Newsletter
Atsumi & Sakai
ATSUMI & SAKAITOKYO | LONDON | FRANKFURT
www.aplaw.jp▶

Newsletter from our FRANKFURT AFFILIATE OFFICE (Tokyo - Frankfurt):
Atsumi Sakai Janssen Rechtsanwalts- und Steuerberatungsgesellschaft mbH
Atsumi & Sakai is a multi-award-winning, independent Tokyo law firm with offices in London and Frankfurt.
Through our local presence, we respond to various cultures and mindsets in those regions. Furthermore, our local
presence facilitates building cooperative relationships with local law firms.
We continue to meet the diverse needs of our clients from both a legal and tax perspective, which is essential forbusiness development in Europe.

More legal risks for online tracking in the EU| Page 1/3 |November 2020 No.FRT_005

1. Understanding online tracking
Don’ t be surprised, companies are tracking your cyber footprints.
Many businesses are relying on online tracking as a tool to understandtheir online customers’ behaviours and preferences, improve browsing
experience, generate statistics, tailor their products to customers’expectations, profile them, and facilitate direct marketing. Various
online tracking tools are being widely used such as:
●

●

●

●

●

Internet Protocol (IP) address that reveals the users’ rough location;
HTTP referrers that tell the webpage address where the users
were previously;
Cookies that save the users’ log-in data for a certain period,
including browsing history (this is the most common and well-known
online tracking tool);
Tracking Pixels that can track web traffic, site conversions, user
behaviour and more (e.g. if a webpage is clicked on or an email isopened);
User agents that can identify the browsers and operating systems
being used;
Browser fingerprinting that can let websites know e.g. the users’
operating system, screen resolution, installed fonts, time zone,
language, and other information without the users’ explicit permission.[1]Online tracking tools can derive an extensive amount of personal
data from Internet users and have a certain impact on their privacy
rights. However, they are quite well hidden from the Internet users.
It is often rather vague to Internet users by whom, when, and how
they are being tracked and for what purpose their data is being
collected and used. For that, the use of online tracking tools mustbe regulated by law.

2. Obtaining users’ consent before tracking them online
In the EU, the use of cookies, as the most common form of online
tracking, is governed under the General Data Protection Regulation(GDPR)[2] and the ePrivacy Directive.[3] Accordingly, a cookie tracker
must comply with the following requirements when using cookies
to track its users online.

●

●

●

●
●

●

Explaining to users in plain language about the data to be tracked
by cookies, its purpose of tracking, the cookie providers, types,
functions and storage duration;
Obtaining users’ consent before using any cookies regardlessof whether personal data are processed using the cookies ornot, except those that are strictly necessary for the website
to function such as cookies used for shopping cart, login status,
language selection, consent storage;
Storing users’ consent;
Allowing regular use of the website even when users refuse togive consent (i.e. the website should be functionable even without
the unconsented cookies);
Making it easy for users to withdraw their given consent.

In the consent request, it is not admissible to havea pre-ticked box for users to give their consent.
Instead, the users must be allowed to actively tick the box to opt-in
to agree with the use of cookies.
For a long time, it was controversial whether such an opt-in consent
requirement for using cookies is applicable under German law or not.
It can be argued that this requirement has never been transposed fromthe ePrivacy Directive into German law. Although a consent requirement
can be found in the German Telemedia Act (TMG), this Act does not
actually deal with the use of cookies. However, finally, in May 2020,
the German Federal Court (BGH) has confirmed in its case between
the Federation of German Consumer Organizations and Planet49 GmbH,
that the opt-in consent requirement also applies in Germany.[4] Exceptions
are given to pure content websites, smaller web stores or websitesthat only use technical cookies. These websites may continue to informtheir users about the cookies being used without taking any further
action for obtaining consent.

