The German Data Protection Law Revised

The following News Information has just been released from FEDMA

This reform will lead to significant changes, the effects of which will be felt by the entire Direct Marketing sector, in particular the Direct Mail sector and list brokers. In cooperation with our German member, the Deutsche Dialogmarketing Verband - DDV e.V., FEDMA would like to make you aware of the most important changes.

In the evening of last Friday, 3rd July, the German Bundestag adopted a revision of the Federal Data Protection Act ("Bundesdatenschutzgesetz"). The changes are aimed at "restricting the illegal trade in personal data" and giving data subjects more control over the processing of their personal data. The changes will go into effect on 1 September 2009. A transitional period until 31 August 2012 applies to data that were collected prior to September 2009. An additional set of changes to the law, dealing with "scoring" practices, was already adopted on 29 May 2009 but will not come into force until April 2010.

The new law marks a change in paradigm from "opt-out" to "opt-in" for the use of personal data for marketing purposes. Although the legislator made some amendments following protests by the industry, the new law will be burdensome for industry, and will also create a significant degree of legal uncertainty.

Exceptions from the "opt-in" obligation apply in the following cases:

• for business-to-business marketing;
• for the marketing of a company's own products to existing customers;
• using data from public directories (phone book, etc.) to market a company's own products;
• for donations (exception applies to charitable organisation and political parties [not for political marketing]);
• for transfers and trading of address data, if the mailing clearly states where the data was first collected; any transfer to third parties will have to be recorded in a register for two years (starting in April 2010);
• the use of data for marketing purposes is allowed if the source of the data is distinctly noticeable on the marketing material (this exception allows traditional list broking and is not limited to address data).

The law will not affect the existing German regulations on marketing by e-communications (e-mail, SMS, etc.), which are opt-in. With an exception for the marketing of similar products to existing customers; or telemarketing which is opt-in for "cold calling".

Under the new law, where personal data are collected for market research, they may only be used for a specific project. If they are to be used for other research projects, the data will have to be anonymised. An exception applies to data from publicly available sources.

Besides the introduction of the "opt-in", there are several other changes which could be burdensome for the industry:

• The already existing principles of "avoidance" and "minimisation" have to be applied whenever data is processed (before only when designing data management systems);
• The role of the data protection offices is strengthened (e.g. improved protection against laying off a privacy officer);
• Additional contractual requirements for sub-contracting of processing operations;
• New regulations for scoring, e.g. limiting the use of geographic data for scoring;
• The level of protection for employee data is increased (a special law might follow in the next legislative term);
• The enforcement powers of the data protection authorities is significantly widened under the new law;
• The authorities and the data subject will have to be notified when certain types of data (e.g. financial data) are lost and the data subject may face significant damages ("data breach notification");
• Fines for violations are increased to 300,000 Euros, and could also include skimming of profits.

It is still unclear how some of the new provisions will be applied in practice, and leaves room for interpretation. Initially, this will create a great deal of legal uncertainty.