Online marketing

The “Green Deal” – personally announced by Ms von der Leyen in 2019 – promised great things: climate neutrality by 2050, emissions trading and billions in financial support. Now, the “Empowering Consumers” Directive (EmpCo, 2024/825) marks another milestone in the fight against climate change. At least, that is how the Commission sees it. In addition to banning misleading green claims, the directive sets out comprehensive new information requirements for traders. These are to be transposed into national law by March 2026 and will apply from the end of September 2026. Specifically, for the purpose of informing consumers, this concerns information on statutory warranty rights and voluntary manufacturer guarantees.

In this episode, Brink and Härting discuss the Federal Ministry of Justice’s draft bill on strengthening civil and criminal law protection against digital violence. First, from minute 00:39, Dr Brink and Prof Härting explain what the legislature means by ‘digital violence’ and, from minute 02:52, begin by critically examining the criminal law section of the draft. To what extent is the draft compatible with the principle of the ‘ultima ratio’ in criminal law? Subsequently, from minute 16:11, Brink and Härting examine the question of whether the draft’s civil law proposals are compatible with the DSA (Digital Services Act). From minute 20:47, the focus is particularly on the judicial blocking of user accounts provided for in the draft. Finally, from minute 26:30, they discuss the draft’s provisions on claims for information against service providers and the associated orders to preserve evidence. Whilst these are compatible with the DSA, they should be rejected in the context of the introduced data retention measures. Is the draft to be endorsed from a civil rights perspective?

The latest podcast with Stefan Brink and Niko Härting focuses mainly on (non-German) fines. First, we discuss (01:34) the annual review of sanctions and regulatory measures for 2025 published by the French CNIL in February. In it, the authority reports that it imposed a total of 83 sanctions amounting to a total fine of €486.8 million. In total, the CNIL issued 259 decisions, including 143 orders to ensure data protection compliance and 31 notices regarding legal requirements. Wow. Niko and Stefan then (18:12) discuss a €3.5 million fine imposed by the CNIL for the disclosure of customer data to social media. In December 2025, the CNIL sanctioned the sports retailer Intersport for targeted advertising within its loyalty programme, which has around 10.5 million members in France alone. The discussion then turns (29:27) to a decision by the UK regulator, the ICO: the UK data protection authority has fined Reddit £14.47 million because the online platform unlawfully processed data from children under the age of 13 due to a lack of age verification. This is followed (36:46) by a decision from the Dutch data protection authority, which, in notices dated February 2026, imposed fines of €25,000 each on ten Dutch municipalities (including Delft and Eindhoven) because the municipalities had processed sensitive data on Muslim residents without the knowledge of those concerned. Finally (42:56), we look at a decision by the Spanish data protection authority, which imposed a fine of €500,000 on the football club FC Barcelona. The reasons for this included an inadequate data protection impact assessment in connection with the processing of biometric data to update the membership directory. A string of fines from which the German supervisory authorities could also take a leaf.

The latest podcast with Stefan Brink and Niko Härting focuses mainly on things that are a bit of a nuisance. First, we discuss (00:47) the vexing ruling by the Administrative Court of Karlsruhe (3rd Chamber) of 18 March 2026 (Case No. 3 K 2355/24), which dismissed the claim for access to documents from a technical consultation between the Federal Constitutional Court and judges of the European Court of Human Rights in June 2023. Although the issue concerned freedom of information, the Federal Constitutional Court did not wish to demonstrate transparency. The Administrative Court of Karlsruhe ruled that whilst this exchange between the courts did not constitute case law and was therefore subject to freedom of information, the protection of the confidentiality of exchanges between courts should take precedence over the required transparency of administrative action. This is difficult to comprehend. Next (18:29) is a late concession by the ‘House of History’ regarding the Schabowski note: the House of History did not wish to provide any details on the acquisition of the historic note regarding the opening of the Wall and sought to draw a veil of silence over who had received €25,000 for it. After the Cologne Administrative Court and the Higher Administrative Court of North Rhine-Westphalia had upheld a reporter’s claim, the museum decided against taking the case to the Federal Administrative Court and revealed what it would rather have kept secret: the (tax) money went to the circle of the shady GDR currency procurer, Schalck-Golodkowski. Really annoying. Incidentally, the legal costs are also borne by the taxpayer. Next (27:09) we look at a ruling by the ECJ (dated 19 March 2026 – C 526/24) on the right to information: in March 2023, a person residing in Austria subscribed to the newsletter of a family-run optician based in Arnsberg. In doing so, they entered their personal data into the registration form on the company’s website and consented to the processing of this data. Thirteen days later, the data subject submitted a request for access under Article 15 of the GDPR to the optician, who rejected the request as abusive. The data subject pursued his request for access and also asserted a claim for damages under Article 82 of the GDPR in the amount of €1,000. An vexatious case. Following a referral from the German Local Court, the ECJ has now clarified: Even an initial request for access to personal data under Article 15 of the GDPR, made by the data subject to the controller, may be regarded as ‘excessive’ within the meaning of Article 12(5) of the GDPR if the controller demonstrates that the request was not made to ascertain the processing of such data and to verify its lawfulness, but rather with an abusive intent. Finally (38:00), the focus is on a decision by the Dresden Administrative Court (5 November 2025, case number: 6 K 790/23), which once again concerns the documentation of a parking offence by means of a photograph. The Saxony Data Protection Supervisory Authority informed the photographer in a letter of its legal opinion that reporting via photograph was only permitted in cases of legitimate interest due to personal involvement (contrary to the Ansbach Administrative Court) and announced sanctions in the event of a repeat offence. The Dresden Administrative Court deemed the action brought against this to be inadmissible, ruling that the warning was not an administrative act and that actions for annulment and for performance were inadmissible. Furthermore, Article 78 of the GDPR grants a right of appeal against supervisory authorities only in the case of legally binding decisions. Annoying.

