Nullity of purchase agreements for the acquisition of personal data without the consent of the data subjects concerned

By judgement of January 29, 2018 – Case No. 13 U 165/16, the Higher Regional Court of Frankfurt am Main ruled that a contract for the sale of address data is ineffective without sufficient consent of the address owners due to violation of data protection law.  The ruling not only has implications for commercial dealings in address data; it should also be taken into account in the context of corporate acquisitions.

Facts of the case

Plaintiff and defendant deal with address data. The plaintiff had acquired various web domains, as well as names, postal addresses and e-mail addresses – obtained via those web domains – from the defendant for € 15,000.00. After the defendant had also sold the same address data to a third party, the plaintiff claimed damages and injunctive relief; as a result of the defendant's second transaction and the use of the data by the third party, the latter allegedly lost two-thirds of its value, the plaintiff argued.

Ruling

Unlike the court of first instance, this was not followed by the Higher Regional Court of Frankfurt am Main. The plaintiff was unable to base their claim on the use of the address data by third parties in breach of contract as the purchase agreement concluded with the defendant was null and void.

Given that the personal data forming the subject matter of the claim does not constitute "aggregated data relating to members of a certain group of individuals" (Section 28(3) of the German Federal Data Protection Act, “Bundesdatenschutzgesetz” – BDSG), the use thereof for the purposes of dealings in address data is not covered by the statutory privilege, but requires consent of the data subjects concerned. The requirements with regard to such declarations of consent are strict: They must be freely issued by the data subjects, who must be informed of the intended purpose of the use of their data and the consequences of refusal of their consent; they must, as a general rule, be issued in writing and kept separately and distinct from the rest of the text of the agreement in question. The declarations of consent obtained in the case under consideration did not meet these requirements.

Practice notes

If personal customer data is transferred as an asset from one responsible party to another, the customer must in principle give his or her consent. This applies, in particular, to agreements governing corporate acquisitions by way of so-called asset deals, in which a company sells its individual assets. Personal data of customers or users regularly represent - if not even: the  - essential asset of the company to be acquired.

On the basis of the legal analysis conducted by the Higher Regional Court of Frankfurt am Main, a failure to obtain any or adequate declarations of consent (for example, to the implementation of marketing measures) will not "only" result in a finding in favor of the existence of a defect (of title); it may even result in the purchase agreement being deemed to be (partially) null and void. This exposes contractual parties to considerable economic risk.

With the entry into force of the General Data Protection Regulation (GDPR) on May 25, 2018, the risk is further increased: Pursuant to Art. 83(5)(a) of the GDPR, transactions for which the necessary declarations of consent have not been obtained may be subject to fines – which may be imposed on both the seller and the purchaser – of up to € 20 million or 4% of the total worldwide annual turnover generated by the undertaking in question in the previous financial year, whichever amount is higher.

The conduct of a due diligence process, also in terms of data protection law, is thus indispensable to check whether the data to be acquired had been collected and stored legally and whether it can be transferred to the buyer without the customer's prior consent.