Clubhouse app faces court action in Germany over serious failings under data protection and consumer law

No “imprint”

In e-commerce, the obligation to publish an Impressum – a form of legal notice – under Section 5 of the German Telemedia Act (Telemediengesetz, TMG) is designed first and foremost to protect consumers. It is essential that they are informed about a service provider. Only with this information can they check whether the provider is trustworthy and assert any contractual or tort claims – but also their right to information under data protection law.

Platform terms and privacy notice in English language only

Although the company’s platform is also geared towards the German market, its terms of service are only available in English, which is a violation of German and European consumer protection law.

Note: in a lawsuit filed by the vzbv against WhatsApp back in 2016, the Berlin Kammergericht ruled that a company that only makes its T&Cs available to German users in English is acting “in a non-transparent manner that disadvantages all consumers in a breach of good faith”. Foreign-language T&Cs do not apply to German-speaking users.

Serious violations of data protection law

It is not yet clear exactly which violations are alleged in this case. Even so, an examination of the app reveals a lack of appropriate data protection notices, which would be required under the GDPR and the TMG. In addition, the fact that the app requires users to upload their address books has attracted public criticism, as has the claim that Clubhouse could use the contact information obtained in this way for advertising purposes.

Note: courts already banned social media platforms from requiring users to upload their address books years ago, as this was deemed a violation of consumer protection rules. It was also following a complaint by the vzbv that the German Federal Supreme Court (Bundesgerichtshof, BGH) ruled against Facebook’s Friend Finder tool back in 2016.

Summary

If the company does not undertake to cease and desist from the business practices complained of and, in particular, does not issue a cease-and-desist declaration with a penalty clause, the vzbv will take legal action against it. In addition, the severe data protection violations mean that the company not only risks lawsuits from consumer protection groups, but also sanctions from data protection authorities under the GDPR.