OLG Stuttgart - 2 U 257/19

OLG Stuttgart - 2 U 257/19
Court:	OLG Stuttgart (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 13 GDPR § 3 UWG (national law against unfair competition)
Decided:	27.02.2020
Published:
Parties:	Trade association Professional internet seller
National Case Number/Name:	2 U 257/19
European Case Law Identifier:
Appeal from:
Appeal to:
Original Language(s):	German
Original Source:	Oberlandesgericht Stuttgart (in German)
Initial Contributor:	n/a

The Higher Regional Court of Stuttgart points out that the absence of information of Article 13 GDPR constitutes an unfair trade-based action as understood by § 3 of the national law against unfair competition (UWG).

English Summary

Facts

The defendant had offered tires for instant purchase on the website eBay where he had not provided potential buyers with information about the processing of their personal data in case of a purchase according to Article 13 GDPR.

Therefore, the plaintiff, as representative trade-association of those potential buyers, lodged a complaint with the competent jurisdiction, demanding that the defendant be summoned to provide the missing information since the sell was otherwise to be considered inadmissible.

Dispute

Is the absence of information, such as required by Article 13 GDPR, to be considered as an unfair trade-base action, making the offer inadmissible in accordance with § 3 UWG (national law against unfair competition)?

Holding

After admitting the right of action of the plaintiff as representative association of consumers’ rights, the Court points out that the absence of information of Article 13 GDPR constitutes a violation of the law and, as such, an unfair trade-base action as understood by § 3 of the national law against unfair competition (UWG). As long as the defendant does not provide the missing information, the offer is therefore to be considered as inadmissible.

Comment

Share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the German original for more details.

DECISION
Guiding Principles

1 Section 13 (1) sentence 1 TMG is superseded by the provisions of the basic data protection regulation.



2 Article 80 DPA does not contain a conclusive provision on the legal enforcement of violations of the Basic Data Protection Regulation. Pursuant to Article 8 (3) no. 2 UWG in conjunction with § Article 8 (1) and Article 3a UWG authorise competition associations to assert such violations of the provisions of the Basic Data Protection Regulation which are market conduct regulations.



3. the information obligations under Article 13 (1) (a), (c) and (2) (b), (d) and (e) DSGVO constitute market conduct regulations

Tenor

I.

In response to the plaintiff's appeal, the judgment of the Stuttgart Regional Court of 20 May 2019 - Case No. 35 O 68/18 KfH - is amended as follows, with the rejection of the further appeal:

    1) The defendant is ordered to refrain from doing so, while avoiding a fine of up to 250,000.00 euros to be determined by the court in each case of the infringement, or alternatively to refrain from being held in custody for up to six months,

    in the course of trade with the consumer in respect of motor vehicle accessories

    to maintain a website/homepage itself or through third parties, on which personal data is collected for business purposes, without a data protection declaration in accordance with Article 13 Paragraphs 1 and 2 of the EU Data Protection Regulation (DSGVO 2016/679) of 27 April 2016,

    each as reproduced below:

    <follows the illustration of an offer on eBay>

    2. dismisses the remainder of the action

II.

Sets aside the costs of the proceedings at both instances.

III.

The judgment shall be provisionally enforceable.

The judgment debtor may avert enforcement under No. I.1 of the decision formula (omission) by providing security or a deposit in the amount of EUR 2,000.00 unless the judgment creditor provides security in the same amount prior to enforcement. Otherwise, the judgment debtor may avert enforcement by providing security or a deposit in the amount of 110% of the amount enforceable on the basis of the judgment unless the judgment creditor provides security in the amount of 110% of the respective amount to be enforced prior to enforcement.

IV.

The appeal is allowed to the extent of the defendant's conviction.

Amount in dispute in both courts:

20,000.00 Euro (main and auxiliary petition each 10,000.00 Euro)

Reasons
 	
A
1 
	
The plaintiff, a trade association, demands that the defendant refrain from providing an offer on the Internet without specific information on data protection.
2 
	
In view of the facts of the case, reference is made to the findings in the regional court ruling.
3 
	
In summary: On 16 July 2018, the defendant offered tyres for immediate purchase as a commercial trader on the internet trading platform eBay. In addition to his company, he provided his postal address, telephone number, fax number and e-mail address. He did not make a statement on data protection. The warning of the plaintiff issued by these Greens remained unsuccessful.
4 
	
The Regional Court dismissed the action. § Section 13 of the German Telemedia Act, on which the main claim is based, no longer has any scope. The auxiliary request based on the Basic Regulation on data protection was also unfounded. Article 80 (2) DSGVO expresses the view that the European legislature intends to permit arbitrary prosecution of infringements by third parties only if the conditions set out in the standard are fulfilled and the national legislature has regulated this. The German legislature had not made use of the authorisation in Article 80(2) DSGVO. On the basis of the final provision of the Basic Data Protection Regulation, the plaintiff was also not entitled to injunctive relief under the UKlaG.
5 
	
This is the subject of the applicant's appeal. § Section 13 TMG continues to apply. The provision serves to implement Directive 2002/58/EC, which has a different scope of application than the Basic Data Protection Regulation. In the alternative, the claim arises from the Basic Regulation on data protection, which does not contain a complete system of sanctions.
6 
	
