Search results for
Lawyers
Dr. Oliver Hornung advises national and international IT service providers and users in the legal structuring and negotiation of IT, project, and outsourcing contracts, as well as in matters of copyright and licensing. He is also regularly involved in distressed projects (dispute management) and advises clients in conciliation and arbitration proceedings and, where necessary, in litigation.
Due to his industry focus on digital business, Dr. Oliver Hornung advises his clients on all legal matters dealing with cloud computing, Big Data, Industry 4.0, and FinTech.
Another focus of his practice is data protection and IT compliance. Dr. Oliver Hornung advises cloud providers and users in developing national and international data protection concepts and on IT compliance. He currently advises on numerous projects to implement the EU General Data Protection Regulation.
Finally, Dr. Oliver Hornung advises start-ups on all questions relating to IT law and data protection law. In addition to his extensive practical work, Dr. Oliver Hornung is also a frequently requested lecturer in IT law and data protection law.
Norbert Klingner specializes in national and international movie/TV and advertising film production, financing, insurance, and distribution. He represents well-known producers, distributors, global distributors, and movie financing entities. His expertise ranges from negotiating and drafting contracts from the beginning of the material development to all matters related to production and financing up to the strategically correct exploitation and licensing. A selection of the film productions in which Mr. Klingner was involved can be found on the Internet Movie Database IMDb.
News
KI-Flash: DeepSeek AI - Navigating Legal & Cross-Cultural Challenges
Just published in the New York Law Journal: William A. Tanenbaum and Dr. Matthias Orthwein, LL. M. (Boston) examine the Chinese AI model DeepSeek's dual-edged implications for international business.
Their analysis covers:
- Impact of the Thomson Reuters fair use ruling on AI training data
- DeepSeek as insight tool for Chinese business perspectives
- Data confidentiality risks and corporate espionage concerns
- GDPR compliance challenges facing European operations
- Actionable guidance for corporate AI governance
Essential reading for cross-border businesses and legal professionals navigating the evolving AI landscape.
Read the full article here.
We recycle ourselves! - OLG Frankfurt a.M. on mislea-ding advertising of an ecological cleaning agent
The decision of the Federal Court of Justice (BGH) in the ‘climate-neutral’ case on the competition law requirements for advertising with ambiguous, environmentally-related terms is now being implemented by the courts of first instance. After the Higher Regional Court of Cologne commented on CO2-neutral travel, the Higher Regional Court of Frankfurt a.M. now also considers ambiguous advertising statements on the environmental compatibility of recycling material from the yellow bag, on the defendant's recycling efforts and on climate neutrality to be misleading and also applies the standards to web links to further information (Higher Regional Court of Frankfurt a. M. (6th Civil Senate), judgement of 12/19/2024 - 6 U 33/24).
Advertising statements on pollutant content and carbon footprint
The dispute between two manufacturers of ecological laundry detergents and cleaning products before the Frankfurt Higher Regional Court centred on advertising statements made by the defendant about its dishwasher detergent bottles. Specifically, it concerned the statements that these were the ‘first recycled bottles’ from the defendant itself, that it would recycle them itself, and that ‘recycled PE’ from the yellow bag could always contain residues of synthetic fragrances, heavy metals, pesticides, etc.
In addition, the defendant used the ‘climate neutral’ logo of the company ClimatePartners on its homepage, behind which a website with further information could be called up by clicking on it. The plaintiff considered the advertising claims and the presentation of the information on ‘climate neutrality’ to be misleading.
Ambiguous environmental term ‘recycled PE’ not sufficiently explained
The Higher Regional Court of Frankfurt a.M. has now largely ruled in favour of the plaintiff. The term ‘recycled PE’ was ambiguous in the specific context. It could either refer to already recycled polyethylene or the source material or plastic (‘PE’) from the Yellow Bag. If, as the defendant had to accept, the statement was understood in relation to the already finished recyclate, this would be misleading, because this material would in any case not harbour a higher risk of containing heavy metals and/or pesticides if the starting material was sufficiently processed as usual by the plaintiff and in accordance with the state of the art. The defendant should have clearly and unambiguously resolved this ambiguity in the advertising itself.
