The Higher Regional Court of Stuttgart ruled in an appeal proceeding that the information obligations under Art. 13 para. 1 lit. a), c), para. 2 lit. b), d) and e) GDPR constitute market conduct regulations under § 3a UWG (German Act Against Unfair Competition).
What was the issue?
The plaintiff, a trade association, demanded that the defendant cease and desist from offering goods or services online without providing specific data protection information.
In July 2018, the defendant, a commercial seller, offered tires for sale on the eBay platform. In addition to his company name, he provided his postal address, telephone number, fax number, and email address. He did not provide any data protection notices. The plaintiff issued an unsuccessful warning letter to the defendant.
The Regional Court of Stuttgart dismissed the injunction claim. Essentially, the Regional Court of Stuttgart based its decision on the premise that the plaintiff could not assert claims for injunctive relief due to infringements of the General Data Protection Regulation. While Art. 80 para. 2 GDPR contains a corresponding authorization for member states, the German legislator had not made use of this authorization.
Can an incorrect or missing privacy policy be subject to a warning letter?
In addition to various formal aspects, the Higher Regional Court of Stuttgart addressed two issues: namely, the plaintiff's authority to assert claims for injunctive relief due to infringements of the General Data Protection Regulation, and that infringements of certain information obligations constitute market conduct regulations under § 3a UWG.
May competition associations issue warning letters for data protection infringements?
According to the Higher Regional Court of Stuttgart, competition associations are permitted to pursue claims for injunctive relief arising from infringements of the General Data Protection Regulation. The General Data Protection Regulation does not exhaustively regulate the authority to assert claims for infringements of the General Data Protection Regulation, so that the provisions of § 8 para. 1 and para. 3 no. 2 in conjunction with § 3a UWG remain applicable.
According to the Higher Regional Court of Stuttgart, this outcome results from the legislative history of Art. 80 GDPR, from an interpretation of Recitals 11 and 13, and from a systematic interpretation of the General Data Protection Regulation's evaluative framework.
Is the infringement of certain information obligations anti-competitive?
After presenting the dissenting and mediating views in legal literature and jurisprudence regarding the market conduct relevance, the Higher Regional Court of Stuttgart explained that the business contact itself affects the data protection interests of the prospective customer and establishes corresponding obligations for the entrepreneur. The information to be provided thus also serves the consumer's decision whether to engage with the company at all and, in doing so, to transmit data. For this reason, Art. 13 GDPR serves the interests of consumers and other market participants within the meaning of § 3a UWG.
The infringement is also capable of perceptibly impairing the interests of consumers, other market participants, or competitors. For the reasons that the information obligations under Article 13 GDPR are to be classified as market conduct regulations, an infringement thereof is regularly to be considered perceptible. The defendant did not present any arguments to refute this.
The Higher Regional Court of Stuttgart allowed the appeal to the Federal Court of Justice.
Why is the ruling of the Higher Regional Court of Stuttgart so important?
The ruling of the Higher Regional Court of Stuttgart is not yet legally binding. It is anticipated that the decision will be submitted to the Federal Court of Justice for review on appeal.
Should the Federal Court of Justice uphold the ruling of the Higher Regional Court of Stuttgart, all online retailers must prepare for increased scrutiny of their data protection information obligations by competitors and competition associations. Even now, we anticipate numerous warning letters in this area.
What must retailers do now?
It is strongly recommended that every online retailer take the issue of the General Data Protection Regulation (GDPR) seriously, seek appropriate advice, and implement the GDPR regulations within their own company as quickly as possible. Otherwise, costly warning letters from competitors, warning associations, and competition associations are imminent.
Source: Ruling of the Higher Regional Court of Stuttgart of February 27, 2020, Ref. 2 U 257/19, Previous Instance: Regional Court of Stuttgart, Ruling of May 20, 2019, Ref. 35 O 68/18
We are pleased to offer our services as consultants across the entire spectrum of data protection law, as well as in the legal fields of IP and IT law. Contact us to avoid justified warnings.
Also read our article on this topic: “Can data protection violations be subject to competition law warnings?“
GoldbergUllrich Attorneys at Law 2020
Julius Oberste-Dommes LL.M. (Information Law)
Attorney-at-Law and
Specialist Attorney for Information Technology Law