The applicant claims that the Court should
7 
	
amend the judgment of the Landgericht Stuttgart (Case No 35 O 68/18 KfH) delivered on 20 May 2019 and order the defendant to refrain from imposing a fine of up to EUR 250,000.00, or alternatively to refrain from imposing administrative detention or regulatory detention for up to six months, to be determined by the court in each case of infringement
8 
	
in the course of trade with the consumer in respect of motor vehicle accessories
9 
	
to maintain a website/homepage themselves or through third parties, on which users can enter personal data for the purpose of establishing contact or communication or for other business purposes, without informing the consumer at the beginning of the usage process in a generally understandable form in accordance with § 13 TMG about the type, scope and purpose of the collection and use of personal data and, if applicable, about the processing of their data in states outside the scope of Directive 95/46/EC of the European Parliament and the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,
10 
	
in each case as reproduced in the figure printed in point I.1 of the decision formula.
11 
	
In the alternative, the applicant claims that the Court should
12 
	
as recognized.
13 
	
The defendant claims that the Court should
14 
	
dismissal of the appeal
15 
	
The defendant defends the regional court's judgment. The claims are also statute-barred, as the plaintiff had based his claims for the first time in the first instance on the violation of the basic data protection regulation in a written statement dated March 11, 2019. Furthermore, the defendant raises the objection that the claims are being asserted in abuse of rights.
16 
	
Reference is made to the pleadings exchanged and to the minutes of the oral proceedings for the further presentation of the parties.
B
I.
17 
	
The appeal is admissible. In particular, the appeal was lodged within the time limit and reasons were given.
II.
18 
	
The regional court ruling has been formally effective. The missing signature of the judge does not prevent this.
19 
	
If a judgment is pronounced in a separate hearing in accordance with § 310 (2) ZPO, this formal public announcement of the court decision, recorded in the minutes (§ 160 (3) no. 7 ZPO), is sufficient to make it appear - if necessary without a signature - as a final, binding sovereign statement. Accordingly, the judgment pronounced without a signature is also effective (Federal Court of Justice, judgment of 23 October 1997 - IX ZR 249/96, juris marginal no. 12; Federal Court of Justice, order of 6 December 1988 - VI ZB 27/88, juris marginal no. 4), although it may be set aside on the grounds of a lack of grounds for the judgment (Federal Court of Justice, judgment of 27 January 1977 - IX ZR 147/72, juris marginal no. 5). However, the requirements for a referral back under § 538.2 sentence 1 no. 1 of the Code of Civil Procedure are not met, if only because it has not been requested by either party and, moreover, because no extensive or costly taking of evidence is required.
C
20 
	
The action is admissible in respect of the principal claim.
1.
21 
	
The main claim is not too vague within the meaning of Paragraph 253(2) of the ZPO.
a)
22 
	
An application for a prohibition may not be worded so vaguely that the defendant cannot defend himself exhaustively and, if the application were granted in the decision proceedings, the decision on what is prohibited for the defendant would be left to the enforcement court (Federal Court of Justice, judgment of 11 October 1990 - I ZR 35/89, juris para. 18 - Undetermined application for an injunction). For this reason, in particular applications for injunctive relief that merely repeat the wording of a law are in principle to be regarded as too vague and thus inadmissible (BGH, judgment of 16 November 2006 - I ZR 191/03, juris para. 16 - Telephone advertising for individual contracts; BGH, judgment of 13 March 2003 - I ZR 143/00, juris para. 19 - Heir's Investigator).
23 
	
However, the application for an injunction is usually sufficiently specified if the plaintiff merely seeks a prohibition of the act as it was committed (BGH, judgment of 16 July 2009 - I ZR 56/07, juris para. 10 - Betriebsbeobachtung; BGH, judgment of 26 October 2000 - I ZR 180/98, juris para. 16 - TCM-Zentrum).
24 
	
If the defendant is prohibited from advertising again in the form complained of, it cannot be doubtful for him how he has to behave in future (OLG Stuttgart, judgement of 5 July 2018 - 2 U 167/17, juris marg. no. 11 - Grabmale). In future, he must refrain from any advertising consisting of the entire advertisement (BGH, judgment of 26 October 2000 - I ZR 180/98, juris marginal no. 16 - TCM Centre). In contrast to versions of the application which use the concrete form of infringement - for example, introduced by the words "in particular how" - only as an example, the direct reference to the concrete advertisement with the comparative particle "how" usually makes it clear that the object of the application is solely the concrete advertisement, whereby the abstractly formulated features may have the function of defining more precisely the circle of variants which are to be covered by the prohibition as essentially identical forms of infringement (BGH, judgment of 2 October 2000 - I ZR 180/98, juris para. 16 - TCM-Zentrum). June 2005 - I ZR 252/02, juris para. 14 - Capitalisation Costs II; BGH, judgment of 29 April 2010 - I ZR 202/07, juris para. 36 - Reminder advertising on the Internet). In such a case, the advertisement in its entirety constitutes the object of the dispute and the plaintiff, if the action is successful, leaves it to the court to determine on which aspect the injunction is based (BGH, judgment of 13 September 2012 - I ZR 230/11, juris para. 24 - Biomineral water).
25 
	
Nor are the claims to the determination of the claim higher because the plaintiff - which is possible for him (BGH, loc. cit., para. 25) - attacks the concrete form of infringement under different legal aspects by way of a cumulative accumulation of actions. In this respect, the abstract part of the motion is to be taken into account when determining the objective of the action. It follows from this that the plaintiff bases the main claim on an infringement of Section 13 German Telemedia Act.
2.
26 
	