Environmental contribution must be more than just symbolic
The court also considers the defendant's statement that it recycles itself to be misleading because consumers would expect that a significant return system already exists and that the specific product depicted has outer packaging that consists at least to a significant extent of recycled material. However, the defendant had set up a maximum of 150 return boxes in small and smaller organic markets and the proportion of self-recycled bottles was therefore well below 1%. In addition, a large number of the new bottles advertised were made entirely from virgin plastic.
Clear references to links to further information necessary
The court also commented on the specific presentation of further information on climate neutrality by means of a link behind the climate neutral logo, which was not relevant to the decision. Although a link is permissible in principle, it must be sufficiently clear and unambiguous. However, the public would not expect or regularly simply find out that a corresponding link was hidden behind the logo. A clear reference to the link is therefore necessary.
Conclusion: Requirements for environmental claims further specified
The Higher Regional Court of Frankfurt a.M. continues the case law of the Federal Court of Justice on ‘climate neutral’ and shows that there is a fundamental risk that environmental terms, in this case ‘recycled PE’, have more than one meaning. This ambiguity must therefore be taken into account in environmental advertising and clarified on the spot. Anyone using a link to further information must make sufficient reference to this.
Podcast "ILTA Voices" zum Barrierefreiheitsstärkungsgesetz
Is your firm or business ready for the European Accessibility Act (EAA)? In the latest podcast of the International Legal Technology Association (ILTA), Yves Heuser and Johannes Schäufele broke down this game-changing regulation, exploring who needed to comply, key deadlines, and how to meet accessibility standards. From practical steps to enforcement measures, we covered everything you needed to know to stay ahead of the 2025 requirements.
You can listen to the audio of the recording here.
SKW Schwarz: 18 Lawyers Recognized as "World's Leading Practitioners Germany 2025" in Six Categories
The prestigious Lexology Index (formerly Who's Who Legal) Germany 2025 has recognized 18 experts from SKW Schwarz as leading lawyers in Germany. These accolades span six key legal areas.
The honored experts are as follows:
Commercial Mediation:
- Dr. Alexander Steinbrecher
Data:
- Nikolaus Bertermann
- Oliver M. Bühr
- Dr. Matthias Nordmann
- Dr. Matthias Orthwein
- Dr. Andreas Peschel-Mehner
- Stefan C. Schicker
- Prof. Dr. Mathias Schwarz
- Martin Schweinoch
IP-Trademarks:
- Dr. Dorothee Altenburg
- Dr. Magnus Hirsch
- Margret Knitter
- Sandra Sophia Redeker
Life Sciences:
- Dr. Matthias Nordmann
- Dr. Tatjana Schroeder
- Markus von Fuchs
Product Liability Defence:
- Arndt Tetzlaff
Sports & Entertainment:
- Dr. Johann Heyde
- Götz Schneider-Rothhaar
- Prof. Dr. Mathias Schwarz
The inclusion of these lawyers underscores SKW Schwarz's leading position in Germany. The Lexology Index is considered one of the foremost international accolades in the legal market, based on comprehensive analyses and evaluations by clients and industry experts.
Trump vs. EU-US Data Privacy Framework?
News about Trump's inauguration and the first laws he has enacted are currently piling up. In addition to many other serious and worrying consequences for the USA, these could also have a significant impact on the EU-US Data Privacy Framework and therefore also have a major impact on European companies.
As the New York Times reported on January 22, three members of the five-person „Privacy and Civil Liberties Oversight Board“ (an agency that is supposed to be a watchdog and protect Americans from abuse by surveillance agencies) received letters this week asking them to resign by Thursday or prepare to be fired.