ATSUMI & SAKAITOKYO | LONDON | FRANKFURT
www.aplaw.jp| Page 2/3 |November 2020 No.FRT_005

3. More attention drawn on online trackers
Despite the explicit rules and guidance from courts and data protection
authorities (DPA), not all cookie trackers are strictly complying withthem.
From August to December 2019, the Irish Data Protection Commission(Irish DPC) ran a “sweep” survey, sending a questionnaire to 40
organizations across various sectors to examine their use of cookies
or other similar online tracking tools on their websites. The survey’ s
result reveals some common non-compliances of organizations regarding
their cookie usages, for example:
●
●
●
●
●
●
●

Use of unnecessary cookies when users first land on the websites;
Pre-ticked boxes in consent requests;
Implied consent;
Bundled consent for all purposes;
Misclassification of cookies as necessary;
Poorly designed cookie banners, insufficient explanation regarding
the use of cookies;
Difficulty in changing cookie settings.

It is likely that these are non-compliant issues of many other organizations
out there, not only the 40 selected ones in the survey.These issues
have caught the attention of not only data protection authorities butalso data protection activists. The number of complaints on the useof cookies and other tracking technologies filed to supervisory authorities
has increased rapidly over the lasttwo years. For example, the UK’ s
Information Commissioner’ s Office alone received from April 2019
to March 2020, 1473 cases relating to cookies, four times more than
the number of complaints received from April 2018 to March 2019.[5]In receiving these complaints, DPAs are obliged under GDPR totake action. The DPA will first ask the organization under concern
to answer a questionnaire to examine its actual use of cookies
and confirm whether the complaint is correct. If the organization
does not respond to such a request, the DPA can require the processeddata to be handed over.
Once the DPA could confirm that the organization does not comply
with data protection rules for using cookies, it can impose a fine,which might be higher in case of non-cooperation. However, a highfine is not the only risk that non-compliant online trackers may haveto face.

4. Non-material damages
As to private enforcement by means of damages claims, Article 82(1)GDPR provides that “any person who has suffered material or
non-material damage as a result of an infringement of this Regulation
shall have the right to receive compensation from the controller orprocessor for the damage suffered” .
A large data protection activist in Austria – has recently successfully
claimed a non-material damages amount of 500 Euro for a dataprotection violation at the Vienna Regional Court. However, thedecision is not legally binding, and the plaintiff is still fighting for aneven higher compensation for the breach.

In a similar case, the Düsseldorf Labour Court recently awarded
the plaintiff an amount of 5,000 Euro as non-material damages forwhat he has suffered due to an alleged data protection breach. Thisdecision is not legally binding either, and an appeal is pending before
the Düsseldorf Labour Court as the plaintiff would like actually toclaim damages of more than 140,000 Euro.
It can be more serious for online trackers, as claims for non-material
damages can be claimed in mass actions. A data protection violationin online tracking can have similar impact on a large number of different
users. For that, it is not a problem for the plaintiffs to together filethe violating organization in one case and for the court to bundle
up the lawsuits. The amount of damages will then be way larger thanin lawsuits with individual plaintiffs. Therefore, it is better to avoid
any online tracking violation, especially at the moment when thecourts’ opinion regarding non-material damages is still unclear.

5. Getting prepared for investigations and lawsuits
Mistakes might take place in the most unexpected situation. So,
besides making sure to comply with all the afore-mentioned rules
for using cookies, organizations should also get themselves readyin case a complaint comes up one day. Following are some ofour suggestions to reduce the risks and be prepared for any
complaint or investigation from the DPA:
●
●

●
●

Reviewing data flows and processes regularly when using cookies;
Being ready for any necessary technical changes of the website
or other data processing activities;
Having all information, which is normally requested by the DPAs,
in place for fast reaction;
Defining in advance a defence strategy (What risks does thecompany accept regarding e.g. fines and claims for damages?
Is the company prepared to challenge its legal position beforecourt?).

On top of these general suggestions, ASJ is always ready and happy
to give our clients advice tailored to their specific situations, supportingthem in reviewing their data processing activities, preparing documents
required for GDPR-compliance, as well as reacting in case of breaches,complaints, or DPA’ s investigations. For further inquiries, do contact
our team.

