Germany Update: GDPR – The Period of Validity of Consents

Every day, companies of all kinds ask for (advertising) consent from their users and customers. In the meantime, it has become clear that newsletters, advertising e-mails and other electronic mail may only be sent on the basis of express consent. Nevertheless, the effective obtaining and use of such consents often poses major challenges for companies. In what ways may consent be requested and what does voluntary mean in this context? What content requirements must be met? Does consent have to be limited in time? What if there is no such time limit? Does the reverse conclusion then apply that once consent has been given, it is valid indefinitely?

Pursuant to Art. 4 No. 11 GDPR, consent is “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”. This definition is also used in unfair competition law. The data subject must be informed transparently and unequivocally about what and for what purpose he consents to the processing of his data. There is no need for a time limit.

No legal requirements for the period of validity

Neither the GDPR nor the law on unfair competition contain explicit requirements on the validity period of consent once given. The Federal Court of Justice (BGH) also ruled in 2018 that, in principle, consent once given does not necessarily expire due to the passage of time (BGH judgment of 1.2.2018 – III ZR 196/17). However, there may be additional circumstances that limit the period of validity of a declaration of consent once submitted. On the one hand, the specific wording of the declaration of consent and, on the other hand, the other accompanying circumstances are of decisive importance.

Accompanying circumstances are decisive

For example, consent can be limited to a specific topic or special offers. Likewise, the consent may contain a certain frequency of sending the advertising e-mails or a time limit. The advantage of such restrictions is that those affected can easily see what they are consenting to. However, this also means that the respective company is restricted in the use of the e-mail address provided. If, for example, a dispatch rhythm is specified, advertising e-mails may only be sent in this rhythm. If, on the other hand, advertising e-mails are sent more often than stated, this behavior is anti-competitive and can therefore be warned (KG Berlin, judgment of 22.11.2022 – 5 U 1043/20). Likewise, a company cannot easily assume that the person concerned agrees to receive advertising e-mails if the consent is linked to membership in a club/association and the membership has been terminated (AG München, judgment of 14.2.2023 – 161 C 12736/22). Conversely, if consent is formulated in very general terms, care must be taken to ensure that the facts covered by it are nevertheless concretely outlined. Data subjects must be able to identify what they are giving their consent to and for what purpose. Vaguely worded and far-reaching consents are quickly ineffective due to their lack of specificity.

For the effectiveness of a consent once given, it must also be taken into account whether advertising e-mails have been sent to the e-mail address provided by the person concerned in the past. For example, the Munich District Court has ruled that consent given loses its validity if four years have elapsed since registration for the newsletter and no newsletter has actually been sent during this time (Munich District Court, judgment of 14.2.2023 – 161 C 12736/22). The longer the period between the consent given and the first mailing, the more likely it is that the consent has lost its effectiveness.

Practical tip

The permissible obtaining and use of consent depends on its specific wording. Consent must be given voluntarily and it must be easy to understand and transparently identify what and for what purpose the data subjects consent. In particular, if the company has not sent any newsletters or other advertising e-mails for a longer period of time, it cannot be assumed without further ado that the consent obtained is still effective. The overall circumstances play a decisive role here.

By MELCHERS, Germany, a Transatlantic Law International Affiliated Firm.

For further information or for any assistance please contact germany@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.