Germany adopts law to enable class actions for data protection violations
On December 17, 2015, the German Federal Diet (Bundestag) adopted a draft law introducing class action-like claims that will enable consumer protection associations to sue companies for violations of German data protection law.
The law amends Germany's Act on Actions for Injunctions to allow consumer protection associations to bring lawsuits against companies for improper use of consumer data in violation of German data protection law.
At this time, only affected individuals, German criminal prosecutors and data protection authorities have legal standing to sue businesses for breaches of data protection law.
Importantly, the law prevents consumer protection associations from bringing claims for violations of international data transfer rules against companies relying on the invalidated Safe Harbor agreement until the end of the day of September 30, 2016 to the extent the transfer of data was based on the Safe Harbor Framework until October 6, 2015.
The draft law still needs to be signed by the president and published in the Federal Law Gazette before becoming law.