The answer to the question in the headline is yes. Since February 2016, German consumer associations have been able to take legal action against data protection breaches that have a commercial connection. They do this under the Unterlassungsklagegesetz (UKlaG), the Injunctive Relief Act.
The idea first appeared in a draft bill from the Federal Ministry of Justice and Consumer Protection (BMJV) in June 2014. That draft went out to associations for comment, with a deadline of 15 August 2014.
What the 2014 draft proposed
The draft had three main parts:
- It added data protection rules for businesses dealing with consumers to the catalogue of consumer protection laws in § 2 UKlaG.
- It added a claim for removal of the infringement, alongside the existing claim to stop it. In data protection, that means unlawfully held data can be deleted or blocked.
- It proposed that standard terms could demand only text form, not written form, for consumer declarations (§ 309 No. 13 BGB).
Commentators at the time expected a rise in warning letters and lawsuits, and businesses expected to have to adapt their contracts.
What the final law did
The law was published in the Federal Law Gazette in February 2016 and applied from 24 February 2016. The legislature narrowed the scope compared with the first draft. The new rules cover data protection provisions that apply when businesses collect, process or use consumer data for commercial purposes. Examples include advertising, market research, credit reporting, profiling, address trading and similar purposes.
The removal claim was kept. The Bundestag’s legal committee proposed that its content and scope follow the specific data protection rules on correction, deletion and blocking. That wording was adopted, and § 2 UKlaG now says so.
To limit abuse, the law also sets requirements for the associations that may sue, which are recorded in a list under § 4 UKlaG. A transitional rule suspended the new provision for certain data transfers until 30 September 2016.
The GDPR era
The General Data Protection Regulation has applied since May 2018. Article 80 lets non-profit bodies enforce data protection rights, and the UKlaG supplies the German legal basis. In May 2022 the Court of Justice of the EU ruled that consumer associations may sue over GDPR infringements without a specific affected person having been harmed. The German Federal Court of Justice (BGH) later followed this approach. It held that associations need only name a category or group of identifiable people affected, not an individual.
For businesses, the practical effect is that a data protection breach now carries a risk of warning letters and injunction suits from associations, besides fines from the supervisory authorities. Companies handling consumer data should check their compliance with qualified legal advice.
FAQ
Who can bring a collective data protection action in Germany?
Qualified consumer associations that meet the statutory requirements and appear on the official list, as well as other entities the law allows, can do so.
Can an association sue without a specific victim?
Yes. According to the CJEU’s 2022 ruling, no individual victim needs to be harmed in advance.