New data protection rules

Transcription

1 New data protection rules Amendment of the German Federal Data Protection Act 2009 On 3, the German Bundestag passed the Federal Data Protection Act Amendment Law (Novelle des Bundesdatenschutzgesetzes), large parts of which will enter into force as of 1 September The amendment law is the result of various so-called data scandals affecting major German corporate groups, which were accompanied by media coverage of a scale previously unknown in Germany, as well as the (attempted) sale of millions of sets of contact and marketing data. The amendment seeks to tighten the existing provisions of the Federal Data Protection Act in specific areas and to ensure better enforcement of existing (and new) rules. While the Federal Data Protection Act Amendment Law had, in the spring of 2009, increasingly become the subject of strategic manoeuvres by political parties in the run-up to the elections for the German Bundestag scheduled for September 2009, the home affairs committee was finally able to reach a compromise in its last meeting before the summer break, on the basis of which together with the updated bill the Bundestag passed the Federal Data Protection Act Amendment Law 1. This also included several last minute modifications, such as, for example, the changes relating to the mandatory contents of data processing agreements pursuant to section 11 of the Federal Data Protection Act. In the course of the legislative procedures, various provisions were discussed heatedly and were the subject of intensive lobbying, in particular the deletion or restriction of the so-called list privilege for marketing measures, while other provisions of the Federal Data Protection Act which were tightened by the amendment and which are quite significant in practice for corporates were hardly discussed by the public. Contents Amendment of the German Federal Data Protection Act Overview of the amendments 3 Overall assessment 7 1 Cf.: and:

2 However, in the end, the German Bundestag refrained from including detailed provisions on the protection of employee data, which originally were also on the agenda for the current legislative term. Only a brief, generally worded provision relating to employee data was incorporated in the newly created section 32 of the Federal Data Protection Act, while the remainder of proposals were (again) postponed to the next legislative term. The German Bundestag also abandoned the proposed data protection audit law, which would have allowed for audits of companies by certified auditors. The new law also does not contain the highly controversial right of associations to institute legal action. The following overview presents the essential legal changes to the Federal Data Protection Act, each accompanied by brief comments describing the practical consequences.

3 Overview of the amendments Amendment Comments Employee data protection Employee data may be used (a) to the extent necessary for the purposes of employment; (b) to uncover criminal offences committed in the course of employment, provided that there is documentation of reasonable grounds for suspicions. Non-electronic documents containing personal data are also protected. Not really a new provision, merely a codification of the established practice of the courts. With regard to (b), s of employees, which are subject to telecommunications secrecy requirements, may still not be used and it remains to be seen whether uses aimed at uncovering infractions that are not criminal offences are permitted. The inclusion of non-electronic documents will make it much more difficult for employers to monitor employees. Protection against dismissal of the data protection officer Data protection officers enjoy special protection against dismissal, similar to immission control officers, incident control officers or works council members. The employer must allow and pay for attendance of training events. Affects all companies that have appointed an internal data protection officer. Those companies that are not obliged to appoint a data protection officer or that have appointed an external data protection officer are not affected. Commissioned data processing (Auftragsdatenverarbeitung) The rights and duties under the data controller-data processor relationship must be laid out in more detail than before. The data controller must assure itself of the data processor s compliance with material provisions prior to the start of data processing and on a regular basis thereafter. Affects all companies commissioning external bodies to process data, for example in the area of payment processing or in connection with IT outsourcing projects. Violations punishable by a fine. Existing commissioned data processing agreements should be reviewed accordingly. Prohibition of tying arrangements (Kopplungsverbot) The execution of contract or agreements may not be made subject to the affected Affects in particular monopolists and companies operating in the area of

4 Amendment person s consenting to the use of her/his data, in particular for marketing purposes, if the affected person does not otherwise have access to equivalent contractual services. Comments services of general interest (e.g. electricity, water). It may, however, also affect non-monopolists if there is a uniform market practice, such as, for example, if a customer could only open an account provided that he/she first consented to the use of his/her data for marketing purposes. Reduction and economical use of data As a general principle, the use of personal data should be reduced to the absolute minimum necessary. Personal data must be pseudonymised or anonymised, provided that this does not require disproportionate efforts. Remains a mere objective; despite the enlarged scope of application, breaches are not punishable by fines. Marketing and address trading Almost no restrictions to the use of the affected person s data if the persons affected consent. Consent may also be given by electronic means, i.e. for example via the internet. The following will still be possible without consent of the person affected (but not contrary to such person s refusal!), subject, in each case, to the condition that such uses do not conflict with protected interests of the person affected. For example: (a) Marketing of own offers: certain data such as a person s name, address and job title may be used if such data has already been collected under a contract entered into with the person affected and provided that such data collection was permitted; or if such data originates from generally accessible directories (e.g. telephone book). Remainders of the so-called opt-in solution. Address traders and other advertisers will increasingly consider using incentive schemes (e.g. bonus programmes, club memberships) to motivate potential customers to give consent. Provides legal security for all advertisers intending to use contractual data for marketing purposes. (b) Marketing with regard to the professional occupation of the person Interesting opportunity to directly address persons at their professional ad-