It is not yet clear whether Trump plans to appoint new members or leave these positions vacant. The latter would mean that the Privacy and Civil Liberties Oversight Board would effectively be shut down. This could be a piece of the puzzle that could cause the EU-US Data Privacy Framework, the adequacy decision for data transfers to the USA, to crumble.
One of the main arguments that brought down the predecessor decision to the EU-US Data Privacy Framework - namely the EU-US Data Privacy Shield - was that the US security authorities had too extensive access rights and could access all data stored by US companies almost without sufficient reason or individual court approval.
However, the matter with the Privacy and Civil Liberties Oversight Board will not be Trump's last action concerning data protection in the US. In one of the first executive orders signed by Trump, he decided that all of Joe Biden's national security decisions (including the relevant decisions on which the EU-US Data Privacy Framework is based) should be reviewed and possibly discarded within 45 days. This could result in the removal of other key elements on which the EU-US Data Privacy Framework is based.
Practical note:
The fact is that the EU-US Data Privacy Framework is not automatically overridden by Trump's actions to date. It is up to the ECJ to determine whether the EU-US Data Privacy Framework provides an adequate level of protection for data transfers from Europe. However, this assessment will depend on how Trump structures the protection of personal data and access to it by the US security authorities
Data protection activist Max Schrems has already expressed his displeasure at the changes and Trump's behavior. It is therefore not unrealistic that the ECJ could reach a Schrems III decision. However, this would not happen immediately, but will probably take a few more months
If the EU-US Data Privacy Framework is declared invalid, this means that companies in Europe will no longer be able to base their data transfers when using tools from Amazon, Google, Microsoft and others on the adequacy decision. The conclusion of EU-US standard contractual clauses and the agreement of additional security measures will then once again play a central role. It is therefore advisable to keep an eye on current developments. We will of course keep you up to date accordingly.
Cologne Higher Regional Court on transparency in sustainability advertising: requirements for clarity and accuracy
Another ruling on a greenwashing allegation has been issued: The Cologne Higher Regional Court held that advertising by an airline with the statement “CO2-neutral travel ... offset now and take off” constitutes anti-competitive misleading conduct if the environmental impact is only offset in the future and this is not made sufficiently clear (OLG Köln, Judgment of 13 December 2024 – 6 U 45/24).
Background of the Decision: The case concerned Eurowings, a Lufthansa subsidiary, which offered customers the option to offset the CO2 emissions caused by their flights. This was to be achieved either through the use of sustainable aviation fuels or by investing in climate protection projects, such as forest conservation and reforestation initiatives. The advertisement was challenged by the consumer protection association Deutsche Umwelthilfe.
The Court's Reasoning: The court found that the design of the website created the impression that CO2 compensation occurred before the flight took place, i.e., prior to the customers' departure. A significant portion of consumers were likely to believe that the environmental impact of their planned flight would be offset immediately after purchase. In reality, however, the compensation was achieved through the use of sustainable aviation fuels, which might only be utilized on future flights. Additionally, the exact extent of the compensation remained unclear. Eurowings should have provided this information directly alongside its advertising. While it is true that customers could access further details via a chain of links on the website, the court ruled this insufficient. Instead, the relevant information needed to be made directly available in connection with the advertising itself.
In its reasoning, the Cologne Higher Regional Court referenced the landmark decision of the Federal Court of Justice (BGH) on climate neutrality (BGH, Judgment of 27 June 2024 – I ZR 98/23). According to this decision, companies may only use ambiguous environmental terms such as “climate neutral” if the advertisement itself makes it clear what specifically renders the advertised product sustainable. For consumers, it is crucial to understand whether emissions are genuinely avoided or merely “offset.”
Conclusion: The ruling makes clear the need for meticulous scrutiny when advertising with sustainability terms. Courts demand that such advertising claims be complete and accurate on their own. In cases of ambiguity, any necessary clarification must be provided directly alongside the advertising claim. The courts do not accept the argument that there is typically insufficient space to include a comprehensive explanation.
