Consumer Data Protection In Brazil, China And Germany: A Comparative Study

229 Pages·2016·1.936 MB·English

by  Rainer Metz, Jörg Binding, Pan Haifeng, Florian Huber (editors)

German Federal Ministry of Justice and Consumer
The rapid development of new information and communication technologies Protection
has changed people’s everyday life and consumption patterns signifi cant-
State Administration for Industry and Commerce of the
ly. The worldwide spread of those technologies provides many innovations for
People´s Republic of China
consumers, but it can also bear risks, such as the indiscriminate collection,
National Consumer Secretariat, Ministry of Justice of the
storage and cross-border fl ow of personal data, illegal spying on Internet ac-
Federal Republic of Brazil
tivities, dissemination of personal information, and abuse of user passwords.
Deutsche Gesellschaft für Internationale Zusammenarbeit
The study deals with the current state of consumer data protection law in Brazil,
(GIZ) GmbH (eds.)
China and Germany from a comparative perspective. It covers the main legal
issues of consumer privacy and data protection in these countries and seeks to
explain current issues and case law concerning consumer data protection from
a practical perspective.
y
n Consumer Data Protection in Brazil,
a
m
r China and Germany
e
G

d
n
a
A Comparative Study
a
n
i
h
C

,
l
i
z
a
r
B

n
i

n
o
i
t
c
e
t
o
r
P

a
t
a
D

r
e
m
u
s
n
o
C
Board of Editors
Rainer Metz
Jörg Binding
Pan Haifeng
Coordinating Editor
Florian Huber
ISBN: 978-3-86395-236-5 Universitätsverlag Göttingen Göttingen University Press

Consumer Data Protection in Brazil, China and Germany

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0
International License.
Published by Göttingen University Press 2016
Consumer Data Protection
in Brazil, China and
Germany
A Comparative Study

Edited by
German Federal Ministry of Justice and
Consumer Protection
State Administration for Industry and
Commerce of the People´s Republic of China
National Consumer Secretariat, Ministry of
Justice of the Federal Republic of Brazil
Deutsche Gesellschaft für Internationale
Zusammenarbeit (GIZ) GmbH

Board of Editors: Rainer Metz, Jörg Binding,
Pan Haifeng
Coordinating Editor: Florian Huber

Göttingen University Press
2016
Bibliographic information published by the Deutsche Nationalbibliothek
The Deutsche Nationalbibliothek lists this publication in the Deutsche
Nationalbibliografie; detailed bibliographic data are available on the Internet at
http://dnb.dnb.de

This work is protected by German Intellectual Property Right Law.
It is also available as an Open Access version through the publisher’s homepage and
the Göttingen University Catalogue (GUK) at the Göttingen State and University
Library (http://www.sub.uni-goettingen.de).
The license terms of the online version apply.

Set and layout: Franziska Pannach
Cover design: Jutta Pabst
Cover picture: Maksim Kabakou/shutterstock.com