The plaintiff is entitled to bring an action. Under Paragraph 8(3)(2) of the UWG, the claims arising from Paragraph 8(1) of the UWG may be brought by associations with legal capacity which promote commercial or independent professional interests, provided that they include a significant number of undertakings which market goods or services of the same or related types on the same market, provided that they are actually able, in particular in terms of their staff, material and financial resources, to perform their statutory tasks of pursuing commercial or independent professional interests and provided that the infringement affects the interests of their members.
27 
	
This provision concerns both the procedural standing and the substantive-legal entitlement to bring an action and, as such, must be examined ex officio at any time (BGH, judgment of 1 March 2007 - I ZR 51/04, juris marginal no. 12 - hospital advertising; BGH, judgment of 18 May 2006 - I ZR 116/03, juris marginal no. 14 - spectacle advertising).
28 
	
The Regional Court found that, in addition to the necessary equipment, the plaintiff in particular includes a significant number of traders who sell goods of the same or a related type on the same market. The defendant has not challenged these findings in its statement of appeal. Nor are there any other doubts as to the correctness of the findings.
3.
29 
	
Furthermore, there are also no sufficient indications of an abusive conduct by the plaintiff. An abuse within the meaning of § 8 para. 4 UWG is to be assumed if the dominant motive in asserting the claim for injunctive relief is irrelevant interests and objectives that are not in themselves worthy of protection and these appear to be the actual driving force and the dominant motive for initiating proceedings. The assumption of such an abuse of rights requires a careful examination and weighing of the relevant individual circumstances (Federal Court of Justice, judgment of 4 July 2019 - I ZR 149/18, juris marginal no. 33 - environmental assistance; Federal Court of Justice, judgment of 5 October 2000 - I ZR 224/98, juris marginal no. 20 - class action against multiple admonishers).
30 
	
In the present case, however, no abuse of rights can be established. The mere fact that a competition association does not also take action against one of its members for the same competition violation does not provide sufficient evidence for the assumption that the dominant motive is irrelevant (OLG Stuttgart, judgment of 12 December 2019 - 2 U 23/19). In principle, an association that is entitled to bring an action under Section 8 (3) no. 2 UWG is not prevented from taking legal action only against certain infringers. The decision in this regard is left to its own discretion, just as it is up to the individual trader to decide whether and against which competitors it wishes to bring an action. An unacceptable disadvantage of the (solely) attacked infringer compared to others - for example, because he alone must now refrain from the attacked actions - is not to be seen in this, because the infringer is in principle free to take action against similar acts of infringement by his competitors not attacked by the association (BGH, judgement of 17 January 2006). August 2011 - I ZR 148/10, juris para. 19 - Glücksspielverband; BGH, judgment of 17 September 1998 - I ZR 117/96, juris para. 27 - bonus miles; BGH, judgment of 12 December 1996 - I ZR 7/94, juris para. 18 - lifting cream). Even in the case of comparable infringements, it cannot in principle be regarded as an abuse of rights if an association that wishes to have the question of the anti-competitive nature of a certain conduct clarified by the highest court first takes legal action against a third party and not against its own member (BGH, judgment of 23 January 1997 - I ZR 29/94, juris nr. 34 - product advertising).
31 
	
There is no sufficient evidence that, in exceptional cases, extraneous reasons predominate. This would be the case, for example, if the association's selective approach is aimed exclusively at non-members in order to recruit new members to whom it promises protection from persecution after accession (BGH, ruling of 17 August 2011 - I ZR 148/10, juris para. 23 - Glücksspielverband). It remains to be seen whether the "systematic toleration of unfair competition" could also be regarded as an irrelevant consideration (BGH, judgment of 23 January 1997 - I ZR 29/94, juris para. 34; questioning OLG Hamburg, judgment of 11 August 2011 - 3 U 145/09 juris para. 69). No reasonable grounds for this were presented.
II.
32 
	
However, the main claim is unfounded.
1.
33 
	
Since the plaintiff has separately attacked the concrete form of infringement in the main and auxiliary claim under different aspects in each case, the contested notification must be examined under the respective aspect asserted (BGH, judgment of 13 September 2012 - I ZR 230/11, juris para. 25 - Biomineral Water). Due to the explicit reference of the main application to Section 13 German Telemedia Act, the existence of a first-time infringement is to be measured exclusively against this standard, whose paragraph 1 sentence 1 is also taken up in the wording of the application.
2.
34 
	
However, the plaintiff is not entitled to injunctive relief under Sec. 8 (1) UWG in conjunction with §§ Sections 3, 3a UWG and Section 13 (1) sentence 1 TMG. The Regional Court rightly stated that Section 13 TMG in the present constellation is superseded by the provisions of the Basic Data Protection Regulation, which were already applicable at the time of the first violation on July 16, 2018.
35 
	
According to Section 13 (1) sentence 1 TMG, the service provider must inform the user at the beginning of the usage process about the type, scope and purposes of the collection and use of personal data and about the processing of his data at a location outside the European Union in a generally understandable form, unless such information has already been provided.
36 
	
This legal regulation is superseded by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data (Basic Data Protection Regulation, DSGVO). In accordance with Article 95 of the DPA, this Regulation does not impose any additional obligations on natural or legal persons with regard to processing in connection with the provision of publicly available electronic communications services in public communications networks in the Union where they are subject to specific obligations laid down in Directive 2002/58/EC (Directive on privacy and electronic communications) that pursue the same objective.
37 
	
