Google's data protection provisions unlawful!

The Regional Court (LG) Berlin has decided that Google's data protection clauses may not be used further due to violation of German data protection law.

Foreign internet companies often use data protection provisions from the Anglo-American legal system. The question is whether these are applicable to German users.

The Federal Association of Consumer Centres and Consumer Associations (vzbv) had now also challenged 13 data protection clauses and sought to have the market leader among internet search engines ordered to cease the use of the clauses. The court ruled in favour of the vzbv.

Court's decision

The LG Berlin had to decide in its judgment of 19.11.2013 – Az. 15 O 402/12 initially whether German law should be applied at all to the question of the lawfulness of the data protection provisions. The court answered in the affirmative, because in contracts concluded by a consumer with an entrepreneur, the law of the country in which the consumer has his habitual residence is decisive, provided that the entrepreneur's activity is directed in any way towards the consumer's home country. The question of applicable law had been decided differently by the Higher Administrative Court (OVG) Schleswig in the matter Independent State Centre for Data Protection (ULD)/Facebook.

The LG Berlin took the view that the statutory provisions, according to which the collection and use of the desired data may exceptionally be permitted, were not fulfilled. Consequently, an effective consent of the user to the data use desired by Google would be required. However, this requirement was not met. In this regard, the court stated, in connection with the following registration screen:

"I agree to Google's Terms of Service and have read the Privacy Policy."

the consumer must initially assume that he is giving his consent to the data protection provisions. However, the individual provisions from the privacy policy were then to be assessed.

The clause:

"We will disclose personal data to companies, organizations or individuals outside of Google if we in good faith have reason to believe that access to, use of, retention or disclosure of that information is reasonably necessary to

• comply with applicable laws, regulations, or applicable legal processes or to comply with an enforceable government request
• enforce applicable Terms of Service, including investigation of potential violations
• detect, prevent or otherwise address fraud, security or technical issues
• protect the rights, property or safety of Google, our users or the public, to the extent permitted or required by law."

was held to be unlawful. The court came to the conclusion that this clause was too vague in its formulation to bring about an informed and deliberate decision by the consumer on consent.

The statutory exception, according to which certain data may be transmitted without consent for purposes of criminal prosecution and hazard prevention by police authorities, constitutional protection authorities, etc., is extended to all laws, regulations and government orders. The clause is therefore not suitable to bring about an informed and deliberate decision by the consumer on consent.

The clause:

"In the event that Google is involved in a merger, acquisition or sale of assets, we will continue to ensure the confidentiality of any personal data and we will notify affected users before personal data is transferred [or becomes subject to a different privacy policy]."

refers to future circumstances, upon the occurrence of which customer data might possibly be transferred to third parties. Under this, non-transfer to third parties in the event of mergers represents only one partial aspect. However, the consumer does not perceive to the required extent to whom his data might possibly be transferred. A "blank consent" (literally), which does not refer to the specific circumstances, does not meet the requirements for effective consent.

The clause:

"When you use location-based Google services, we may collect and process information about your actual location, such as GPS signals transmitted from a mobile device."

for the collection of so-called geo-data is not already permitted under statutory exceptions. Therefore, effective consent of the consumer would be required again. However, due to the vagueness of the clause, the consumer cannot ascertain whether the data might possibly also be used for advertising purposes; the wording does not reveal this.

The clause:

"We use various technologies to collect and store information when you access a Google service, including sending one or more cookies or anonymous identifiers to your device. Furthermore, we also use cookies and anonymous identifiers when you interact with services that we offer to our business partners, such as advertising services or Google features that are displayed on other websites."

opens up the possibility of merging the collected data with already known personal data. However, the creation of usage profiles is only permitted within narrow limits by law; they may, among other things, only be created using pseudonyms. Whether Google complies with this cannot be inferred from the wording of the clause.

Google appealed against the judgment.

Conclusion

The judgment of the LG Berlin shows that special attention must be paid to the precise formulation of data protection provisions. The consumer must be able to understand the collection and use of his data in order to be able to make an effective decision on whether to consent to the desired collection and use or not.

The judgment of the LG Berlin furthermore represents another decision on the question of applicable law in the case of services provided by foreign operators on the internet such as Google, Facebook and others.