posted that the German Government, in a reaction to several scandals regarding illegal trade with address lists, put forward a draft Amendment to the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) which aimed to abolish the so-called “list privilege” (“Listenprivileg”).
Under this exception from the general consent requirement, certain personal data such as name, address and job title, if pooled in a list covering a group of people, may be used for a company’s own marketing purposes and transferred to third parties for advertising and marketing without the specific prior consent of the customer.
What followed were months of hefty controversy between privacy advocates and interest groups; the latter claiming that such limitations on direct marketing would seriously harm whole industry sectors. Then, in virtually the last days before parliamentary recess in July 2009, the German Parliament (Bundestag) and the Upper Chamber (Bundesrat) managed to pass, within a set of amendments to the BDSG, a watered-down revision of the list privilege, at Sec. 28 (3) (now Sec. 28 (3), (3a), (3b)). Key elements are:
The general rule is now explicit: any transfer of personal data for address trading and marketing purposes demands the prior consent of the data subject.
Nevertheless, three exceptions may allow for the use of the data without such consent, if necessary for (1) marketing the data controller’s own goods and services; (2) advertisements in a business context; and (3) advertisements for charitable donations. Finally, a fourth exception had found its way into the statute, allowing for the use of the data for advertisements for third party offerings, if the data processor is clearly mentioned as the source of this advertisement.
Such aggregated personal data may also be transferred to a third party in order to let the third party use the data for its own advertising purposes. In this case both sides must keep records of such transfer – but only for the purpose of documenting such transfer! – for two years. The third party must inform the customer together with the advertisement about the identity of the source where the data were collected.
The new rules are complemented by new information rights and administrative offences, for instance the use of the data for advertising purposes after the data subject has declared his disagreement.
The changes will come into force on 1 September 2009. Under a transition rule, the old rules still apply to data collected until this date and used for marketing purposes until 31 August 2012, which may make it quite complicated to deal with data stores. The complicated arrangement of the new law itself reveals its nature as a compromise. Datonomy will keep you informed as to how this (paper?) tiger will “bite” in practice.