In April, 2013 EDRi–member Digitale Gesellschaft (Digiges) therefore sent a letter of complaint to the European Commission in order to draw their attention to the misuse of warning letters, in contravention of the safeguards contained in the European legislation. Digiges pointed out that in Germany, IPRED had led to a situation which allowed rightsholders to acquire personal data of the users directly from the providers. All they needed for that was the IP–address of an alleged infringer and an application to a court that would order the provider to hand over the requested information. While this option was originally meant to facilitate the realisation of damages and injunctive relief, the whole process in fact became more and more automated over time. The requests from rightsholders usually comprised between 15 and 3 500 IP–addresses at a time. In one single case in October 2009, the number even reached a breathtaking 11 000. Given the fact that the court proceedings in these cases are always summary or expedited ones, it becomes clear that there is hardly any chance for a judge to thoroughly check the validity and accuracy of the “evidence” presented by the rightsholder.
Digiges argued in their letter that the situation created by the German implementation of IPRED violates EU law, in particular Article 8 IPRED (Right of information) as well as Articles 8 (Protection of personal data) and 52 (Scope of guaranteed rights) of the Charter of Fundamental Rights of the European Union.
According to Article 8 IPRED, judicial authorities may order information to be provided only upon a justified and proportionate request of the claimant. Clearly, a request that covers thousands of IP–addresses at a time hardly qualifies as “proportionate”. And from the perspective of a judge, it's more or less impossible to determine whether a request that comprises so many IP–addresses is “justified” in each single case, especially when a decision on the entire batch is due within two or three days.
The same is broadly true for Article 52 of the Charter of Fundamental Rights which rules that limitations on any fundamental right (such as the Protection of personal data) are always subject to the principle of proportionality.
In response to Digiges' letter the Commission invited them to a personal talk in Brussels in October 2013 which gave them the chance to present their complaint in a more comprehensive way. The meeting was followed by an extensive email communication with further enquiries and discussions, .
Then finally in mid December 2014, more than one and a half years after the initial letter was sent, the Commission decided to take the first step towards an infringement procedure against Germany. The Commission officially prompted the German government to comment on the German situation around warning letters within ten weeks.
On receiving the statement from the German government, the Commission will evaluate the reasoning and decide on further measures to be taken. These could result in Germany actually changing its laws in order to make them comply with the provisions of IPRED and the Charter of Fundamental Rights.
On the other hand, the Commission might also come to the conclusion that the legal situation in Germany does not violate EU law, in which case the proceedings will be discontinued. If however, the Commission and the German government do not reach a mutual consent, the Commission can take the case to the Court of Justice of the European Union (CJEU) and launch an actual infringement procedure, which in turn might result in Germany being ordered to change their legal provisions or being fined for breaking EU laws.
A lot of water will have passed under the bridge by then, though. The German government is expected to delay their answer to the Commission as long as possible. Once it has arrived, the Commission will have 10 weeks to evaluate the government's reply. An ensuing judicial infringement procedure might take up to two years and will be repeated if the member state in question fails to comply with the ruling of the court. So for now, it is still unclear if and when Germany will change its laws facilitating the abuse of warning letters. But an important step towards the first infringement procedure with a net–political twist has been taken.
Links
"The end of bulk cease–and–desist letters?" – Alexander Sander talks about the infringement procedure against Germany (only in German, 07.01.2015) https://www.youtube.com/watch?v=tRGvTxFbBpQ
Digiges' letter of complaint to the EU Commission (only in German, 04.04.2013) https://digitalegesellschaft.de/wp–content/uploads/2013/04/anschreiben_eu_ kommission.pdf (Contribution by Volker Tripp, EDRi–member Digiges, Germany)