Thus, national provisions transposing Directive 2002/58/EC continue to prevail. However, the provision in question here in Section 13 (1) TMG does not transpose Directive 2002/58/EC, but Article 10 of the Data Protection Directive 95/46/EC (Jandt/Schaar/Schulz in Beck'scher Kommentar zum Recht der Telemediendienste, 2013, Section 13 TMG, marginal no. 13). After the Data Protection Directive was repealed on 25 May 2018 pursuant to Article 94 (1) DSGVO, the Basic Data Protection Regulation now has priority in application (cf. Auer-Reinsdorff/Conrad, Handbuch IT- und Datenschutzrecht, 3rd ed. 2019, Section 36 marginal no. 20).
38 
	
The basic data protection regulation claims direct applicability pursuant to Article 288(2) TFEU and supersedes national law in the event of a conflict (cf. 2 BvE 2/08, juris nr. 335 - Lisbon Treaty; BVerfG, decision of 6 July 2010 - 2 BvR 2661/06, juris nr. 53 - Mangold; BVerfG, decision of 19 July 2011 - 1 BvR 1916/09, juris nr. 81). It is irrelevant here whether and to what extent the provision in § 13.1 sentence 1 of the German Telemedia Act is compatible with the Basic Data Protection Regulation. The Member States are prohibited from enacting (even concurrent) provisions which obscure the scope of application of the Regulation and thus call into question the European Court of Justice's power of interpretation of Union law (ECJ, judgment of 10 October 1973, C-34/73, marginal 11; see in this respect Sydow, European Data Protection Basic Regulation, introduction, marginal 39). The service provider's information obligations relating to data protection are therefore governed solely by the Basic Data Protection Regulation, not by Section 13 (1) of the German Telemedia Act (Hullen/Roggenkamp in: Plath, DSGVO/BDSG, 3rd ed. 2018, Section 13 of the German Telemedia Act, marginal no. 3).
C
39 
	
The applicant's alternative claim is successful.
I.
40 
	
The action is also admissible as regards the alternative claim for the reasons set out above. In particular, the plaintiff is entitled to pursue claims for injunctive relief under Sec. 8 (3) No. 2 UWG arising from violations of the Basic Data Protection Regulation.
41 
	
The data protection basic regulation does not conclusively regulate the legal remedies, so that the national provisions of Section 8 (1) and (3) no. 2 in conjunction with § Section 3a UWG remain applicable in the event of a violation of a market conduct regulation (see also OLG Hamburg, judgment of 25 October 2018 - 3 U 66/17, juris marg. no. 56 m. with legal effect, Janßen, jurisPR-ITR 25/2018 note 2; Wolff, ZD 2018, 248; Laoutoumai/Hoppe, K&R 2018, 533; Schreiber, GRUR-Prax 2018, 371).
1.
42 
	
Provisions of an EU regulation are not conclusive in themselves. The act of a regulation has general application, is binding in its entirety and directly applicable in all Member States (Article 288(2) TFEU). If the regulation does not expressly provide for the adoption of more far-reaching national regulations, member states may apply national standards even if these do not frustrate the direct applicability of the regulation, do not conceal its Community nature and specify the exercise of the discretion conferred by the regulation in question within the limits of these regulations (ECJ, judgment of 14 October 2004 - C-113/02, para. 16). In doing so, it must be examined, with reference to the relevant provisions of the regulation, whether these provisions, interpreted in the light of their objectives, prohibit, require or permit the Member States to apply certain national standards and, in the latter case in particular, whether they fall within the scope of the discretion granted to each Member State (ECJ, judgment of 21 December 2011 - C-316/10, para. 43).
2.
43 
	
In interpreting the Regulation as to whether it allows Member States to apply certain national standards of law enforcement, the relevant interest of each standard-setting body is to ensure that the provisions adopted by it are complied with by all addressees. This fundamental interest is also the basis for the obligation of the Member States to implement Union law effectively, as laid down in Article 4(3) TEU and Article 197(1) TFEU. In general, this presupposes an effective system of monitoring and prosecution. The more closely meshed this network is, the more the will of the legislator is enforced.
44 
	
The interests in this area may be different from those in the harmonisation of substantive law. There, the purpose may be to set not only minimum but also maximum requirements. It facilitates the cross-border movement of goods and services if the entrepreneur does not have to prepare himself for even higher requirements being imposed on him abroad than in the Member State in which he is domiciled. It is assumed in the literature that parts of the Basic Data Protection Regulation fully harmonise substantive law (instead of all of them: Franzen in Franzen/Gallner/Oetker, Kommentar zum Europäischen Arbeitsrecht, 3rd ed. 2020, Art. 88 DSGVO marginal no. 7 ff). However, this recital does not yet allow any conclusions to be drawn that this should also apply to law enforcement.
3.
45 
	
Under the European Union's general system of competences, the Member States are already obliged to protect the rights conferred by a regulation, in particular through the national courts (ECJ, judgment of 10 October 1973 - 34/73, para. 8). The basic data protection regulation also follows this general division by establishing the competence of national courts to hear actions (Articles 78(3), 79(2), 82(6) DPA) and, in addition, by obliging the Member States to set up supervisory authorities (Article 51(1) DPA). The Regulation merely stipulates that individuals must be granted access to legal protection by means of a right of action or a right of appeal to the supervisory authority. It follows from this that the detailed design of law enforcement is the responsibility of the Member States.
4.
46 
	
