BGH enables competitor lawsuits for data protection violations
With its judgment of March 28, 2024 (Case Nos. I ZR 222/19 and I ZR 223/19), the Federal Court of Justice (BGH) has made a landmark ruling at the intersection of data protection and competition law. The court confirmed that companies can take action against competitors who violate the provisions of the General Data Protection Regulation (GDPR) and where this also constitutes a violation of the Act Against Unfair Competition (UWG). This decision is of significant practical importance and raises numerous new questions regarding enforcement of the law and compliance.
Context and Legal Background
Data Protection Violations and Fair Competition Law
The BGH makes it clear that violations by a company of key provisions of the GDPR, particularly Articles 5 and 6 GDPR concerning the lawfulness of data processing, can at the same time constitute a competition violation pursuant to § 3a UWG. This applies especially when the relevant GDPR provision represents a market conduct rule relevant to competition within the meaning of the UWG. Thus, a competitor can file a claim for injunctive relief against a data protection violation, provided that the disputed data processing could cause them competitive disadvantages.
Relationship to the GDPR: Sector-Specific Legal Protection
The GDPR itself, in Articles 77 et seq., provides for a graduated system of legal remedies for affected individuals, as well as, in Article 80 GDPR, the option for representation by qualified organizations. Nevertheless, the BGH, in continuation of the case law of the European Court of Justice (ECJ, judgment of 28.04.2022, C‑319/20), emphasizes that these regulations do not exclude the possibility of additional legal remedies—such as those available to competitors under the UWG—where the national legal system allows for this. As long as the national legal order provides space for such actions, this avenue of access remains open.
Implications for Companies and Competition
Increased Compliance Requirements
As a result of the decision, companies are subject to an intensive obligation to review their own business practices with regard to data protection law. In the future, it can be expected that not only affected consumers or supervisory authorities, but also direct competitors, will identify and litigate data protection violations. The risk of costly warning notices and legal disputes increases.
Protection of Market Participants and Fair Competition
The court explains that the purpose of the relevant data protection provisions is also aimed at safeguarding the orderliness and fairness of competition. Particularly sensitive issues arise where data-driven business models are used and the handling of consumers’ personal data can constitute a significant competitive advantage.
Scope and Limitations
Nevertheless, the BGH emphasizes that not every data protection violation automatically qualifies as a competition violation. A UWG violation is only considered where a data processing provision in the GDPR directly aims to protect market behavior and thus affects the interests of other market participants, in particular competitors.
Practical Consequences and Future Developments
New Dynamics in Legal Enforcement
The latest case law could lead to a noticeable expansion of the right to bring legal actions in the competitive environment. Companies are now subject to new review and control mechanisms by competitors, underscoring once again the importance of legal compliance in the design of data protection declarations and data processing procedures.
International and National Legal Situation in Focus
The decision is relevant not only for the German domestic market, but, thanks to its basis in European Union law, also for companies operating internationally. In particular, companies operating across borders must be prepared for different national approaches. Future court proceedings are expected to further clarify and define the scope for legal action in cases of data protection violations.
Proceedings and Liability Issues
It is important to stress that the opening up of competition law as an additional level of sanctions does not displace the still central role of the data protection supervisory authorities or the individual remedies available to affected persons. It remains to be seen how case law—especially at the European level—will continue to develop and how courts will concretely define the criteria for a violation of market conduct rules.
Conclusion
The BGH ruling marks an important milestone in the interlinking of data protection and competition law. Companies are required to pay even greater attention to compliance with the GDPR in their processes, as violations can now also attract attention from competitors. Legal certainty, transparency and compliance are coming increasingly into focus for all market participants.
For in-depth legal questions in the area of data protection and competition law, the lawyers at MTR Legal are happy to assist you as competent contacts.
