Olswang Media Newsletter: latest legal developments in Germany and Europe - June 2014 edition

This article was produced by Olswang LLP, which joined with CMS on 1 May 2017.

• Netflix to launch in Germany, Austria, Switzerland, France, Belgium and Luxembourg
• German film production and distribution company Senator Entertainment restructuring after massive loss; CEO and chairman of the board Helge Sasse leaves
• German Federal Supreme Court decision: Screen scraping of Ryanair flight data no passing off
• CJEU establishes the "right to be forgotten" in Google Spain decision
• Open Internet Project launches new platform for more competitive digital markets
• Data protection authorities establish data protection requirements for Smart TVs / Hybrid TVs

Netflix to launch in Germany, Austria, Switzerland, France, Belgium and Luxembourg

On May 20, Internet VOD service Netflix announced via Twitter that it will launch in Germany and several other European countries "later this year". The additional markets will extend Netflix' reach into nearly 50 countries, including 13 in Europe. Netflix had entered Europe in 2012, when its Internet video service debuted in the U.K. and Ireland. It remains unclear which month the service will be available in the new markets, or how much it will cost. Netflix recently raised its Internet streaming prices by about $1 per month, now charging new customers $9 per month in the U.S. for unlimited video streaming. Netflix ended March with 35.7 million U.S. subscribers, and an additional 12.7 million customers in the rest of the world.

German film production and distribution company Senator Entertainment restructuring after massive loss; CEO and chairman of the board Helge Sasse leaves

After booking a net loss of € 27.4 million with revenues falling by 47 percent compared to the year before, according to Senator's revenue figures published on April 30, it was reported that the producer-distributor is overhauling its entire operation, looking for capital and cutting costs. On May 23, the company announced that Helge Sasse will be leaving at the end of June, after more than 8 years as the company's CEO. Reportedly, he is leaving at his own request to accept responsibility for the poor 2013 business year. Helge Sasse will also step down as chairman of the board on June 20. Markus Maximilian Sturm will then be interim sole chairman of the board.

German Federal Supreme Court decision: Screen scraping of Ryanair flight data no passing off

The German Federal Supreme Court has ruled on April 30 that the automated scraping of data from third party websites is generally admissible under German unfair competition law.

Airline Ryanair had sued against an online service offering booking of flights from various airlines. The service also shows and allows bookings of Ryanair flights, for which the data is retrieved via screen scraping from Ryanair's website. Ryanair has excluded such use of their website in their usage terms, and claimed the screen scraping was an abuse of their booking system amounting to unfair passing off. The Supreme Court dismissed Ryanair's claim and held that the screen scraping did not impede Ryanair as competitor under German unfair competition law. The Court balanced the interests of competitors, consumers and the general public, and held that the screen scraping of data against Ryanair's will and website terms of use was, by itself, not enough to establish an act of unfair competition.

The Supreme Court added that the result might be different if a website used a technical barrier against screen scraping that was breached. The lower court, to which the case was remanded, will now have to decide whether Ryanair might have a claim against the booking service for misleading of customers.

CJEU establishes the "right to be forgotten" in Google Spain decision

On May 13, in a judgment greeted with surprise from both the legal and the technology worlds, the Court of Justice of the European Union (CJEU) called into question the legality of search engines collating personal information and then facilitating respective searches.

The case arose from a complaint brought against Google Spain SL and Google Inc. to the Spanish data protection authority by a Spanish individual, Mr. González, who had been the subject of an auction notice for unpaid debts published in a widely-read newspaper in Spain. Despite the time that had elapsed since initial publication in the late 1990s, the notice still featured prominently in a Google search for Mr. González' name. González argued that this was in breach of the EU Data Protection Directive (the "DPD"), as the data was not current, and that in such circumstances, he should essentially have the "right to be forgotten". He requested the data to be erased from both the search engine and the digital version of the newspaper. The data protection authority rejected the complaint against the newspaper, taking the view that the information in question had been lawfully published, but agreed regarding the search engine, ordering Google to take the necessary measures to withdraw the data from its search results. In response, Google brought actions before the Spanish National High Court, which then referred questions on the interpretation of the DPD to the CJEU.

The CJEU ruled that an Internet search engine operator is responsible for the processing of personal data that it carries out and that appears on third-party web pages, i.e. the search engine is to be regarded as the "controller" in the sense of the DPD. Also, when the operator sets up a branch or subsidiary in a Member State to promote and sell advertising space directed at the inhabitants of that Member State, this branch or subsidiary qualifies as an "establishment" under the DPD. The operator of the search engine is then obliged under the DPD to remove web links resulting from searching a person's name (at least after it has been requested to do so) where the information collated is deemed harmful to the individual's privacy, regardless of whether the information on such web pages is published by third parties. The CJEU also commented as to how individuals could bring similar claims against search engines established in the EU, saying that firstly claims could be addressed directly to the EU-established search engine operator. If the search engine rejects the request to remove search results, it would then be open to the claimant to bring a private claim before their national courts under national data protection laws and/or complain to their local data protection authority.

The implications of the CJEU judgment are only beginning to be addressed. For more information, please see our detailed analysis of the judgment and its impact on Google, publishers and individuals, as well as on wider data debates.

Open Internet Project launches new platform for more competitive digital markets

On May 15, the Open Internet Project (OIP) launched an initiative for the protection of a competitive and open internet, in particular a neutral search. The OIP is a newly formed open platform that already connects more than 400 European digital actors. Its members and supporters have signed a Manifesto that calls upon the European Commission and national governments to effectively address all competition concerns relating to the search engine Google, and in particular to safeguard equal search, display and ranking criteria for all websites, including Google's own. The OIP website also offers an "Observatory" where affected companies can upload examples of a threat to the open internet, in particular cases of search manipulation. In the future, the OIP also wants to address issues of data protection and privacy relating to online platforms.

Data protection authorities establish data protection requirements for Smart TVs / Hybrid TVs

Darmstadt University of Applied Sciences recently examined data sent by TV devices using Hybrid Broadcast Broadband TV (HbbTV). HbbTV is a multimedia teletext feature provided by the broadcasters, and is serial in current models of Smart TV devices, enabling the viewer to see Internet content related to the program at the push of a button (provided the TV is connected to the Internet). However, the examiners found that HbbTV does not only inform the viewer, but also sends out data related to viewing habits to advertisers like Google Analytics, Chartbeat and Webtrekk, and uses cookies to track and save information of the viewers. It turned out to be sufficient to watch TV when connected to the Internet for the device to send out such data. Some devices were found to record and send minute-by-minute information on the programme being watched.

Now, the data protection authorities for the non-public sector and the data protection officers of the public service broadcasters have issued a joint position of May 2014, in which they establish data protection requirements for Smart TV devices:

1. TV programmes must be watchable anonymously, and viewer consent is required to record and track viewing habits;
2. Web or HbbTV services used via Smart TV devices are telemedia in the sense of German media law, and fall under the data protection requirements of the Act on Telemedia ("TMG");
3. Smart TV devices must have "privacy by default" settings when sold; and
4. Smart TV devices using HbbTV or other web services must be sufficiently secured via technical measures against third party access to their data traffic.

It will now be for the manufacturers to comply with these requirements in their Smart TV models.

This newsletter contains general legal information only and, although we endeavor to ensure that the content is accurate and up to date, users should seek appropriate legal advice before taking or refraining from taking any action. The contents of this newsletter should not be construed as legal advice and we disclaim any liability in relation to its use.