations and others will be able to send cease-and-desist letters, and file interim injunctions when companies violate data protection provisions.