© 2016 Göttingen University Press
http://univerlag.uni-goettingen.de
ISBN: 978-3-86395-236-5
Table of Contents
Table of Contents.............................................................................................................. 1
Chapter 1: Study Structure ........................................................................................... 7
A. Project Summary ................................................................................................... 7
B. Research Activities ................................................................................................ 9
C. General Overview of the Study ........................................................................ 10
Chapter 2: Country Studies on Consumer Data Protection
(Brazil, China, Germany) and International Initiatives ............................ 13
A. Consumer Data Protection in Brazil (Prof. Dr. Danilo Doneda) ................... 13
I. Introduction ...................................................................................................... 13
II. Overview and scope of legislation addressing consumer data
protection ................................................................................................ 14
1. Character of legislation .................................................................. 14
2. General legal framework for consumer data protection .......... 17
3. Telecommunication ....................................................................... 17
4. Banks ................................................................................................ 18
5. Media-related acts ........................................................................... 18
2 Table of Contents
6. Specific acts for e-commerce ........................................................ 18
III. Applicability of data protection acts .......................................................... 19
IV. Definitions of consumer and data .............................................................. 20
V. General guiding principles ............................................................................. 22
VI. Collecting, storing and processing consumer data ................................... 24
VII. Approaches to consent ............................................................................... 24
VIII. Publicity and transparency ........................................................................ 25
IX. Data security .................................................................................................. 26
X. Data control, data portability and the right to access, modify and
delete collected data ............................................................................... 26
XI. Roles and responsibilities of intermediaries .............................................. 27
XII. Access to user data by third parties .......................................................... 28
XIII. Provisions on data retention .................................................................... 28
XIV. Transfer of data on an international scale, transfer to third
countries and requirements for data transfer outside the country . 30
XV. Enforcement ................................................................................................. 30
1. Civil law ............................................................................................ 32
2. Criminal law ..................................................................................... 33
3. Administrative law .......................................................................... 33
XVI. Role of self-regulation and co-regulation ............................................... 34
B. Consumer Data Protection in China (Prof. Dr. Zhou Hanhua) ..................... 35
I. Introduction ...................................................................................................... 35
II. Overview and scope of legislation addressing consumer data
protection ................................................................................................ 36
1. Character of the legislation ........................................................... 36
2. General legal framework for consumer data protection .......... 41
3. Telecommunication ....................................................................... 44
4. Banks ................................................................................................ 45
5. Media-related acts ........................................................................... 47
6. Specific acts for e-commerce ........................................................ 48
III. Applicability of data protection acts .......................................................... 49
IV. Definition of consumer and data ................................................................ 50
V. General guiding principles ............................................................................. 51
VI. Collecting, storing and processing consumer data ................................... 53
VII. Approaches to consent ............................................................................... 54
VIII. Publicity and transparency ........................................................................ 56
IX. Data security .................................................................................................. 57
Table of Contents 3
X. Data control, data portability and the right to access, modify and
delete collected data ............................................................................... 58
XI. Roles and responsibilities of intermediaries .............................................. 59
XII. Access to user data by third parties .......................................................... 62
XIII. Provisions on data retention .................................................................... 63
XIV. Transfer of data on an international scale, transfer to third
countries and requirements for data transfer outside
the country .............................................................................................. 64
XV. Enforcement ................................................................................................ 64
1. Civil law ............................................................................................ 64
2. Criminal law .................................................................................... 66
3. Administrative law .......................................................................... 68
XVI. Role of self-regulation and co-regulation ............................................... 70
C. Consumer Data Protection in Germany (Prof. Dr. Gerald Spindler) ............. 71
I. Introduction ...................................................................................................... 71
II. Overview and scope of legislation addressing consumer data
protection ................................................................................................ 72
1. Character of the legislation ........................................................... 72
2. General legal framework for consumer data protection .......... 76
3. Telecommunication ....................................................................... 76
4. Specific acts for e-commerce ........................................................ 76
III. Applicability of data protection acts .......................................................... 77
IV. Definitions of consumer and data .............................................................. 81
1. Personal data under the Data Protection Directive .................. 82
2. Personal data under the General Data
Protection Regulation ....................................................... 88
V. Basic concepts ................................................................................................. 91
VI. Collecting, storing and processing consumer data ................................... 94
VII. Approaches to consent .............................................................................. 95
1. Informed consent according to the Data Protection
Directive ............................................................................. 96
2. Informed consent and obligation of transparency under
the General Data Protection Regulation ....................... 97
VIII. Publicity and transparency ........................................................................ 99
1. Information ..................................................................................... 99
2. Notification ................................................................................... 100
3. Privacy by design and default ..................................................... 100
4. Privacy seal .................................................................................... 101
4 Table of Contents
IX. Data security ................................................................................................ 102
X. Data control, data portability and the right to access, modify and
delete data collected ............................................................................. 103
XI. Roles and responsibilities of intermediaries ............................................ 104
1. Controller and processor under the Data Protection
Directive ........................................................................... 105
2. Controller and processor under the General Data
Protection Regulation ..................................................... 112
XII. Access to user data by third parties ........................................................ 115
XIII. Provisions on data retention .................................................................. 115
XIV. Transfer of data on an international scale, transfer to third
countries and requirements for data transfer
outside the country .............................................................................. 116
1. By processor outside the EU/
European Economic Area (EEA) ................................ 116
2. Data transfer to third countries .................................................. 116
XV. Enforcement ............................................................................................... 125
1. Civil law .......................................................................................... 125
2. Criminal law ................................................................................... 126
3. Administrative law ........................................................................ 127
4. The Data Protection Officer ...................................................... 128
XVI. Role of self-regulation and co-regulation ............................................. 133
D. Review of International Initiatives on Consumer Data Protection
(Consumers International) ..................................................................... 134
I. UN Guidelines for Consumer Protection .................................................. 134
II. OECD Guidelines ........................................................................................ 135
III. The Global Privacy Enforcement Network (GPEN) ........................... 141
IV. Convention 108 ........................................................................................... 145
V. Regional Initiatives........................................................................................ 147
1. Asia Pacific Economic Cooperation (APEC) .......................... 147
2. Association of South East Asian Nations (ASEAN).............. 149
3. Economic Commission for Latin America and
the Caribbean (ECLAC)................................................. 150
Chapter 3: Law in Practice: Current Issues, Challenges and Case-Law
for the Enforcement of Laws and Regulations on
Consumer Data Protection ............................................................................... 153