If it can therefore be assumed that the legislature claims effective enforcement of the rights conferred by it and, as in the present case, gives the Member States the power to organise procedural law, any national measure which is likely to facilitate enforcement must, in principle, be regarded as permissible. Anything else can only be assumed if it is clear from the Regulation itself with sufficient clarity that more far-reaching national measures that facilitate enforcement are to be inadmissible.
47 
	
However, it does not follow from the basic regulation on data protection - and certainly not with the clarity required for this purpose - that Member States should be denied to grant legal standing to competition associations.
a)
48 
	
The regulation does not in any way restrict the enforcement of rights by civil law. It is true that the supervisory authorities have an important role to play in enforcing the basic data protection regulation. However, the Regulation does not restrict the enforcement of private rights by civil law. Rather, measures taken by the supervisory authority, which can impose sanctions, and the enforcement of claims for damages under private law are independent of each other and have equal priority.
aa)
49 
	
By establishing the supervisory authorities, the legislator wanted to improve the legal status of Union citizens. Every data subject has the right to complain to a supervisory authority if he or she considers that the processing of personal data relating to him or her infringes this Regulation (Article 77(1) DPA). The supervisory authorities are empowered, inter alia, to warn, admonish, impose certain measures on and sanctions against data subjects (Article 58(2)(a), (b), (g), (i) and Article 83 DPA).
bb)
50 
	
It was not intended to restrict existing powers of law enforcement. Rather, the basic data protection regulation was clearly intended to provide only a minimum standard for the legal protection of the data subject and of the person who has suffered damage as a result of violations of the regulation.
51 
	
The data subject's right of appeal (Article 4 No. 1 DPA) is "without prejudice to any other administrative or judicial remedy" (Article 77 (1) DPA). The Regulation places the individual judicial assertion of claims - for example, before a civil court - on an equal footing with official enforcement of rights. Irrespective of the right to appeal to a competent supervisory authority, Article 79 paragraph 1 DPA grants every data subject a legal remedy against controllers or processors if he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data not in conformity with this Regulation (cf. Mundil in Beck'scher Onlinekommentar Datenschutzrecht, 30 Ed. 1.2.2017, Art. 79 DPA, marginal no. 14). In addition, Article 82 (1) and (6) DSGVO grants any person who has suffered material or non-material damage as a result of a breach of the Regulation a legally enforceable claim for damages against the person responsible or against the processor.
cc)
52 
	
In particular, Article 80 of the DSGVO does not contain any conclusive provision for private law enforcement. The view cannot be accepted that a contrary conclusion to Article 80 (2) DSGVO would mean that competitors and competition associations do not have the right to bring an action. Article 80(2) DSGVO was to be regarded as an opening clause, which only empowers the Member States to grant legal standing to so-called data protection associations, but not also to competitors and competition associations within the meaning of Paragraph 8(3)(2) of the UWG (Köhler, WRP 2018, 1269 marginal no. 35; et seq, WRP 2019, 1279 marginal note 5; Köhler/Bornkamm/Feddersen, Kommentar zum UWG, 38th edition 2020, § 3a UWG marginal note 1.40f; Barth, WRP 2018, 790 marginal note 16; Baumgartner/Sitte, ZD 2018, 555 [558]; Schmitt, WRP 2019, 27 marginal note. 20; Spittka, GRUR-Prax 2019, 4; differentiating Uebele, GRUR 2019, 694 [697], who grants competitors the right to sue, but not their associations).
(1)
53 
	
Article 80 paragraph 1 of the DPA grants the data subject the right also to instruct third parties to exercise their rights vis-à-vis the supervisory authority, the controller or the processor. However, this should be a non-profit-making institution, organisation or association duly constituted under the law of a Member State, whose statutory objectives are in the public interest and which operates in the field of the protection of the rights and freedoms of data subjects with regard to the protection of their personal data. Furthermore, Member States may provide that such institutions, organisations or associations shall have the right to exercise the aforementioned rights of individuals, independently of any mandate from the data subject in that Member State (Article 80(2) DPA). As an association for the promotion of commercial or self-employed professional interests, the plaintiff does not fulfil the requirements of Article 80 (1) DSGVO.
(2)
54 
	
However, the course of the discussions in the Council working party does not indicate that Article 80(2) of the DSGVO is exhaustive.
55 
	
The scheme is based on a proposal by the French delegation, which introduced the idea that respect for data protection rights by associations is an effective way of enforcing them. The initiative was intended to oblige the Member States to adopt effective procedural rules (Council document 7586/1/15 REV 1, p. 22/23). The Presidency took up this proposal as a new Article 76(2) of the draft, but without providing for an obligation to implement it (Council document 7722/15, p. 16). During the discussions, the question of whether the Member States should be obliged to grant legal standing was discussed, which was supported not only by the French delegation but also by the European Commission (Council document 8371/15, p. 15, footnote 36). The delegations found a compromise with the version adopted (Council document 8383/15, p. 18 footnote 34).
56 
	
However, the materials do not give rise to any comments from delegations that considered the reference to paragraph 1 necessary to exclude the possibility of granting legal standing to other associations that did not meet the requirements of a data protection association. The European Commission supported the reference to the definition of an association in paragraph 1. However, it is not clear from the materials that its aim was to exclude further legal standing. Rather, it wanted to ensure that a recognised data protection association could also pursue rights in another Member State. The European Commission saw this as the real added value of the regulation (Council document 8371/15, page 15 footnote 38).
57 
	
