IT law and Internet law

For many companies, the distribution channel via their own webshop appears to be cost-effective and lucrative. The operator of the webshop has to observe a large number of legal requirements in order to minimise the risk of receiving reprimands and warnings from competitors, however:

• For example, in order to be legally compliant, the web shop requires not only a data protection declaration and an imprint, but also an up-to-date, individual design of its own general terms and conditions (GTC).
• One frequent cause of reprimands and warnings is the sending of newsletters to recipients who may not have ordered one, or the use of photos, videos or texts for which there are third party copyrights or which are inadmissible under competition law (e.g. due to a misleading description). 
• It is also indispensable in online trade with consumers to have a cancellation policy when concluding a contract. In this context, it is advisable not to deviate from statutory model revocation declarations. 

Outsourcing means shifting services to an external service provider. In essence, outsourcing is about working together as partners, which is of course laid down in a set of contracts. Don’t be too hasty in choosing service providers. Often the advantages and disadvantages of the various offers only become apparent through a comparison with other providers. In any case, you should spell out the rights and obligations of a service provider in a precise outsourcing contract. In addition to this contract, a data protection agreement on commissioned processing (ADV) must generally be concluded with service providers in accordance with the GDPR. From a data protection perspective, you need to pay particularly close attention to technical and organisational measures to ensure data security as well as the location where the data processing takes place. Especially if a service provider from a non-EU country is involved, further precautions need to be taken. Pay particular attention to this point. Because when you commission a provider in connection with outsourcing, important tasks and thus data and information of the company are transferred to them. An outsourcing contract therefore always affects the areas of data security and IT security. Advice from a specialised lawyer is a sound investment in such cases.

Following a spate of reprimands and warnings, the imprints of many companies have improved in recent years. However, due to changes in the law, new obligations have to be met from time to time. In addition, numerous particular obligations apply to special providers (e.g. professionals, the medical sector, the financial sector) that are occasionally overlooked. Or are not even requested by online generators used to create an imprint. Companies are often unaware that the creation of an imprint is also legally required for their social media sites and apps - a popular starting point for competitors to send out a warning. But even if a company is aware of the need to provide an imprint in all its telemedia, social networks or apps sometimes confront companies with graphic or technical challenges.

If you want to use cookies or plug-ins on your website that are not technically necessary for the operation of the website and may even transfer data to a third party company, you need the consent of website users. This consent is usually obtained by means of a cookie banner. The following requirements are applied to cookie banners:

• The cookie banner must be visible to users when the website is first opened. Access to the imprint and the data protection declaration must be possible via the cookie banner. Only when users give their consent may the cookies (which require consent) be activated.
• Users must - insofar as consent is required - give self-determined and voluntary consent to the cookies and this must be done proactively, such as by placing a tick in the cookie banner. If the tick is set automatically, consent to the cookies is null and void, as it was not given by the user. 
• Each cookie requiring consent must be listed with the name of the service provider and functions and it must be possible to be activated individually by the user in the cookie banner.
• The user must be able to easily revoke consent to the use of cookies on the website (e.g. in the data protection declaration) at any time.
• In addition to "normal" cookies, tools are also used that initially suppress the content of a plug-in (e.g. an embedded video) and only reload it after another click on the consent - the so-called double-click method. Contact us if you have any questions about this or the topic of cookies. 

Many SMEs believe they are unattractive to a hacker attack. But in 2020, a representative study of 1,000 SME entrepreneurs revealed that almost half had already been victims of a hacker attack. What can you do if you have already been hacked?

• In order to expose vulnerabilities and ascertain possible traces left by the attackers, a forensic analysis by IT specialists should be initiated immediately.
• Provided you have taken this important precaution, you should check your existing insurance coverage and inform the insurance company about the incident.
• Technical, organisational and legal protective measures must be adapted, as exemplified by the development and implementation of a protective concept for the protection of business secrets.
• If necessary, legal claims such as injunctive relief and claims for damages can be asserted. In addition, criminal charges can be filed and in some cases sanctions under labour law can be invoked.
• Data protection reporting obligations are to be reviewed and an improvement in the information security management system is to be initiated.

75% of the companies that were hacked suffered significant damage. Therefore: You need to create a comprehensive security strategy and an emergency plan working together with an expert. To make sure that your company is well prepared for any attack, which hopefully will not happen in the first place.