It is currently being discussed whether violations of the General Data Protection Regulation (GDPR) constitute a competition infringement that can be subject to a warning. We have already reported on the discussion in our article "Can violations of data protection law be subject to a warning? You can read our article here.
The Regional Court of Würzburg (LG Würzburg, order dated 13.9.2018, ref. 11 O 1741/18) has now issued its first judicial decision on this issue.
The case:
In the case at issue, a lawyer had a website with a faulty/insufficient privacy policy. The privacy policy consisted of only a seven-line privacy statement. It lacked information on the person responsible, the collection and storage of personal data as well as the type and purpose of their use, a statement on the transfer of data, on cookies, analysis tools, but above all the instruction on the rights of the data subject, in particular the right to object, data security and a reference to the possibility of complaining to a supervisory authority.
The decision:
With reference to the decisions of the Higher Regional Court of Hamburg (3 U 26/12) and the Higher Regional Court of Cologne (6 U 121/15), both dating back to the time before the GDPR, the Regional Court of Würzburg assumed that the infringements of the disputed provisions from the GDPR are infringements of competition law pursuant to Section 4 No. 11 UWG or now Section 3 a UWG and that, consequently, the infringements of the GDPR are also infringements of competition law.
Unfortunately, there was no discussion of the question of whether the provisions of the GDPR are conclusive and whether, in addition to the provisions of the GDPR, a scope of application for the provisions of the Unfair Competition Act is still open at all.
Our conclusion:
In our opinion, it is still unclear whether violations of the General Data Protection Regulation can actually be subject to a warning under competition law. The decision of the Würzburg Regional Court is not convincing in terms of content. It lacks an examination of the current legal situation and the legal questions discussed in this context.
It therefore remains to be seen whether "warning letters" will jump on the bandwagon and, with reference to the decision of the Würzburg Regional Court, issue warning letters under competition law in the case of data protection violations. We have already received a few such warnings. It remains to be seen whether the decision of the Würzburg Regional Court will trigger the long feared "wave of warning letters".
In any case, you should ensure that all data protection regulations are fully complied with within your internet presence. Otherwise, with reference to the decision of the Würzburg Regional Court, warnings under competition law and fines under data protection law may follow.
If you have any further questions on this topic or would like advice on data protection, please do not hesitate to contact us.
GoldbergUllrich - Lawyers 2018