As this statement and other comments show, the delegations considered that the regulation of standing was a matter for the Member States. The Portuguese delegation pointed out that the powers of other associations should not be excluded (Council document 8371/15 footnote 37). The French delegation, having been unable to achieve its objective of a mandatory regulation, noted that there was no need for a regulation if it did not contain an obligation (Council document 8383/15 p. 18, footnote 36).
58 
	
However, the fact that the delegations, in the process of decision-making, have found as the lowest common denominator a rule that only expresses what is generally recognised - namely that Member States may grant legal standing to data protection associations - does not mean that other generally recognised powers of Member States - the granting of even more extensive legal standing - should be limited. There is no indication in Council documents that such an arrangement should be made.
dd)
59 
	
Neither can it be inferred from recitals 11 and 13 that the sanctions and enforcement are finally regulated in the basic data protection regulation (Köhler, WRP 2018, 1269 para. 24; Ohly, GRUR 2019, 686 [688]).
60 
	
Admittedly, it talks about the need for the Member States to have the same powers to monitor and ensure compliance with the rules on the protection of personal data and the same or equivalent sanctions in the event of their infringement. However, sanctions in this sense are to be understood as the measures to be taken by the supervisory authorities (Article 58(2) DSGVO), in particular the fines to be imposed (Article 58(2)(i) DSGVO), for which Article 83 DSGVO contains a detailed regulation on the amount and the assessment criteria. However, the prosecution of claims by private individuals under civil law does not constitute a sanction in this sense. As the title to Chapter VIII shows, the Regulation distinguishes between remedies, liability and sanctions (applicable Uebele, GRUR 2019, 694 [698]).
5.
61 
	
The associations' right of action under Section 8(3)(2) of the Act against Unfair Competition (UWG) is in line with the evaluation framework of the Basic Regulation on data protection.
62 
	
The prosecution of competition violations by competitors and competition associations has proven to be a powerful instrument (draft of the Federal Government for a law against unfair competition, Bundestag Printed Matter 15/1487, p. 22). It is true that Article 52(4) DSGVO requires the Member States to provide the supervisory authorities with the necessary resources to enable them to perform their tasks effectively. However, since all resources are limited and each authority must set priorities and priorities, competitors and competition associations can also make a substantial contribution to the monitoring of data protection rules. In this way, the right of action to which they are entitled serves the effective enforcement of the regulation, which is in the interests of the legislator and is thus within the scope of the discretion granted to the individual Member States. Since Article 77 et seq. DSGVO that further-reaching legal remedies remain unaffected, nothing else applies to the power of associations (Laoutoumai/Hoppe, K&R 2018, 533 [535]).
II.
63 
	
The action is also well founded. The right to injunctive relief follows from § 8 (1) UWG in conjunction with §§ Sections 3, 3a UWG and Article 13 DSGVO.
1.
64 
	
Anyone who undertakes a business act which is impermissible under Section 3 of the Unfair Competition Act may, in accordance with Section 8(1), first sentence, of the Unfair Competition Act, be sued for an injunction if there is a risk of repetition. Under Section 3a of the Unfair Competition Act (UWG), any person who contravenes a statutory provision which is also intended to regulate market conduct in the interest of market participants commits a business act which is impermissible within the meaning of Section 3(1) of the Unfair Competition Act if the contravention is likely to have a significant adverse effect on the interests of consumers, other market participants or competitors.
65 
	
The application of Section 3a UWG is not blocked by the fully harmonising UCP Directive, as the latter itself provides that Community legislation governing specific aspects of unfair commercial practices shall prevail and be determinative (Article 3(4) UCP Directive). The Directives mentioned in Recital 10 of the UCP Directive are not exhaustive (Micklitz/Namysłowska in Münchener Kommentar zum UWG, 3rd ed. 2020, Art. 3 UCP Directive para. 35). Data protection provisions may also regulate specific aspects of unfair commercial practices, as the last sentence of Recital 14 to the UCP Directive shows. It depends on the provisions in the individual case which regulation specifically regulates a particular aspect of unfair commercial practices. Article 13 of the DPA is decisive for the data protection information obligations. It is therefore not necessary to resort to Section 5a (2) and (4) UWG. This provision, in implementation of Article 7 of the UCP Directive, regulates the unfairness of the withholding of material information necessary for an informed business decision by the consumer.
2.
66 
	
By placing an advertisement on the Internet trading platform, the defendant infringed Article 13 of the DSGVO.
a)
67 
	
This is a commercial act within the meaning of Article 3(1) of the UWG. Any conduct of a person for the benefit of his own enterprise or for the benefit of another enterprise before, during or after the conclusion of a business transaction which is objectively connected with the promotion of the sale or purchase of goods or services or with the conclusion or performance of a contract for goods or services is deemed to be such an act. This is the case for an advertisement with the possibility of contacting and ordering.
68 
	
The defendant also acted on behalf of his company. According to the legal definition of § 14 paragraph 1 BGB, an entrepreneur is a person who, when concluding a legal transaction, acts in the exercise of his commercial or self-employed professional activity. A commercial activity requires an independent and planned offering of paid services on the market for a certain period of time (BGH, judgement of 4 December 2008 - I ZR 3/06, juris marg. no. 33 - Ohrclips). These prerequisites are indisputably present after the defendant presents himself on the trading platform as a commercial seller.
b)
69 
	
If personal data is collected from the data subject, the data controller must provide information for the collection of the data. In part, the information duties depend on whether certain circumstances are present (Article 13 paragraph 1 lit. a (2nd alternative), lit. b, d, e, f, Article 13 paragraph 2 lit. c, f and Article 13 paragraph 3). Since nothing has been submitted as to the existence of such circumstances, it can only be stated that the defendant had to inform the purchasers and interested parties of the following circumstances before receiving personal data from them:
70 
	
