1. Data transfers following Schrems II

by Sven Schonhofen, LL.M.

On July 16, 2020, (docket no.: C-311/18) the CJEU ruled that the EU-U.S. Privacy Shield was invalid, but that the Standard Contractual Clauses remained valid, although they might require supplementary measures. The European Data Protection Board has published recommendations on such measures, in particular, technical, organizational and contractual measures (more on our blog). Further, the European Commission has published new draft Standard Contractual Clauses, which now also include provisions on processor-to-processor and processor-to-controller transfers.

Conclusion: Organizations must conduct their data transfer mapping and implement sufficient data transfer mechanisms. Supervisory authorities are already actively reviewing data transfers following Schrems II.

2. German Supreme Court: Relationship between the GDPR and the German Act on the Protection of Copyrights in Works of Art and Photographs with respect to media privilege

by Dr. Philipp Süss, LL.M., Dr. Alexander Hardinghaus, LL.M.

On July 7, 2020, (docket no.: VI ZR 246/19), the German Supreme Court held that the legitimacy of adding photographs of persons to journalistic works needs to be assessed solely in accordance with sections 22 and 23 of the German Law on the Protection of Copyright in Works of Art and Photographs even though the GDPR has now entered into force. In support of its ruling, the Supreme Court made reference to the provisions of state law, pursuant to which the processing of personal data for journalistic purposes is widely exempted from the provisions concerning the lawfulness of processing in articles 6 and 7 GDPR. German federal states have therefore made use of the opening clause in article 85 GDPR (concerning media privilege).

Conclusion: The GDPR is not relevant when answering the question of whether photographs of a person can be lawfully included in journalistic works.

3. Munich Regional Court I: Right to obtain copies of personal data in accordance with article 15 (3) deemed comprehensive

by Arne Senger, LL.M.

By its judgment of April 6, 2020, (docket no.: 3 O 909/19), the Munich Regional Court I held that data subjects’ right to obtain copies of personal data in accordance with article 15 (3) GDPR generally covers all personal data stored by the controller. Following the ruling, copies of personal data, in particular in the form of telephone notes, memos, minutes, emails, and letters, must also be handed over to the data subject.

Conclusion: Munich Regional Court I’s judgment is in line with the Cologne Court of Appeals’ judgment of July 26, 2019, (docket no.: 20 U 75/18) and the Landau Regional Court’s judgment of September 17, 2019, (docket no.: 3 O 389/17), which also granted a comprehensive right of access to information. However, in a recent judgment of August 28, 2020, (docket no.: 3 O 248/19), the Ulm Regional Court found that the right to obtain copies of personal data does not include declarations of intent made by the data subject (e.g., to terminate an agreement).

4. Damages under GDPR

by Dr. Thomas Fischl

In the past, German courts tended to be reluctant to grant compensation in proceedings for immaterial damages under article 82 GDPR. They demanded proof of a concrete and substantial immaterial damage. From a number of recent decisions, however, a clear trend can be seen which is more in the direction of punitive damages, similar to the U.S. approach. This is because some judgments give a very broad interpretation of the concept of damage within the meaning of article 82 (1) GDPR. However, in some cases, the courts still come to the conclusion that no compensation is to be paid, e.g., due to a lack of causality. 

Conclusion: Should the broad interpretation of the concept of immaterial damage prevail, however, and should other courts also agree with this view (such as, most recently, the Frankfurt Regional Court by its judgment of September 18, 2020, (docket no.: 2/27 O 100/20)), it would not be surprising to see an increase in litigation for damages in the near future.

5. Frankfurt/Oder Regional Court: Marketing consent must be clear and specific

by Dr. Andreas Splittgerber

Marketing consent with the wording “By providing my email address, I agree that XY may send me regular information by email” is not sufficiently clear and specific. This judgment of the Frankfurt/Oder Regional Court of June 18, 2020, (docket no.: 31 O 59/19) confirms earlier case law, e.g., the judgment by the Frankfurt/Main Court of Appeals of June 27, 2019, (docket no.: 6 U 6/19). The latter ruled that advertising consent must clearly inform about the advertiser, as well as the concrete categories of advertising measures.

Conclusion: Marketing consent is still the subject of numerous court decisions. As a rule of thumb, advertisers should try to formulate the consent in such a way that users can get a good idea, when giving their consent, of what they will receive, from whom and how often.

6. Update on influencer advertisement requirements

by Ramona Kimmich

The Karlsruhe Court of Appeals (by its judgment of September 9, 2020, (docket no.: 6 U 38/19)) and the Cologne Regional Court (by its judgment of July 21, 2020, (docket no.: 33 O 138/19)) have held that tagging product images in social media posts of public influencers, which direct the user to the product supplier, are considered advertising. As a consequence, posts that contain tags must be labeled as advertising, irrespective of whether the influencer was paid for it.

By contrast, on July 2, 2020, the Hamburg Court of Appeals (docket no.: 15 U 142/19) dismissed a similar first instance judgment, holding that the commercial purpose of posts from famous influencers, who have millions of followers and get thousands of likes per post, would be immediately clear in the circumstances and thus labeling was not required.

Conclusion: Organizations that engage influencers should monitor developments in this area, particularly since the Karlsruhe Court of Appeals and the Hamburg Court of Appeals have allowed for an appeal to be filed with the German Supreme Court, which will likely provide more legal clarity soon.

Recommended readings in the areas of EU and German IT and data protection law

by Sven Schonhofen, LL.M.

• European Data Protection Board

• Guidelines on the concepts of controller and processor – more on our blog.
• Guidelines on targeting of social media users – more on our blog.
• Statement on the future of the ePrivacy Regulation

• EU Commission:

• Draft template data processing agreement
• Draft Data Governance Act

• German supervisory authorities

• Guidelines on video surveillance
• Guidelines and checklist on video conference systems

• Checklists by the Bavarian DPA

• Remote working
• Cybersecurity for medical facilities
• Patch management
• Good practices for technical and organizational measures

• Lower Saxony DPA: Requirements for cookie consent
• €35 million fine against H&M – more in our article.
• CJEU on consent requirement – more on our blog.