Recently the German public has been shaken not only by scandals concerning the use – and misuse – of employees’ data, but also by several revelations of illegal trade with address lists. One of the cases that provoked public uproar was the sale of six million pieces of data, including four million bank accounts, for 850 Euro.
The German Government reacted by putting forward, within a whole bunch of amendments to the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), the proposal to require the data subject’s express consent for any transfer of data to third parties.
If agreed upon, the bill could come into force on 1 July, 2009. But presently this seems unlikely, due to hefty controversy.
Under the current draft bill (BDSG-E) personal data can no longer be transferred to third parties for advertising and marketing purposes without the specific prior consent of the customer, except in very limited cases.
Thus the draft bill abolishes a currently-existing right of companies not only to use personal customer data which have been given to them in the course of a contract for their own marketing purposes without the consent of the data subject, but also to transfer certain personal data to third parties without consent, if these data are pooled in a list, which is called the “list privilege” (“Listenprivileg“). This applies to data on occupation, name, title, academic degree, address – but not e-mail-address -, date of birth and the membership of a specific group. According to the draft bill, only the use of such data for one’s own advertising purposes will still be allowed without explicit consent. Whereas the transfer of data which have already been collected would remain permissible during a transitional period until July 2012, the new provisions would immediately apply to all newly collected data. This would require companies to maintain two separate databases.
All this, as well as other legislative proposals concerning scoring and data protection audits, has caused a debate on the suitability of the envisaged measures and the negative impact the reform might have for the national economy. The comments of the second chamber of German Parliament (Bundesrat) indicate some reservations against the reform package. Industry groups have heavily lobbied against it, claiming that it would dramatically affect current legitimate practices of direct marketing. They argue that the privilege to use list data for advertising and marketing purposes has been relied upon by small and medium-size companies, which could not afford expensive TV and press advertising campaigns. Experts are afraid that through the introduction of the “permission marketing” the number of available address data will be significantly reduced and firms will no longer be able to tailor their advertising to different groups of consumers, which might lead to economic losses and, in the end, redundancies. The most-affected industry section might be the press industry.
On the other hand the recent data scandals have led to a high public awareness and the call for more restrictive measures in favour of privacy protection by data protection commissioners and consumer groups. They regard an opt-in procedure as the proper solution for more transparency and prevention of the misuse of data.
Industrial organisations now ask for a compromise between data protection and the companies’ interest in using adequate advertising methods. BITKOM (German Association for Information Technology, Telecommunications and New Media) and DDV (German Dialogue Marketing Association) propose to uphold the list privilege for data transfers to such companies which have received a certificate as being compliant with data protection rules. The public now awaits the outcome of the current reform discussion.