(1) the name and contact details of the person responsible (Article 13 (1) lit. a DSGVO)
71 
	
(2) the purposes for which the personal data are to be processed and the legal basis for the processing (Article 13(1)(c) DPA)
72 
	
(3) the duration for which personal data are stored or, if this is not possible, the criteria for determining this duration (Article 13 paragraph 2 lit. a FADP);
73 
	
(4) the existence of a right of access by the controller to the personal data concerned and the right to rectify or erase or to limit the processing or a right to object to the processing and the right to transfer the data (Article 13 paragraph 2 letter b DPA);
74 
	
(5) the existence of a right of appeal to a supervisory authority (Article 13 (2) lit. d DSGVO) and
75 
	
(6) whether the provision of the personal data is required by law or by contract or necessary for the conclusion of a contract, whether the data subject is obliged to provide the personal data and what the possible consequences would be if the data were not provided (Article 13(2)(e) DPA).
76 
	
It is undisputed that the defendant did not provide this information. He is to be regarded as a responsible person within the meaning of Article 4 No. 7 of the DSGVO, since he collects data from buyers and prospective buyers who contact him and decides on the purposes and means of the personal data thus collected. The information to be provided was also not known to the buyers or prospective buyers in any other way (Article 13 paragraph 3 DSGVO).
c)
77 
	
The above-mentioned provisions of the basic data protection regulation are market conduct regulations within the meaning of Section 3a of the UWG.
aa)
78 
	
In some cases, however, the provisions of the basic data protection regulation are denied any reference to the market as a whole (Köhler, WRP 2018, 1269 marginal no. 22; on expired law: Munich Higher Regional Court, judgement of 12 January 2012 - 29 U 3926/11, juris marginal no. 29). This is countered by the argument that, according to recital 9, third sentence, the Regulation also has a competition law objective (Wolff, ZD 2018, 248).
79 
	
It is represented that data protection regulations generally serve the protection of personal rights and that they only have a competitive relationship insofar as the permissibility of the collection, processing or use of data is concerned, for example for the purposes of advertising, opinion research, the creation of user profiles, address trading or other commercial purposes (Schaffert in: Münchener Kommentar zum Lauterheitsrecht, 3rd ed. 2020, § 3a UWG marginal no. 81; Schreiber, GRUR-Prax 2019, 4; following this approach: OLG Frankfurt, judgment of 13 December 2000 - 13 U 204/98, juris marginal no. 37; on the DSGVO: OLG Saxony-Anhalt, judgment of 7 November 2019 - 9 U 39/18, marginal 57; Barth, WRP 2018, 790 marginal 26; Baumgartner/Sitte, ZD 2018, 555 [557]; on the use of personal data without consent: OLG Cologne, judgment of 19 November 2010 - I-6 U 73/10, juris para. 13). In this sense, the Senate has already ruled that the specific standard must be examined for its market relevance (OLG Stuttgart, judgment of 22 February 2007 - 2 U 132/06, juris para. 27). Data protection law with its multi-faceted ramifications does not pursue a single protective purpose alone. It is therefore not possible to take a generalising view (Schmitt, WRP 2019, 27 marginal no. 12).
bb)
80 
	
Any activity on a market which objectively serves to promote the sale or purchase of goods or services and by which an entrepreneur influences competitors, consumers or other market participants is to be regarded as market conduct within the meaning of Section 3a of the Act against Unfair Competition (OLG Stuttgart, judgment of 8 June 2017 - 2 U 127/16, juris nr. 28 - Extra portion of vitamin C). A standard regulates market conduct in the interest of competitors, consumers or other market participants if it has a competitive connection in the form that it protects the competitive interests of persons who are potential suppliers or purchasers of goods or services (BGH, judgment of 8 October 2015 - I ZR 225/13, juris para. 21 - Egg cell donation). A provision that serves to protect the rights, legal interests or other interests of market participants is a market conduct regulation if the protected interest is affected precisely by market participation, i.e. by the conclusion of exchange contracts and the subsequent consumption or use of the acquired goods or services (BGH, judgment of 27 April 2017 - I ZR 215/15, juris nr. 20 - obligation to keep records). A specifically competition-related protective function in the sense that the provision specifically protects market participants against the risk of unfair influence on their market conduct is not required (BGH, judgment of 4 November 2010 - I ZR 139/09, juris nr. 34). However, the provision must at least also aim to protect the competitive interests of the market participants (BGH, judgment of 28 November 2019 - I ZR 23/19, juris para. 24 - Obligations of the battery manufacturer).
cc)
81 
	
According to these standards, according to which not only the interests of competitors but of all market participants are to be included, a market reference exists with regard to all information obligations.
(1)
82 
	
Knowledge of the name and contact details of the person responsible (Article 13(1)(a) DSGVO) has a consumer-protection function and has the necessary competitive relevance. It facilitates communication with the company (for provider identification in the case of telemedia services: BGH, judgment of 20 July 2006 - I ZR 228/03, juris para. 15). In this sense, the information on the rights against the responsible party referred to in Article 13 Paragraph 2 lit. b DSGVO as well as the reference to the right of appeal to the supervisory authority (Article 13 Paragraph 2 lit. d DSGVO) can also be regarded as consumer protection with market relevance.
(2)
83 
	