First, from the 1:53 mark, Prof. Niko Härting and Dr Stefan Brink discuss reforms to the Freedom of Information Acts (IFG) in the federal states. In Berlin, critical infrastructure is to be exempted from the Freedom of Information Act. There are now also moves in Schleswig-Holstein and Mecklenburg-Western Pomerania to restrict freedom of information. Not exactly a hit! The discussion then turns (from 11:19) to the Federal Court of Justice (BGH) ruling of 31 March 2026 – VI ZR 157/24. Schlager star Helene Fischer took legal action against a report by BILD. In its ruling, the BGH addressed the scope of liability for intermediaries regarding follow-up reporting on social media and the internet. What measures does the Federal Court of Justice consider reasonable for those liable for interference? Finally (28:01), Brink and Härting discuss a decision by the Higher Administrative Court of Koblenz dated 28 November 2025 – 10 A 11059/23.OVG. A patient’s health data was forwarded to a specialist. As a result, the patient concerned contacted the state data protection authority. The legal successor of the patient, who has since passed away, continued the complaint before the courts. Can the right to informational self-determination also protect the data of deceased persons under certain circumstances?

“The Basic Law does not prohibit hatred. The Basic Law does not prohibit contempt for others. Nor does the Basic Law require loyalty to the Constitution. The Basic Law also permits the rejection of the Constitution… Even those who disseminate statements that contravene the Basic Law can invoke freedom of expression.” In conversation with Prof. Niko Härting, Leipzig-based constitutional and media law expert Prof. Christoph Degenhart highlights the broad scope of protection afforded by freedom of expression and criticises efforts to increasingly restrict this freedom through new criminal provisions. From Degenhart’s perspective, it is not only the offence of “insulting a politician” (Section 188 of the German Criminal Code) that is cause for concern. Degenhart also expresses incomprehension regarding the Federal Minister of Justice’s efforts to combat “deepfakes”, “AI pornography” and indecent photographs by expanding and creating new criminal offences relating to speech. “Chilling effects” are invariably associated with expanded criminal provisions and can lead to citizens becoming increasingly reluctant to express their opinions in public. The broad concept of freedom of expression, which the Federal Constitutional Court (BVerfG) emphasises in its established case law, is easily forgotten in the process. Degenhart is critical not only of the planned changes to criminal law. He also calls for a sense of proportion regarding new powers proposed in criminal procedure and police law to enable the widespread use of biometric procedures. As a result, innocent bystanders could find themselves under the scrutiny of the police and the public prosecutor’s office at any time.

In episode 54 of our sports law podcast “Liebling Bosman”, we examine the trademark dispute surrounding darts player Justin Hood and his nickname “Happy Feet”. We also discuss the CAS proceedings in the case of Senegal v the African Football Confederation (CAF) in connection with the decision to award Morocco the Africa Cup of Nations title by default, and assess the liability issues surrounding Noa Lang’s injury in the match between Galatasaray and Liverpool. Finally, we take a look at the latest developments regarding stadium bans in Germany and provide an update on the regional league reform.

In episode 42 of the Data Navigator podcast, we speak to Dominik Ebeling (Head of Data Governance, Rolls-Royce Power Systems) about whether and how trade secrets might be embedded in IoT sensor data – and what this means in terms of the requirements under the Data Act. Specifically, we cover: - striking the right balance between data access and innovation protection, - the fridge example: how a product’s control logic can be deduced from a temperature-time series, - reverse engineering via data versus via hardware: why the effort involved is a crucial protective factor, - a practical categorisation of sensor data into four levels – from environmental variables to the protected core of innovation. - figures: at least two-thirds of sensor data is completely uncritical for disclosure – says the engine manufacturer and - the Omnibus, the Federal Network Agency and the call not to abandon the compromise between data sharing and the protection of trade secrets.

The Cologne Data Protection Law Conference, organised by Dr. Otto Schmidt Publishers, will take place on 18 and 19 June 2026. The event will focus on current developments relating to the GDPR, the AI Regulation, the Data Act, the Digital Omnibus Directive, class actions and digital sovereignty.