On January 24, 2014, the Berlin Court of Appeal upheld the ruling of lower court concerning the file against Facebook by the German consumer protection association (“Verbraucherzentrale Bundesverband – VZBV), stating that Facebook’s “Friend Finder” is unlawful, hence it is violating the German data protection law as well as the unfair trade law. Furthermore, the Court confirmed that several clauses of Facebook’s privacy notice and online terms and conditions do not reach up to the German standards and are therefore invalid.

The VZBV reported the ruling as a consumer victory!

At the time when the original complaint was filed, the Facebook Friend Finder function invited its users to find friends from different parts and times of their lives to reconnect with them. The users had to provide several pieces of information to Facebook such as personal infos regarding schooling, employment etc.. They were also able or as Facebook said “invited” to upload personal contact infos of their friends like Skype and MSN; this enabled Facebook to add the “non-user Friends” to its own database and then send them Emails, in which they were invited to join its social media platform. The complaint also included that the information and data could also be used for other, especially commercial purposes.

The Court stated that Facebook failed to provide the adequate and necessary notice to their Facebook users who provided the info. Moreover, Facebook also collected personal information of individuals, who were not even Facebook users, without their knowledge or consent. 

Even though the European headquarters of Facebook are in Ireland, the Court established that German law would apply in this case, because, first, the users’ computers were located in German and, second, Facebook used German service providers.

This application had to be distinguished from previous before the Schleswig – Holstein Administrative Court, where Irish law was applied, hence it concerned Facebook’s marketing activities which were controlled and set from Ireland.

A breach of data protection law also includes the breach of the German Unfair Trade Act. By collecting information without prior notice or consent of the users, Facebook breached Germany’s Data Protection Act and Telemedia Act. By using this data for also commercial purposes without users’ knowledge or agreement the Unfair Trade Act was clearly violated. Facebook – unlike other companies –  did not use  “tell a friend” method, rather than sending out these emails itself.

Eventually, the Court also ruled that a variety of certain clauses of Facebook’s terms and conditions (Allgemeine Geschaeftsbedingungen) and privacy terms (Datenschutzrichtlinien) are invalid, because they were not clear and modified enough to be understood by every user. 

For several years, the VZBV wanted the German government to pass a legislation permitting data protection based actions. Now, the German government has, finally in February 2014, announced that a draft bill amending the German Injunctions Act is expected next April.

Generally, these amendments will extent the scope of certain provision permitting consumer associations to initiate proceedings to protect and defend individuals’ rights, for instance the data protection laws.

This would also provide a  new legal basis for litigation in Germany related to privacy and data protection.

Best regards
und viele Grüße aus Charlotte
Reinhard von Hennigs
www.bridgehouse.law