The new German Data Protection Act and its compatibility with the European Data Protection Directive

Abstract

A substitution of the right to maintain mailing lists for marketing purposes (the so-called list privilege) by a strict opt-in requirement as proposed by the German Government for the amendment of the German Data Protection Act does not conform with European law. Making the use of relatively innocuous data like name and address for marketing purposes subject to the data subject's declaration of consent infringes upon the requirements of the European Data Protection Directive. The Directive allows for the use of personal data either on the basis of a data subject's declaration of consent or after a balancing of legally protected interests. Reducing this two-track model to a one-track model (based on the data subject's declaration of consent only) does not do justice to the idea of balancing of interests or free movement of goods and services which are a mandatory part of European law. The draft bill interferes drastically with the free movement of goods and services. A tightening of the opt-in requirements would be a severe burden for the German economy because it is impossible for businesses to distribute their goods and services without the help of marketing measures. The economic cycle would be hit at its weakest point, i.e. the link between businesses and consumers which is gaining more and more importance especially with a view to cross-border competition.