CJEU ruling on works agreements
In December, the CJEU dealt with the data protection effect and judicial reviewability of company agreements in Germany (judgment of December 19, 2024, case no. C-65/23). The focus is on the question of the conditions under which national legislation and collective agreements may lay down specific rules for the processing of employee data. The CJEU also provided guidance on the judicial reviewability of company agreements. The decision is also important for international groups of companies with subsidiaries in Germany. If a works council exists in these companies, existing group-wide regulations must also meet the requirements of the new CJEU ruling.
Background
Art. 88 GDPR allows member states to adopt regulations on employee data protection at national level. With the introduction of Section 26 BDSG, the German legislator has made use of this option and, in Section 26 (4) BDSG, made it possible for the parties to a company to base the processing of personal data on a works agreement.
Although the CJEU has already expressed considerable doubts about the effectiveness of the general clause of Section 26 para. 1 sentence 1 BDSG (judgment of March 30, 2023, Ref. C-34/21), these concerns expressed by the CJEU do not apply to data processing on the basis of collective agreements in accordance with Section 26 para. 4 BDSG.
Requirements for works agreements
With regard to the first question referred, the CJEU initially states that the parties are entitled to adopt "more specific provisions" on data processing in accordance with Art. 88 para. 1 GDPR. However, the CJEU has clarified that national legislation and collective agreements must not only meet the specific requirements of Art. 88 para. 2 GDPR, but must also comply with the general provisions of the GDPR, in particular Art. 5, 6 and 9 GDPR. Otherwise, national legislation and collective agreements could undermine the protection standards of the GDPR. Art. 88 GDPR does not allow the provisions of the GDPR to be undermined.
In practice, we therefore believe that there is effectively no longer any room for works agreements as an independent legal basis for data processing in the employment context. Due to the CJEU's reference to the fact that the requirements of Art. 6 and Art. 9 GDPR must always be met, all data processing must therefore meet the requirements of at least one of the legal bases mentioned therein. Accordingly, works agreements can only specify these legal bases standardized in the GDPR. Consequently, the parties to the works agreement can - as was previously the case - agree which data processing or which performance and conduct checks are carried out in the employment relationship, but they do not create any new independent legal bases, but rather specify the legal bases from the GDPR - for example Art. 6 para. 1 letter b) GDPR (data processing for the performance of the employment relationship) or Art. 6 para. 1 letter f) GDPR (balancing of interests between the legitimate interests of the employer and the interests of the employees worthy of protection).
Judicial reviewability
With regard to the second question referred, the CJEU emphasized that collective agreements are subject to full judicial review pursuant to Art. 88 GDPR. The parties to a collective agreement have an equivalent margin of discretion to that of the Member States when adopting national legislation.
In practice, this means that works agreements under employment law must always be measured against all relevant requirements of the GDPR and are not sufficient as the sole legal basis. Employers must also ensure that works agreements do not fall below the level of protection provided by the GDPR. Data processing that is not permitted under the provisions of the GDPR cannot be made lawful by an effective works agreement.
Outlook on the prohibition of the use of evidence
The CJEU ruling makes no statement as to whether employee data processed on the basis of an ineffective works agreement is subject to a ban on the use of evidence in a legal dispute. The CJEU will still have to decide on this by way of a referral from the Lower Saxony Higher Labor Court (decision of 8.5.2024 - 8 Sa 688/23 in German only).
Practical tips
- Check legal basis: Even if collective agreements pursuant to Section 26 (4) BDSG and Art. 88 GDPR can be formally used as a basis for the processing of employee data, company parties should always (additionally) rely on one of the general legal bases of Art. 6 and 9 GDPR.
- Comply with GDPR requirements: As data controllers under data protection law, employers must ensure that all processing of employee data complies with the general requirements of the GDPR. This applies in particular to the principles of Art. 5 GDPR (e.g. lawfulness, transparency, purpose limitation and necessity) as well as the specific requirements of Art. 6 and 9 GDPR.
