It is currently being debated whether infringements of the General Data Protection Regulation (GDPR) constitute a competition law infringement subject to a warning letter. We have already reported on this discussion in our article "Can data protection infringements be subject to a warning letter?". You can read our article here.
The Regional Court of Würzburg (LG Würzburg, decision of September 13, 2018, file no. 11 O 1741/18) has now rendered a first judicial decision on this matter.
The Case:
In the case at hand, a lawyer operated a website with a faulty/insufficient data privacy policy. The data privacy policy consisted of merely a seven-line statement. It lacked information on the data controller, on the collection and storage of personal data, as well as the type and purpose of its use, a statement on data transfer, cookies, analytical tools, but most notably, the instruction on data subject rights, particularly the right to object, data security, and a notice regarding the possibility to lodge a complaint with a supervisory authority.
The Decision:
Referring to the decisions of the Higher Regional Court of Hamburg (3 U 26/12) and the Higher Regional Court of Cologne (6 U 121/15), both predating the GDPR, the Regional Court of Würzburg assumed that the infringements of the disputed provisions of the GDPR constitute violations of competition law pursuant to Section 4 No. 11 UWG or now Section 3a UWG, and that, consequently, infringements of the GDPR simultaneously constitute competition law infringements.
Unfortunately, a detailed examination of the question of whether the provisions of the GDPR are exhaustive and whether, therefore, there is any scope for the application of the provisions of the UWG alongside the GDPR regulations, did not take place.
Our Conclusion:
In our view, it remains unclear whether infringements of the General Data Protection Regulation can actually be subject to competition law warning letters. The decision of the Regional Court of Würzburg is not convincing in its substance. It lacks a thorough examination of the current legal situation and the legal issues discussed in this context.
It therefore remains to be seen whether "warning letter issuers" will jump on the bandwagon and issue competition law warning letters for data protection infringements, citing the decision of the Regional Court of Würzburg. We have already received isolated instances of such warning letters. Whether the decision of the Regional Court of Würzburg will trigger the long-feared "wave of warning letters" remains to be seen.
You should, in any case, ensure that all data protection regulations are fully complied with within your online presences. Otherwise, competition law warning letters and data protection fines could potentially follow, citing the decision of the Regional Court of Würzburg.
For further inquiries on this topic or for data protection legal advice, we are at your disposal.
GoldbergUllrich – Attorneys at Law 2018
