Missing/incorrect data protection declaration liable to a warning?

This question is currently not so easy to answer, because the case law is currently wildly mixed. Even in pre-DSGVO times, it was controversial and the judgments diverged. Well, after the GDPR, the situation is no better.

Thus, the LG Würzburg had recently decided, even still in a case lawyer against lawyer, that a warning is possible.

“The 7-line privacy policy contained in the defendant’s legal notice does not comply with the new GDPR.

It lacks information on the controller, the collection and storage of personal data as well as the type and purpose of its use, a statement on the transfer of data, cookies, analysis tools, but above all information on the rights of data subjects, in particular the right to object, data security and a reference to the possibility of complaining to a supervisory authority.”

The court therefore stated:

“With the Higher Regional Court of Hamburg (3 U 26/12) and the Higher Regional Court of Cologne (8 U 121/15), the court assumes that the provisions that were violated here constitute violations of competition law pursuant to Section 4 No. 11 UWG and Section 3a UWG and could therefore be warned by the applicant.

”
The Regional Court of Bochum, on the other hand, did not give a competitor the right to issue a warning and ruled

“The application was unsuccessful, however, insofar as a violation of Article 13 of the General Data Protection Regulation is asserted. The plaintiff is not entitled to such a claim because Articles 77 to 84 of the General Data Protection Regulation contain a conclusive provision excluding the claims of competitors. The Board is not unaware that this question is disputed in the literature and that opinions are still being formed. The Board in its current composition agrees with the view expressed in particular by Köhler (ZD 2018, 337 as well as in Köhler/Bornkamm/Feddersen, UWG, 36th ed. 2018, Sec. 3 a paras. 1.40 a and 1.74 b, in the result also Barth WRP 2018, 790; different view Wolff, ZD 2018, 248). This is supported in particular by the fact that the General Data Protection Regulation contains a detailed regulation of the group of persons entitled to claim. According to this, not every association is entitled to exercise the rights of a data subject, but only certain non-profit institutions, organizations and associations under further conditions. From this it can be concluded that the Union legislator did not intend to allow an extension to competitors of the infringer (Köhler, ZD 2018, 337, 338). For further details of the argumentation, reference can be made to the cited literature.”

Among lawyers, the question is currently very controversial. In its decision, the Würzburg Regional Court declared two older decisions of the Hamburg and Cologne Higher Regional Courts to be still applicable. The Bochum Regional Court, on the other hand, bases its opposing view on the leading commentary on competition law.

Current therefore better have a proper privacy policy in place. Regardless of the legal question of the existence of a market conduct standard or the lack thereof, data protection declarations are now expected by consumers, and the existence of such declarations is likely to create consumer confidence. Finally, of course, data protection commissioners of the federal states can act independently of the UWG case law.