The German Government approved a draft law to strengthen the private enforcement of certain data protection law provisions that aim to protect consumers. In particular, the draft law empowers consumers and other qualified associations to send cease-and-desist letters and to initiate legal action for injunctive relief against companies violating the law’s provisions. The draft Act targets the data handling practices of companies whose business models are based on the commercialization of data. The draft law plays a pioneering role and pre-empts similar types of class actions that the European Commission has proposed in its draft General Data Protection Regulation. It will now have to pass the legislative process, requiring parliamentary approval, before it can enter into force.