5 (c) (d) Amendment affected and under such person s professional address: certain data such as a person s name, address and job title may be used and also transferred, as the case may be. Marketing of tax-privileged donations: certain data such as a person s name, address and job title may be used and also transferred, as the case may be. Generally for marketing purposes: certain data such as a person s name, address and job title may be transferred, to the extent it is clear to the persons affected what the source of such data is and provided that the person affected can effectively object to the use of such data. Comments dress, e.g. for specialised publishers, stationery suppliers, providers of specialist seminars. Permits the use of data in particular by non-profit or charitable organisations. Broadest exception. Address traders, publishing houses and other professional advertisers providing data can primarily rely thereon. In addition, so-called third-party advertising and recommendation marketing remains permissible in the future. Market and opinion research Data storage must be notified to the competent supervisory authority. Overall, data use is privileged over marketing. The notification duty violations of which are punishable by fines affects all market and opinion research companies, including those using it for disguised marketing efforts or contests. Breach notification Companies must notify the supervisory authorities and the persons affected if their data has been unlawfully disclosed to third parties (whether by illegitimate transfer, data leakage or hacker attack), provided that there is danger of serious prejudice to the interests of the person affected. If it is too difficult to directly notify all persons affected, such notice must be published in two daily newspapers. Examples: loss of credit card, social security or patient data. Affects all companies without exceptions, since every company stores personal data. May cause considerable expenses and reputational damage. Confiscation of profits (Gewinnabschöpfung) Fines shall be higher than any potential economic gain resulting from the breach Breaches of data protection law will not be rewarded. The confiscation of

6 Amendment of data protection law. Comments profits is not limited in time or amount! Administrative offences and fines Expansion of the catalogue of administrative offences. Administrative offences may generally be punished by a fine of up to 50,000 (previously: up to 25,000) or, in certain cases, up to 300,000 (previously: 250,000). Expanded and more severe sanctions; in particular, deficiencies in ordering commissioned data processing (Auftragsdatenverarbeitung) and insufficient monitoring by the data controller will be considered administrative offences. Expanded powers to intervene of supervisory authorities Supervisory authorities can not only impose fines, but they may also order that any discovered breaches be remediated and, in the event of serious infringements, may ban certain procedures. Considerable rights to intervene against respective companies. Entry into force The amendments will take effect as of 1 September Longer transition periods apply to market and opinion research (until 31 August 2010) and marketing (until 31 August 2012). Result of intensive lobbying.

7 Overall assessment A realistic assessment of the stricter provisions of the Federal Data Protection Act Amendment Law requires a holistic look at the following amendments mentioned above: Breach notification in the event of illegitimate transfers/data leakage, Expanded powers to intervene of supervisory authorities, and Increased fines, including potential confiscation of profits. The risk of negative (legal) consequences that may now realistically result from breaches of data protection law in particular from illegitimate transfers has increased considerably. Henceforth, there is also the risk of the following chain reaction: Breach notification with corresponding media coverage, followed by an investigation by the competent data protection supervisory authority (now equipped with expanded powers of intervention) and punishment by a fine, which may, in the worst case, include retroactive confiscation of profits in the worst case. In view of this scenario, which has become more likely, companies will have to devise specific strategies how to proceed in the event of internally discovered illegitimate data transfers or leakages. From a risk management perspective, both the potential damage as well as the probability of negative (legal) consequences in the event of a breach of data protection law have increased as a result of the Federal Data Protection Act Amendment Law. The effects are further exacerbated by the increased public attention to and media coverage of data protection infringements by large corporates since 2008 (reputational damage/pressure on management).

8 Berlin Linklaters LLP Potsdamer Platz Berlin Postfach Berlin Tel: (+49) Fax: (+49) Düsseldorf Linklaters LLP Königsallee Düsseldorf Postfach Düsseldorf Tel: (+49) Fax: (+49) Frankfurt am Main Linklaters LLP Mainzer Landstraße Frankfurt am Main Postfach Frankfurt am Main Tel: (+49) Fax: (+49) München Linklaters LLP Prinzregentenplatz München Postfach München Tel: (+49) Fax: (+49) Editors: Dr Daniel Pauly daniel.pauly@linklaters.com Dr Konrad Berger konrad.berger@linklaters.com This publication is intended merely to highlight issues and not to be comprehensive, nor to provide legal advice. Should you have any questions on issues reported here or on other areas of law, please contact one of your regular contacts, or contact the editors. Linklaters LLP. All Rights reserved 2009 Please refer to for important information on our regulatory position.. We currently hold your contact details, which we use to send you newsletters such as this and for other marketing and business communications. We use your contact details for our own internal purposes only. This information is available to our offices worldwide and to those of our associated firms. There will be no disclosure to third parties for their respective purposes. If any of your details are incorrect or have recently changed, or if you no longer wish to receive this newsletter or other marketing communications, please let us know by ing us at publications.germany@linklaters.com. Linklaters converted to Linklaters LLP on 1 May References in this document to Linklaters for the period following 1 May 2007 accordingly refer to Linklaters LLP and, where relevant, its affiliated firms and entities around the world. Linklaters LLP is a limited liability partnership registered in England and Wales with registered number OC It is a law firm regulated by the Solicitors Regulation Authority. The term partner in relation to Linklaters LLP is used to refer to a member of the LLP or an employee or consultant of Linklaters LLP or any of its affiliated firms or entities with equivalent standing and qualifications. A list of the names of the members of Linklaters LLP and of the non-members who are designated as partners and their professional qualifications is open to inspection at its registered office, One Silk Street, London EC2Y 8HQ, England or on and such persons are either solicitors, registered foreign lawyers or European lawyers. 8