--[1] Koofr Blog, What is online tracking and how do websites track you?, https://koofr.eu/blog/
posts/what-is-online-tracking-and-how-do-websites-track-you[2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and on the freemovement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)[3] Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009amending Directive 2002/22/EC on universal service and users’ rights relating to electronic
communications networks and services, Directive 2002/58/EC concerning the processing of
personal data and the protection of privacy in the electronic communications sector andRegulation (EC) No 2006/2004 on cooperation between national authorities responsible forthe enforcement of consumer protection laws
[4] Bundesgerichtshof zur Einwilligung in telefonische Werbung und Cookie Speicherung: https://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=pm&Datum=2020&nr=106314&pos=1&anz=68[5] ICO, Action we’ ve taken: Cookies: https://ico.org.uk/action-weve-taken/cookies/ , retrieved
07/09/2020

ATSUMI & SAKAITOKYO | LONDON | FRANKFURT
www.aplaw.jp| Page 3/3 |November 2020 No.FRT_005

Author(s) / Contacts
Tokyo Head Office(Atsumi & Sakai)Frankfurt Affiliate Office(Atsumi Sakai Janssen Rechtsanwalts- und Steuerberatungsgesellschaft mbH*)* A legal and tax advisory professional corporation registered in Germany

Fumiaki Matsuoka

Frank Becker

Admitted in Japan (2006)

Admitted in the Federal Republic of Germany**** Not Registered as a Foreign Lawyer and not practicing law in Japan

E: fumiaki.matsuoka@aplaw.jp> View Profile

E: frank.becker@asj-law.jp> View Profile

Contact
Europe Practice Team (Atsumi & Sakai)
E: info_frankfurt@aplaw.jp

Information in this newsletter does not constitute/contain legal advice. Although we try to provide quality information, all information in this newsletter is provided "as is", with noguarantee of completeness, accuracy, timeliness or of the results obtained from the use of this information, and without warranty of any kind, express or implied, including, but notlimited to warranties of performance, merchantability and fitness for a particular purpose.

Tokyo Office: Fukoku Seimei Bldg. (16F), 2-2-2 Uchisaiwaicho, Chiyoda-ku, Tokyo 100-0011, JapanLondon Office: 4th Floor, 50 Mark Lane, London, EC3R 7QR, United Kingdom
Frankfurt Affiliate Office: OpernTurm (13 F), Bockenheimer Landstraße 2–4, 60306 Frankfurt am Main,Germany

General enquiries: info@aplaw.jp
Website: www.aplaw.jp/en

LEGAL NOTICES
1. About Atsumi & Sakai
Atsumi & Sakai is a group of Atsumi & Sakai Legal Professional Corporation, a corporation organized under the Attorney Act of Japan, which forms
foreign law joint ventures under the Act on Special Measures Concerning the Handling of Legal Services by Foreign Lawyers with certain registeredforeign lawyers at our firm, and lawyers of a Japanese Civil Code partnership (represented by Yutaka Sakai, a lawyer admitted in Japan). We also form
a foreign law joint venture with Markus Janssen, a foreign lawyer registered in Japan to advise on the law of the Federal Republic of Germany, heading
Janssen Foreign Law Office. In addition to lawyers admitted in Japan (including Japanese lawyers also admitted in England and Wales and the Republicof the Marshall Islands), our firm includes foreign lawyers registered in Japan to advise on the laws of the US States of New York and California, thePeople’ s Republic of China, Taiwan, India, and the State of Queensland, Australia. Foreign lawyers registered in Japan to advise on state laws are also
qualified to advise on federal laws of their respective countries.
Atsumi & Sakai Legal Professional Corporation also wholly-owns a subsidiary, Atsumi & Sakai Europe Limited (a company incorporated in England andWales (No: 09389892); sole director Naoki Kanehisa, a lawyer admitted in Japan), as its London Office. It also has an affiliate office in Frankfurt, Atsumi
Sakai Janssen Rechtsanwalts- und Steuerberatungsgesellschaft mbH, a German legal and tax advisory professional corporation (local managing director:Frank Becker, a lawyer admitted in the Federal Republic of Germany).
2. Legal Advice
Unless stated otherwise by A&S, any legal advice given by A&S is given under the supervision and authority of (i) in respect of Japanese law or any
laws other than foreign laws on which our foreign lawyers are registered in Japan to advise, a specified lawyer admitted in Japan at A&S, or (ii) inrespect of any foreign law on which our foreign lawyer is registered in Japan to advise, such registered foreign lawyer.
© Atsumi & Sakai 2020