Information on the purposes for which the personal data are to be processed, the legal basis for the processing (Article 13(1)(c) DPA), whether the provision of the data is required by law or contract or necessary for the conclusion of a contract, whether the data subject is obliged to provide the personal data and the possible consequences of not providing the data (Article 13(2)(e) DPA) is also of a competitive nature. Finally, the obligation to provide information on the duration for which personal data is stored or, if this is not possible, the criteria for determining this duration (Article 13 paragraph 2 letter a FADP).
84 
	
A standard serves the interests of consumers and other market participants if it protects their interest in information and their freedom of decision and conduct with regard to market participation (Köhler in: Köhler/Bornkamm/Feddersen/Köhler, loc. cit.) This is the case here. The business contact as such already affects data protection interests of the interested party and creates corresponding obligations of the entrepreneur.
85 
	
The decision of the interested party to initiate the contract is a business decision. The term "business decision" covers not only the decision to purchase or not to purchase a product, but also directly related decisions such as contacting the supplier (BGH, decision of 28 April 2016 - I ZR 23/15, juris marg. no. 34 - Geo-Targeting). The decision to contact the provider via means of distance communication is thus inseparably linked to the transmission of personal data (in this sense also OLG Hamburg, judgment of 27 June 2013 - 3 U 26/12, juris nr. 58 on Section 13 TMG). The information to be provided thus also serves the consumer's decision to contact the company at all and to transmit data in this connection.
86 
	
For the consumer, the purpose for which the data are to be processed and how long they are to be stored may also be important for the initiation of the transaction. The more far-reaching the declaration of purpose and the longer the data is stored, the more likely it is that the entrepreneur will process the data unwanted by the consumer or even that the data will be misused by third parties. Especially in cases of free or low-cost consideration, consumers certainly recognise that the processing of their data is part of the business model. The information to be provided for data collection is therefore information that enables the consumer to make an informed decision on the initiation of the business.
87 
	
The fact that the data protection concerns affected by the business contact cannot be considered separately from this is also shown by the fact that Article 13 DPA does not (only) serve the purpose of providing the consumer with the necessary information to give effective consent "in an informed manner" (Article 4 No. 11 DPA) (Article 7 (1) DPA). Rather, the consumer must also be informed about the purposes of data processing and its legal basis even if his consent is not required because the mere fact that data processing is necessary for the performance of the contract or for the implementation of pre-contractual measures justifies its lawfulness (see Article 6.1 sentence 1 lit. b DPA).
3.
88 
	
The infringement is also likely to have an appreciable adverse effect on the interests of consumers, other market participants or competitors. Perceptibility is to be affirmed if an impairment of the protected interests can occur not only theoretically but also actually with a certain probability (OLG Stuttgart, judgement of 05 July 2018 - 2 U 167/17, juris marginal no. 31).
a)
89 
	
Where the infringement of a market conduct rule consists in the withholding of material information from the consumer, this infringement is only appreciable within the meaning of Paragraph 3a of the UWG if, depending on the circumstances, the consumer needs the material information withheld from him in order to make an informed decision and the withholding of such information is likely to lead the consumer to take a transactional decision which he would not otherwise have taken (BGH, judgment of 31 October 2018 - I ZR 73/17, juris nr. 31 - Jogging trousers).
90 
	
However, the entrepreneur who claims that the consumer - contrary to the rule - does not need essential information withheld from him in order to make a purchase decision and that the withholding of this information cannot induce the consumer to make a different purchase decision, has a secondary burden of proof in this respect (BGH, ruling of 2 March 2017 - I ZR 41/16, juris para. 32 - Complete Kitchens). The consumer will generally require essential information to make an informed business decision. Likewise, unless there are special circumstances in the specific case, it must be assumed that withholding essential information that the consumer needs according to the circumstances in order to make an informed decision is likely to induce the consumer to make a business decision that he would not have made if he had been given the necessary information (BGH, judgment of 7 March 2019 - I ZR 184/17, juris marginal no. 27 - energy efficiency class III).
b)
91 
	
For the reasons why the information obligations under Article 13 of the DSGVO are to be classified as market conduct regulations, an infringement against them must regularly be regarded as appreciable. Nor has the defendant made any submissions on this matter which would cast doubt on the fact that, contrary to the rule, the consumer would not need the information to be provided in order to make an informed decision to contact him via the Internet portal for initiating business.
5.
92 
	
The claim is also not time-barred.
93 
	
The action served before the expiry of the limitation period on 19.10.2018 was initially aimed at having the specific form of infringement prohibited under the aspect that a website was operated without a data protection declaration. Since this legal aspect had to be examined both in accordance with Section 13 of the German Telemedia Act and Article 13 of the DSGVO, the subsequent division into two subjects of dispute does not harm the claim. It is irrelevant that the requirements for the content of the information to be provided on data collection differ in part. In this respect, the plaintiff objected to the complete omission of the declaration; this covers the assessment under both provisions. The suspension of the statute of limitations according to § 204 (1) No. 1 BGB thus also covers both legal aspects.
E
94 
	
The decision on costs follows from Paragraph 92(1) of the ZPO. The decision on provisional enforceability is based on § 708 no. 10, §§ 711, 709 sentence 2 ZPO.
95 
	
The appeal must be allowed without restriction in favour of the defendant. The legal dispute raises questions of fundamental importance. Both the question of whether business associations have the right to bring an action and the question of whether Article 13 DSGVO is a market conduct regulation are the subject of lively debate in the literature.