Cease and desist notice under competition law for missing data protection declaration

The Higher Regional Court (OLG) had to decide whether the absence of an imprint and a data protection declaration on an internet portal which requested its users to deposit personal data constituted a violation of German competition law and whether the information obligation in relation to data collection pursuant to the Telemediengesetz constitutes a so-called market conduct norm, in the event of a breach of which a cease and desist notice under competition law from a competitor may be issued.

A manufacturer of blood pressure measuring devices commissioned an advertising agency with a campaign on the internet. Prospective customers were thereby requested through internet advertising to register via the internet in order to receive the manufacturer's device for trial purposes.

The internet page operated by the agency, on which customers could register, contained neither an imprint nor information on the collection and use of the personal data required for the registration of the customers approached. A competitor of the manufacturer issued a paid cease and desist notice and demanded discontinuation. However, the manufacturer refused to issue a legally binding cease and desist declaration because, on the one hand, he held the legal view that he was not liable for the errors of his advertising agency and, on the other hand, that the absence of a data protection declaration on the internet page did not constitute a violation of competition law.

How did the OLG Hamburg decide?

By means of Judgment of 27.06.2013 – Az. 3 U 26/12 the Higher Regional Court (OLG) Hamburg decided that the manufacturer was also liable for a breach by its advertising agency, which carried out unfair advertising with the present advertisement. In particular, a missing imprint constituted a violation of the disclosure obligations of an internet portal operator.

Furthermore, the OLG Hamburg also decided that the data protection regulation, according to which internet users must be informed at the beginning of the usage process about the type, scope and purposes of the collection and use of personal data as well as about the processing of their data in general and in an understandable form, constitutes a market conduct norm and thus a violation of competition law results from non-compliance with this rule. This should, in any case, also protect the competitive development of competitors by creating equal competitive conditions. The provision thus also serves the protection of the interests of competitors and is thus a regulation which is intended to regulate market conduct in the interest of market participants.

Conclusion

The question of whether data protection regulations constitute provisions that can be the subject of cease and desist notices under competition law is disputed and has not yet been decided by the highest court. However, according to the present decision of the OLG Hamburg, internet portal operators should in any case maintain a data protection declaration, particularly if their users provide personal data to the portal operators.