In a judgement from 25.10.2018, the Oberlandesgericht Hamburg concluded, that violations of the GDPR are principally actionable by competitors. However, this only applies, if the violated GDPR rule’s additional purpose is also to protect market behavior.

The competitor’s right of action

With its decision, the Court affirms the competitor’s right of action in accordance with German unfair competition law in regard of the Data Protection Directive as well as in regard of the GDPR. The Court states that the Data Protection Directive obviously does not contain an exhaustive sanctionative system that prohibits actions against data protection violations according to civil law. Although the Data Protection Directive aimed at full harmonization of data protection law within the European Union, the Directive does not contain an exhaustive system of remedies.

With a view to the GDPR, the Court ruled that the GDPR, like the Data Protection Directive, does not contain an exhaustive sanctionative system that excludes competitors’ actions in accordance with competition law.

In the Court’s opinion, the provisions of the GDPR do not limit civil actions against GDPR violations to the data subject whose personal data was processed by the controller. According to the judges, the GDPR only defines a minimum level of remedies and is open to other remedies and sanctions that are not explicitly regulated within the GDPR. 

The Landgericht Würzburg (District Court Würzburg) arrived at the same conclusion in its court decision from 13.09.2018. However, the District Court did not provide any legal opinion for the conclusion.

In another case from 07.08.2018, the Landgericht Bochum (District Court Bochum) held a different view. Here the Court was of the opinion that the provisions in Artt. 77 to 84 GDPR have to be seen as an exhaustive rule that conclusively determines the entitled categories of possible claimants. Therefore, actions beyond those provisions by a competitor are not possible, because with the provisions in the GDPR the European legislator expressed his intention not to extend the categories of possible claimants. 

The Landgericht Wiesbaden (District Court Wiesbaden) comes to the same conclusion, adding in its decision from 05.11.2018 that because of the exhaustive provisions in Artt. 77 to 84 GDPR there is no gap in legal protection that needs to be closed by competition law.

Additional purpose of GDPR rule must be to protect market behavior

The Oberlandesgericht Hamburg also ruled that violations of the GDPR do not necessarily result in an injunctive relief in accordance with competition law. The question whether an injunctive relief is justified, depends on the violated GDPR rule. If the rule also has the purpose to protect market behavior, than a competitor’s injunctive relief is justified. This has to be legally examined on a case-by-case basis.

Summary

In Germany the discussion, whether competitors can prosecute data protection violations remains an open discussion. With the decision of the Oberlandesgericht Hamburg, there is now one Higher Regional Court that allows claims with regard to competition law. However, this ruling is not binding to other courts in Germany and remains in discussion until the Bundesgerichtshof (Federal Supreme Court) delivers a final judgement.

Article provided by: Jens Eckhardt & Nils Steffen (Derra, Meyer & Partner Rechtsanwälte PartGmbB)

Discover more about the Cloud Privacy Check(CPC) / Data Privacy Compliance(DPC) project

Director CPC project: Dr. Tobias Höllwarth, tobias.hoellwarth@eurocloud.org

VIEW PROJECT