Privacy & Data Protection
Client Alert | 1 min read | 09.30.09
Other sections of this issue:
Privacy & Data Protection | ISP-Liability & Media Law | Contracts & E-Commerce |
Electronic Communications & IT
On 19 August 2009, the German discounter Lidl has again been condemned to a 36.000 EUR fine by the German Data Protection Authority for unlawful processing of personal data of its personnel.
A year after the scandal where Lidl was found to have been spying on its employees via surveillance cameras, documents were found in a dumpster indicating that Lidl was unlawfully collecting information about its employees' medical conditions.
Such personal data is sensitive and can only be processed under strict conditions, which were clearly absent here. The personal data collected were moreover also supplemented with comments such as 'operated from tumor, but benign' or 'wants to be pregnant, but fertility issues'.
Lidl admitted to having collected the records but alleged this was only with the purpose of relocating its employees to more fitting positions. This position was, however, not accepted and Lidl was condemned by the German Data Protection Authority to pay a 36.000 EUR fine for violating general principles of German privacy law..
Although this fine is significantly lower than the 1,5 million EUR Lidl had to pay last year, it is a clear indication that Data Protection Authorities more and more actively act against privacy law violations. Also, the fine remained rather low, because the violations were only proven with respect to 4 German branches of Lidl, while the suspicion existed that more branches did collect sensitive personal data in an unlawful manner.
On 14 August 2009, the German federal legislator changed Germany's Privacy Act, now including specific provisions for employer-employee relationships, giving the German Data Protection Authority clearer yardsticks in similar situations in the future.
References: Bundesdatenschutzgesetz (BDSG) in der Fassung der Bekanntmachung vom 14. Januar 2003 (BGBl. I S. 66), zuletzt geändert durch Artikel 15 Abs. 53 des Gesetzes vom 5. Februar 2009 (BGBl. I S. 160)
Links: https://www.ldi.nrw.de/
Contacts
Insights
Client Alert | 5 min read | 08.21.26
FTC Proposes Enforcement Policy Statement on Personalized Pricing: What Businesses Need to Know
On August 19, 2026, the Federal Trade Commission (FTC) announced a proposed Enforcement Policy Statement on personalized pricing — the practice of companies using consumers’ personal data to set individualized prices, discounts, coupons, or other incentives. The proposed statement, which is open for public comment for 30 days following publication in the Federal Register, marks a major step up in the FTC’s focus on data-driven pricing strategies and puts businesses across industries on notice that undisclosed or inadequately disclosed personalized pricing will not be tolerated. Importantly, while the proposed statement is not a binding legal requirement and does not create new legal obligations, it serves as an enforcement warning that the FTC is prepared to use its existing enforcement authority under Section 5 of the FTC Act (Section 5) and is also a potential harbinger of rulemaking. Businesses that engage in — or are considering — personalized pricing should carefully assess their disclosure practices and data collection procedures against the standards articulated in this statement.
Client Alert | 7 min read | 08.19.26
CMS’s Final Rule Bans Federal Medicaid Funding for Youth Gender-Affirming Care
Client Alert | 2 min read | 08.19.26
