Bundling of consent backed by Frankfurt court

The Higher Regional Court of Frankfurt also said that businesses can make entry into the competitions they run dependent on consumers giving their consent to the processing of their data for marketing purposes. That practice is consistent with the requirements of consent set out in the General Data Protection Regulation (GDPR), the court said.

The case before the Frankfurt court concerned an assessment of the consents obtained to marketing calls. The consents were collected in the course of a sweepstake. The possibility to participate in the sweepstake was dependant on the consent of the participants to advertising.

The organiser of the sweepstake collected consents for eight other businesses. It listed the names of the eight companies that would process the data and described the areas of business that those advertisers were involved in.

The court considered in particular whether one of the eight companies, an electricity provider, was entitled to advertise to the sweepstake entrants based on the consent they had given when entering the sweepstake.

The electricity company lost the case because it was not able to prove that consent had been obtained, but the ruling provided an insight into how the court views the standard of consent contained in the GDPR.

Consent is one of six lawful bases for processing personal data under the GDPR. To be valid, consent must, in general, be freely given, specific and informed, and also be an unambiguous indication of the data subject's wishes that is stipulated by a statement or by a clear affirmative action.

According to the court, participation in a sweepstake made dependent on consent to future advertising is compliant with the GDPR because "the consumer can and must decide for himself whether the participation is worth the disclosure of his data".

The court also considered what information needs to be disclosed to consumers about the businesses that might process their data for those businesses to be able to rely on their consent to that processing.

If there are so many companies listed on a consent statement that it would not be realistic for the consumer to understand them all and the areas of business they operate then there would be lack of the required clarity for consent to be valid, it said. However, it said there was sufficient clarity in this case where eight businesses were listed in the consent statement.

The court also gave examples of how detailed the descriptions of the type of businesses that the consents are to apply to must be. It said it is not sufficient to use general references like 'financial services of all kinds' or 'marketing and advertising', but it said 'electricity and gas' is sufficiently specific.

Consents to advertising by one company will remain valid in cases where other consents obtained through the same declaration are invalidated on the basis of unclear descriptions of their businesses, it said.

The Frankfurt court also said that businesses relying on consent to process personal data must be able to prove they have obtained consent to the standards required for that consent to be valid.

In this case the court considered this in requirement in the context of the 'double opt in' practice, which is where consumers that consent to the processing of their data are asked to confirm that consent a second time.

After considering case law established by Germany's Federal Court of Justice, the Frankfurt court said that an electronic double opt in declaration does not offer sufficient proof that consent has been obtained to marketing calls. It said advertisers must prove that the consumers' telephone number is assigned to the e-mail address to which the confirmation was sent.

Christina Kirichenko of Pinsent Masons, the law firm behind Out-Law, said: "The decision will be welcomed by companies investigating advertising opportunities. The decision indicates the possibility of collecting consents tied to participation in a sweepstake for a manageable number of co-sponsors at one time. In addition, the decision highlights the requirements that companies have to document consents. The companies that engage lead generators should consider and clearly define the processes for documenting collected consents and include the corresponding stipulations into relevant agreements."

Kirichenko said that the Frankfurt ruling is not binding on many other courts in Germany, and that it was therefore unclear whether other courts would rule the same way in similar cases. She also pointed out that the case concerned a civil claim made under German laws on unfair competition and that it is the administrative courts in Germany that are tasked with handling appeals against decisions issued by data protection authorities in the country.

"The data protection authorities and administrative courts may well have another opinion, so businesses should adopt a cautious approach and seek specialist advice," Kirichenko said.