Extract by Daniel Felz of Alston & Bird
To strengthen data-protection enforcement, the German legislature recently passed a law that permits registered consumer-protection organizations (called Verbände) to bring suits on behalf of consumers to enjoin data-protection violations. The law—styled as an “Act to Improve the Civil Enforcement of Consumer-Protection Provisions of Data-Protection Law” (the “Enforcement Act”)—was proposed in spring 2015 and, after spending months in committee, was passed on December 17, 2015. Many of the Enforcement Act’s provisions will enter into force as soon as it is published in Germany’s Federal Gazette.
The Enforcement Act’s most salient feature is a provision granting standing to Verbände—which are qualified, federally-registered, nonprofit consumer-protection organizations—to bring actions on behalf of consumers to enjoin data-protection violations. These kinds of organization-brought injunction suits (called Verbandsklagen) resemble injunction class actions under Federal Rule of Civil Procedure 23(b)(2) because the consumer organization seeks, and is empowered to obtain, a ‘global’ injunction prohibiting a company from engaging in purportedly wrongful conduct that harms consumers (or a class of consumers) generally. They are well-established in German law and legal culture.