- Consider judicial reviewability: Works agreements, like national legislation, are subject to full judicial review. Works councils therefore do not run the risk of undermining the rights of employees through a works agreement. Employers as data protection officers must also keep an eye on the decision-making practice on data protection issues when concluding works agreements and should always involve the data protection team in the negotiation of works agreements.
- Review of existing works agreements: The parties should review existing works agreements to determine whether they comply with the requirements of the CJEU ruling and make any necessary adjustments.
400 EUR/per person for data transfers to the USA?
Do data transfers to the USA have a price tag of 400 EUR/per person since the latest EC ruling? The good news is first of all: No, not automatically. The facts of the judgment of the European Court of First Instance of January 8, 2025 (T-354/22) take place in 2021 and 2022, during which time there was greater legal uncertainty regarding data transfers to the USA due to the overturned EU-US Privacy Shield. Since July 10, 2023, there has been a new adequacy decision for the USA in the form of the EU-US Privacy Framework. Meta, Amazon, Microsoft and the other major providers are now all certified under this new framework.
The facts of the case were as follows: In the lawsuit, a citizen resident in Germany took action against the EU Commission and claimed damages for the fact that his IP address was transmitted to the Facebook company in the USA (Meta Platforms, Inc.). He had visited the website of the Conference on the Future of Europe (a website of the EU Commission) several times in 2021 and 2022 and also registered for an event. As part of the registration process, he used the “EU Login” offered by the EU Commission and chose the “Facebook Login” option, a verification via his Facebook account. As part of this verification request, the corresponding website transmits the IP address of the registrant to Meta. The EC confirmed the plaintiff's view with regard to the one claim for damages and considered the transmission of the plaintiff's IP address to a company based in the USA to be unlawful. The plaintiff had suffered non-material damage in that he had lost control over his data and had been deprived of his rights and freedoms.
The judgment is not final and can be challenged before the ECJ. It is not yet known whether the EU Commission will take action against the ruling. At first glance, there would certainly be points of attack, particularly with regard to the unlawfulness of the transfer and the requirements for the causal connection.
Practical implications
Even if the facts of the case would be assessed differently today under the EU-US Privacy Framework, the ruling still has important practical implications. It is not new that there must be a corresponding legal basis for data transfer to the USA. However, this decision, which mind you awarded a claim for damages even against an EU authority (the EU Commission itself!), shows how strict the courts can be when it comes to third country transfers. Furthermore, there is a risk that this decision could now also be used in any legal dispute regarding (alleged) data protection violations in third country transfers, especially when it comes to quantifying specific claims for damages. If the transmission of the IP address alone can trigger damages of EUR 400, higher sums are conceivable in the case of more serious infringements. And with many visitors to the website, the liability risk for the operator can increase accordingly. It is also to be feared that so-called “warning law firms” will become active as a result of this decision. It is therefore advisable for companies to take this decision as an opportunity to “clean up” their websites once again with regard to the topic of “third country transfer” and, in particular, to review their data protection information to ensure that users are adequately informed about the transfer of their data. The same generally applies to the use of third-party service providers on websites and the use of cookies.
The decision is also interesting from another practical perspective: in this case, the court specifically examined whether there was a “genuine” transfer of the IP address to servers in the USA. The court did not consider the mere risk of access from a third country to be a “transmission”. This is very relevant in practice, as almost all major US providers contractually leave themselves the option of being able to access support requests from a third country, for example. This also applies if Europe has been selected as the server location. This decision can therefore also be used for other proceedings in the event of a defense.
In this article, we would only like to provide a brief classification for companies in practice. However, for people who are particularly interested in complex issues of data protection law, it is also interesting to look at the comments on the “causal connection” of the damage in this judgment. In particular, the court denied the causal link with regard to a further claim for damages because, according to the court, the damage was due to the conduct of the plaintiff himself. He had used technical settings to pretend that he was in the USA. This then led to Amazon's content delivery network (Amazon CloudFront), which is based on a routing mechanism that works via proximity, selecting servers in the USA.