Electronic Communications for Marketing Purposes
The protection of personal data in the context of electronic communications for
marketing purposes is subject to the ePR. Every end-user of electronic communications services shall have the same remedies provided for in Art. 77, 78 and
79 GDPR, Art. 21 para. 1 ePR, as well as the right to compensation in case of
suffering material or non-material damage as a result of an infringement of the ePR,
Art. 22 ePR. Administrative fines shall be up to 10 million Euros, or in the case of an
undertaking, up to 2% of the total worldwide annual turnover of the preceding
financial year, whichever is higher, Art. 23 para. 2 lit. d) ePR. Moreover, illegal
communications for marketing purposes may be answered by cease and desist letters
by competitors, consumer organizations and business organizations under §
12 UWG. In practice, this particular German way of private enforcement is of a
significant effectiveness and includes lawyers’ costs of the sender of the letter.
Personal Data of Employees
The breach of rules regarding the electronic processing of personal data of
employees is neither specifically addressed in the GDPR nor in the new BDSG
and thus subject to general rules.
Security of Personal Data Processed by Electronic Means
The degree of responsibility of the controller or processor taking into account
technical measures to ensure the security of processing shall be regarded when
deciding whether to impose an administrative fine and deciding on the amount of
the administrative fine in the individual case, Art. 83 para. 2 lit. d) GDPR. Beyond
that, a breach of rules regarding the security is not specifically addressed in the
GDPR and thus subject to general remedies granted by the GDPR. In case of a
breach of rules of the BSIG, administrative fines up to 100,000 Euros can be
imposed.
Electronic Communications Sector
The end-users of electronic communications services shall have the same remedies
provided for in the GDPR, Art. 21, 22 ePR.
82 Administrative fines can also be issued
up to 20 million Euros or 4% of the annual turnover, Art. 23 ePR. Member States
shall lay down other penalties, Art. 24 ePR.
82 See Sects. 2.5.1 and 2.5.2.
Data Protection in the Internet: National Report Germany
205
The protection of personal data in the context of electronic communications for
marketing purposes is subject to the ePR. Every end-user of electronic communications services shall have the same remedies provided for in Art. 77, 78 and
79 GDPR, Art. 21 para. 1 ePR, as well as the right to compensation in case of
suffering material or non-material damage as a result of an infringement of the ePR,
Art. 22 ePR. Administrative fines shall be up to 10 million Euros, or in the case of an
undertaking, up to 2% of the total worldwide annual turnover of the preceding
financial year, whichever is higher, Art. 23 para. 2 lit. d) ePR. Moreover, illegal
communications for marketing purposes may be answered by cease and desist letters
by competitors, consumer organizations and business organizations under §
12 UWG. In practice, this particular German way of private enforcement is of a
significant effectiveness and includes lawyers’ costs of the sender of the letter.
Personal Data of Employees
The breach of rules regarding the electronic processing of personal data of
employees is neither specifically addressed in the GDPR nor in the new BDSG
and thus subject to general rules.
Security of Personal Data Processed by Electronic Means
The degree of responsibility of the controller or processor taking into account
technical measures to ensure the security of processing shall be regarded when
deciding whether to impose an administrative fine and deciding on the amount of
the administrative fine in the individual case, Art. 83 para. 2 lit. d) GDPR. Beyond
that, a breach of rules regarding the security is not specifically addressed in the
GDPR and thus subject to general remedies granted by the GDPR. In case of a
breach of rules of the BSIG, administrative fines up to 100,000 Euros can be
imposed.
Electronic Communications Sector
The end-users of electronic communications services shall have the same remedies
provided for in the GDPR, Art. 21, 22 ePR.
82 Administrative fines can also be issued
up to 20 million Euros or 4% of the annual turnover, Art. 23 ePR. Member States
shall lay down other penalties, Art. 24 ePR.
82 See Sects. 2.5.1 and 2.5.2.
Data Protection in the Internet: National Report Germany
205